This message was deleted.

Have you taken a look at the step-up authentication docs? https://docs.citrix.com/en-us/citrix-adc/current-release/aaa-tm/configure-login-mechanism-authentication.html I haven't tried it with a gateway, but i assume it should work still

I'll have a look, thanks for that sir. Does that mean my observation is expected behaviour?

If they are seen as the same authentication level, then i would assume the gateway would just accept the already know credentials

If you want to prevent that behavior you can likely edit the authentication cookie domain so it's not matching both OWA and GW domain names. Under the hood AAA-TM and GW share authentication mechanisms, so if you have an active AAA session with the same authentication domain then that session will be valid for the gateway by default.

And where is the authentication cookie domain set? Is it the SSO Domain in the Session Profile?

The authentication domain setting is on the AAA-TM virtual server for classic policies

Sorry for my stupidity, but I can't find it. We have a Advanced Auth Policy bound to the vServer.

Oh if you're already on advanced auth policies then you should be able to control that in the Authentication Profile

Found it. There is no Authentication Profile set up currently. So my last question: I have to create a profile and specify the Authentication Domain. But since it defaults to FQDN what should I set?

If you have separate profiles for gateway and OWA, then you should be able to put the OWA FQDN in there for the OWA profile. Standard disclaimer applies, always test first.

Gateway Auth is not done via AAA. Only OWA. So OWA FQDN should be safe. Thanks a lot for your help 🙂