This message was deleted.
# citrix-netscalers
Slackbot
04/27/2021, 7:35 AMThis message was deleted.
k
Kari Ruissalo (WyW)
04/27/2021, 12:12 PMuser or device cert?
j
Julian Jakob
04/27/2021, 12:22 PMuser
k
Kari Ruissalo (WyW)
04/27/2021, 12:25 PMI've used cascade authentication in this one so that, if a cert from the selected CAs can be found from it starts its "own nFactor flow" (can bypass MFA for instance). If the initial cert policy doesn't hit, then user is shown a credential form to enter their username and password and then continue to the next factor (like SMS OTP /MFA)
Kari Ruissalo (WyW)
04/27/2021, 12:27 PMSo, you could use an expression to detect the Mac OS / iOS devices and bypass the cert auth rule for those endpoints in the first policy in the cascade and then do a different thing in the next one. Just making sure that all use cases meet the defined criteria for authentication?
Kari Ruissalo (WyW)
04/27/2021, 12:30 PM@Julian Jakob, have you checked if any of these match your needs
https://docs.citrix.com/en-us/citrix-adc/current-release/aaa-tm/authentication-methods/multi-factor-nfactor-authentication/how-to-articles.html
j
Julian Jakob
04/27/2021, 3:07 PMThe „must have“ is that user certauth works also with workspace app on all platforms, too. I also used the auto detection of a cert from the correct CA to start or identify the nfactor flow, but that’s exactly what’s not working with native apps - as Citrix consulting told me to use the dropdown method... I will check the link, thanks!
m
Mike Streetz (O_P)
04/27/2021, 3:26 PMI’ve also done it with cascading auth but not with a dropdown
Mike Streetz (O_P)
04/27/2021, 3:26 PMI think you’d have better luck with no dropdown for workspace
j
Julian Jakob
04/27/2021, 7:31 PM@Mike Streetz (O_P) and it’s working with native workspace apps if using cascading? So certauth the Browser way and other factors if workspace way?
m
Mike Streetz (O_P)
04/27/2021, 10:36 PMit was a long time ago, can’t be sure but I think so
Mike Streetz (O_P)
04/27/2021, 10:37 PMwe were doing cert auth and then if didn’t have the cert doing 2fa
k
Kari Ruissalo (WyW)
04/28/2021, 6:06 AMthis is quite good reference of what's supposed to be supported
https://www.citrix.com/content/dam/citrix/en_us/documents/data-sheet/citrix-workspace-app-feature-matrix.pdf
j
Julian Jakob
05/04/2021, 10:00 PMAre you able to provide me some examples? I've configured the certauth expression like this (so it only should hit if using gateway plugin for windows I used from https://docs.citrix.com/en-us/citrix-gateway/current-release/storefront-integration/ng-clg-session-policies-overview-con.html) but it's always asking for a mandatory cert, also if there isn't one. certauth is set to optional. I have no ideas why the expression isn't hitting correctly. Any hints?
Julian Jakob
05/28/2021, 1:35 PMThere's the final solution 🙂 thanks for your help! https://citrixguyblog.com/2021/05/28/citrix-adc-nfactor-user-certificate-authentication-or-the-demystifying-of-user-agent-header/