nice, hopefully they come out with something for users who have 'standard' licenses still.

This is huge for us as a company - we were looking to find a workaround with other providers since Duo was removing iframe and Citrix seemed to have no path forward. Tested this today in dev and it is working nicely.

That exact problem happened to me a few weeks ago when I upgraded to the latest 14.1 from 13.1. have been looking for a solution for weeks. Didn’t submit a ticket. I’ll have to look into it more, but it only happened to us for accessing it through a chromium browser. Safari works on Mac and fire fox works on windows. Hardware keys like a Ubikey are broken in the working browsers .Fortunately, the workspace app still works

I upgraded my qa to latest 14.1 which broke the iframe. but that ver also fixes an issue with importing certificates. has anyone been able to get iframe working on latest 14.1? The policies indicated in the workaround are not working for me and for some reason when I edit httpd.conf it reverts back on reboot.

Still trying to wrap my head around DUO+NetScaler+FAS completely. SAML support apparently requires more advanced licensing and config at the DUO side which makes me nervous. But... The sheer amount of work getting Standard to work with nFactor is frustrating... but possible: https://docs.netscaler.com/en-us/netscaler-gateway/current-release/authentication-authorization/nfactor-for-gateway-authentication#create-[…]license Just wondering to follow up on this thread if people have gotten this to work with NSG Standard and have stories to tell...

The oath duo without fas requires the advanced or better netscaler license. The saml/duo option works with standard. The 3rd option, which is radius, will work too, but it's automatic push, ther is no gui for the mfa prompt.

Bro- you know me better than that 😉

They are still supporting radius, they just aren't supporting iframe

Hmmm... customers were told to get off of RADIUS?

The first two options provide the best user experience, but more variables to troubleshoot

we can chat separately about the amount of work this could have saved me had I known that nuance

If your NetScaler deployment does not meet the requirements for Duo via OAuth or Duo Single Sign-On, the alternative is to reconfigure your existing radius_server_iframe Duo Authentication Proxy application so that it does not use the iframe, for example, Duo RADIUS Challenge Text Prompt for NetScaler nFactor or RADIUS with Automatic Push.

I got OAuth setup on the 14.1 instance in our secondary site pretty easily this afternoon. From a user experience perspective, OAuth seems much more inline with what they're accustomed to seeing compared to SSO, which seemed to redirect you to Duo immediately.