Hello, Hoping somebody might be able to help me out here. I am deploying Self Service Password Reset for a pilot. All working as expected using advanced authentication policies on the AAA vserver using the method documented by Carl S here - https://carlstalhood.com/self-service-password-reset-citrix-adc/. However i want to switch to nFactor so i can put in a check for user group membership to accommodate a group of pilot users. First factor has policy 1 to detect if somebody hits "Reset Password", policy 2 for authentication and user registration check, sspr login schema bound. The second factor on the login/registration check path is a decision block using AAA.USER.Is_Member_Of("groupname") on one policy and !AAA.USER.Is_Member_Of("groupname"). The positive check is the first in the priority list but it never hits it. I can see in aaad.debug logs that it sees the user is in the correct group. I can see with nsconmsg that it is hitting "Non_SSPR_User" policy. Netscaler version 14.1 34.42.

Is there a Policy/Profile with the login schema that has the "Reset Password" selection configured? I cannot see the flow that well. I am glad they have improved the flow visibility in 14.1. Anyway. we have a few nFactor blogs on the Ferroque Systems website that might be of help to you in configuring the loginschema.xml file you are needing to create the option to direct the flow to as you can. For example, this article shows the initial flow no_schema option that would allow the reset password button push to be evaluated first. You can see this in the flow diagram posted. https://www.ferroquesystems.com/resource/howto-build-a-saml-based-environment-selector-citrix-nfactor-flow/

Hey Richard, i am using the built in singleauthpasswordreset.xml on the initial flow. This is working fine if i click on password reset i.e sends me down the password reset flow. It is the decision block to check the user group membership that isnt detecting a user in the group specified for some reason. Thanks for sharing the blog though, i will read it now and see if get any clues.

Not related, but has someone done this /wo security questions? I mean, using TOTP or somerhing else…

I looked into trying it with TOTP previously as the client did not want to use the alternative email but I couldn't find a valid/supported way of doing it.

I misunderstood, I was thinking the the password one was not working. Some simple things that mess me up in the past have been case sensitivity. etc.

Hi, I did it with some SAML Authentication (IDP was showing only a Push Notification and not asking for a password) and afterwards sending an OTP to an alternative Mail address. But to be honest I did it on 13.1 with the advanced authentiation policies and labels but no authentication Flow diagram