Hi Guys, do you have any recommendations for MFA solutions for external partners? Background: We have many external users accessing our internal resources through NetScaler. Each external user has an AD account in a "partner" subdomain. Currently, we use Entrust Identity Essentials for MFA, which sends a one-time password (OTP) via email when they authenticate. We want to stop using emails as the second factor and switch to an authenticator app, like Microsoft or Google Authenticator. I'm also unsure if this is the best strategy for authenticating external users, so I appreciate any input or advice.

NetScaler's native OTP (Advanced License) or Push OTP (Premium License) you can use unlimited tokens for free. It does a good job for that usecase. But remember the OTP-store is Active Directory (encrypted with cert) - this should match your security policy. If you need some technical informations, see https://www.julianjakob.com/citrix-netscaler-native-otp-and-push-otp-in-combination/

@Julian Jakob cool, I wasn't aware of this feature! @Jonas Ziegler Have you converted your licenses to the new HMC licenses? If so, you could benefit from this. Otherwise, if using an Identity Provider is an option, Cisco Duo or HID could serve as alternatives to Entra ID.

Thanks a lot! Yes I have already migrated to the HMC license, so I'll look into it. @Julian Jakob one more question, how would you handle mobile device registration in this case? The users I need this solution for are never in the company network, and it doesn't seem like a good idea to make the device registration page accessible to everyone on the internet.

There are two options which I've used at customer-setups. 1. Use NetScaler's E-Mail OTP to protect the Token-Registration page, first Logon to the Token-Registration will send an email otp. Further Logons will require native / push OTP. When OTP is cleaned (by helpdesk for example) the email otp is used, again. 2. Token-Registration page is not published to External. Use a "NoMFA-Emergency" AD-Group which is bound to your nFactor. Users in that Group do not require MFA to logon. When there's created a new external partner user, the user is put inside the Group. When signing on to NetScaler, there's a warning that it's only a "One-Time No-MFA Logon" and now from the internal network the user should directly enroll the OTP. A Script is cleaning the Group every night, so at the following day, MFA kicks in.

Alright, thanks for the input

There is a good write up on the NetScaler Community site on exactly how to do it and register the devices. https://community.citrix.com/tech-zone/learn/poc-guides/native-otp-registration-and-otp[…]ation-for-netscaler-gateway-using-one-unified-loginschema/

Many customers have also accepted that the initial token registration can be done just with user/pass. We've just configured the nFactor so that they're not able to log in to the actual system (which always requires MFA), just the OTP page. What Julian suggested, seems like a really good option in your case though... requiring the old MFA for token registration and then configuring nFactor so that if the OTP hash is present in LDAP, that authentication will take precedence also for the OTP management page, allowing you to sunset the old MFA eventually.

Another alternative is https://privacyidea.org.

If you/they already have Entrust Essentials why not use the Idaas integration and use push auth through Entrust Identity, or use some other MFA method in Entrust Essentials?

Thanks for all the tips! @Anders Wittendorff I considered to use another MFA method in Entrust, but as far as I know you can only do this in combination with the Entrust Identiy App. I want to avoid the use of a second authenitcator app since they already use the one of Microsoft/Google

@Jonas Ziegler You can use Microsoft/Google Authenticator with Entrust both with and without the Idaas integration, you just use the Soft Token feature.