This message was deleted.

Nothing I can think of... Should not be an issue. We have two Gateways, each pointing to different LB'd Storefront servers, one setup with SAML(Okta)+FAS and the other with LDAP still. The users that don't use SAML are none the wiser that they're doing it the 'hard way' w/ LDAP+RSA SecurID for MFA vs SSO/SAML and MFA Push. The only thing holding us back is apps that still use AAA-TM SSO and don't have modern auth flows yet, that users SSO into when they provide credentials at the Gateway.

Thanks @Jon Bucud. So you use separate SF for SAML/FAS? Could do that. Is it possible to use same SF (but different stores) for both LDAP and SAML/FAS?

You can use the same SF, but and have different Stores setup with different auth methods enabled/configured. I chose to lift/shift as it was the path of least resistance for us. (OS upgrade, Major SF version upgrade, etc)

Yep makes sense, thanks. And the VDAs don’t care whether a user is logging on through FAS/Smartcard or old-school user/pass, we can mix and match?

They don't, just make sure you have the policy applied that points to the FAS server(s)

Roger that. Thanks Jon.