https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
c
I assume you have a AAA vServer. Edit it. Scroll down to authentication policies and click the pencil. Right-click the existing binding and click Edit Binding. Then click the Select Next Factor field.
m
That's the issue, I'm not seeing any next factor field
I'll take a screenshot in a few
c
The next factor is set on advanced authentication polices bound to your AAA vserver or the advanced auth polcies bound to your nfactor policy labels
m
maybe it’s not an advanced policy, that might be it
c
You probaly just created a basic saml auth policy the saml policy has to be an advanced authentication policy
^
m
it seems to omit that part in the article
it has you create the server and mentions creating the policy but doesn’t show you how
yeah, I have it as a basic policy, I see where to add it now
thanks
c
No problem :) the transtition from classic to advanced polices makes you tear your hair out at times
I wanted to do a pre authentication policy that does a epa scan before authentication page nope not happening ..... Got to use advanced auth polices and EPA actions and add it as 1st factor in nfactor flow
m
sweet, that (plus setting an NTP server and fixing the time) was the missing bit, all working now
👍 1
ok, any ideas on how to modify this to handle multi domain?
c
Different IDPs based off Domain UPN suffix ?

https://youtu.be/wx8SWwjR1LM▾

Domain drop down for ldap is now done via login schemas and nfactor https://support.citrix.com/article/CTX201760
m
our UPNs don’t match our domains as they are vanity addresses 😞
I was hoping something could pull it from okta and pass it through
c
U using the okta saml netscaler app in the okta portal ?
m
yes
it has the option to pass through domain\samaccountname but I think I need to tweak something somewhere to make it work
c
edit the app in okta and under signin options you can change the application username format
m
I changed it to AD SAM account name + domain
what is storefront expecting? domain\samaccountname?
c
Might need to tweak your sso domain on the session profiles when using saml and upn it has to be empty
m
pretty sure it is, will double check
oh wait, nope…
c
yeh storefront expects samaccountname used to be pain if u wanted to use upn as you tweak the server logon name and sso name attribute on the ldap server
m
hmmm, I broke something so now it tries to download the file called login instead of actually logging me in
Open in Slack
PreviousNext
Powered by