This message was deleted.

The users have to get to the gateway url with /manageotp on end of url. Because of the NSC_TASS cookie they will be presented with the singleauthmanageotp schema. Once authed (username and password) they will then enroll there device using the QR code with the citrix sso app. I just looked at my authentication push service profile and nothing GW specific in there its the client id/secret u generate from citrix cloud so should be able to use across different gateways as long as you use the same advanced auth polices that has the push profile. As far as i am aware the GW has to have connectivity to mfa.cloud.com and trust.citrixworkspacesapi.net

Big Thanks John! Got this to work in my Lab. Question, is shortcut allowing working in your lab with your phone? I'm very confused about these statements here: from https://docs.citrix.com/en-us/citrix-gateway/current-release/push-notification-otp.html On my setup it's only working via shortcuts on my phone (iOS) if the sso app is opened in background and I'm unlocking my phone. Otherwise if I accept the push, nothing happens. Thats very bad comparing to microsoft's authenticator for azure mfa. Any ideas? There are no settings in the sso app itself. Ping @Daniel Weppeler

if my phone is locked i do see the Citrix SSO push notification. I have to unlock with my fingerprint then click on allow on the notification and I get in successfully. I cant allow the push notification if i don't unlock my phone with my fingerprint. If my phone is not locked i get a notification pop up on screen (it lasts about about 5 seconds) i can click on allow directly or access it via my phones pull down notifications i can then either click allow or deny. If i dont click on allow or deny and just click on the push notification it opens up in the Citrix SSO app

Thanks John for your effort, now I can reproduce the same workflows on my iOS device