Hey all! I am an nFactor weakling and need some guidance. I have a situation that I think I have a solution for, but want to pass it by those more knowledgeable with building nFactor logic. I am working with the Citrix Adaptive Authentication service. My current nFactor logic is fairly simple. I have a single Authentication Policy bound with a priority of 100 and a "true" expression to send all authentication attempts to Duo SSO with SAML. The next and final factor is an unauthenticated LDAP UPN match. In this flow, as long as the user successfully authenticates to Duo and their UPN matches AD, they're good to go and can launch resources. I have a new requirement to send a subset of users to a different Duo SSO configuration based upon egress IP. What I am thinking about doing is creating a new Duo SSO policy, setting the expression to match the egress IP, and binding the Authentication Policy with a lower number priority than my existing "catch all" policy. Is this the proper away to go about configuring nFactor in this situation?

If you can tell based on their machine or a pre-scan, then you can use prioritization to send them to one SAML or another. But, you have to be able to know from the start which login they need to be presented. If you cannot, you can create a landing page where they can choose a login method and then send them to the appropriate SAML after they choose. We have a blog article here that discusses how to create a drop down list of options. https://www.ferroquesystems.com/resource/howto-choose-your-own-auth-factor-on-citrix-gateway-or-adaptive-auth/

Hi Richard! I was looking to avoid adding any additional pages or questions to the authentication flow. This is a temporary thing and I would prefer not to affect what an established user is already doing. I also do not have EPA configured, so I think that throws out the idea of client certs or reg values. I can't base the flow on user security group either, because when a user is authenticating from location A, I want them to hit one SAML policy and from anywhere else, the "catch all" SAML policy.

So, if they are at a particular location? Then you could create the policy and for the expression choose ip equals or contains as part of the expression. You can also create a list of IP addresses as a data source, and use that in the expression. Take a look at the expression editor and see if one of the possible items in there could work. There are truly way too many options to list.

Thank you!

you're welcome