SOLVED: I’m testing access to an Access Gateway with OAuth. The Netscaler is OAuth SP and Entra is OAuth IdP. The OAuth application is multi-tenant. After successful authentication in Entra the user has access to resources. So far no problem. What I’m trying to achieve is after successful authentication in Entra the user only gets access when the tid attribute has certain values. I guess nFactor is the solution. Do you have an example how to do that?

Hi Joost, maybe this can help you

Hi Julian, I’m familiar with some of your documentation. It’s one of reasons why we switched from SAML to OAuth! 🙏 If I understand your link correctly the user has to enter his username first. Correct? That’s the challenge! I want it to be seamless for multiple customers. I’m testing with this multi-tenant application and that is working perfectly. But Entra has no mechanism to restrict which tenants may use the application. You have to manage that in another way. So I hope Netscaler can do that job for this access gateway. And when I want it to be seamless the user must authenticate in Entra before the attributes are known to Netscaler AFAIK. If I could use an expression at that moment I can match attributes with a pattern set. I hope this makes sense.