This message was deleted.

That or SAML/FAS will do it as well. FAS require certificate services so if they don't have that it would take a bit more to do

I would say do it the "correct" way which is sending the auth to Azure using SAML and Citrix FAS for the SSO. I've written a small blog post here about it: https://netscaler.dk/modern-authentication-with-azure-conditional-access/

Tremendous... they have a CA, thanks lads 😁

With SAML and azure ad as the idp. https://www.deyda.net/index.php/en/2019/06/16/saml-authentication-with-azure-ad-as-idp-and-citrix-as-sp/

Got it 🙂

Or with nps extension 😅 https://www.deyda.net/index.php/en/2019/03/20/microsoft-azure-mfa-cloud-service-in-citrix-adc-version-12-2/

Legend.

If you have questions. Just ask. By the way, with the latest 13.0 version of citrix adc the SAML also works with standard licensing.

just one more ;) https://dreadysblog.com/2017/10/22/multi-factor-authentication-for-citrix-xendekstop-netscaler-against-azure-ad/

Cheers guys... licencing is something I need to check. I'm not sure they will want to go to 13.x...

If they don't want to go 13.x, then it would require Enterprise for native workspace app to work with SAML

Depending on the size of the environment you may want to deploy subordinate CAs to issue the user certs and the 2 x FAS servers for it to be resilient too. How many users you working with?

Hey Leee, around 800 - Im thinking x2 FAS with Sub CA, cheers

A single server will be able to handle that without issues, but redundancy is always preferred, so good choice.

@Mads Petersen Nice one mate - cheers for the input 🙂

Just catching up, Mads covered it all 😉

Just a little side node, I have a customer where their users have accounts in other AAD also, and they are signing into them semi regular, which often lead to that issue with SSO, where you're trying to sign into the customer AAD, but doing it with credentials from another AAD. Us admins know we can just open a incognito browser and get on. But at the customer it was such a huge issue, that we had to enable Force authentication on the SAML policy on the ADC, which forces the iDP to authenticate the request coming from the ADC.

Confirmed they actually have Enterprise licensing so it looks like SAML/FAS :)

I always prefer a parallel operation with own gateway vserver with new external DNS entry. I

I agree with Manuel, new gateway, new DNS.

I've done this with nfactor and group extraction to decide the auth mechanism. It can be a bit fiddly but then its modular and be ported between gateways.

Thanks guys... a new gateway/dns makes sense. My initial idea wouldn’t work as a user would need to get past mfa before a policy would apply... on the RSA side anyway... thanks again legends!