what options are there for Gateway Service users that want MFA but don’t want FAS? I thought Native OTP and on prem RADIUS was on the roadmap but can’t find any recent info.

LDAP + Token does the job well

nice, I haven’t used it before, will give it a go

My only complaint is there is no push notifications

yeah that would be nice but I’m glad there’s a simple no FAS option without resorting to radius

You can do radius with adaptive auth

I’ve never been able to sell anyone on adaptive auth

plenty of very good scenarios for it - but if you don't need it, you don't need it

@James Kindon I wish they had the code and password on different pages, like Citrix Cloud Admin login page, as you have no idea if the code was wrong or the password, the feedback is only, try again or something like that.

My gripe is no push - hoping the PMs give in and hand it over at some point :-)

LDAP + token, and issue a yubikey. Avoids FAS, and keeps user from having to type numbers. Touch the token, boom, best thing ever. Of course you now have the cost of a physical item, and people will remember their phone before a fob

Now I’m going to go play with my spare yubikey

yeah this is interesting, I guess it’s the authenticator app that does all of it from that point so it’s not as if you can enforce yubikey right?