World of EUC

if it's the same forest, global catalog authentication would be the easiest / most user friendly. Otherwise you have options with domain dropdown boxes ( custom config without nfactor, built-in with nfactor). Or set up a different gateway per domain. Or if you can ask/force your users to use UPN that would open up other options, but generally doesn't play well with the users.

<https://www.carlstalhood.com/citrix-gateway-ldap-authentication/#domains>

I prefer the UPN method but it’s not always possible if you don’t have them set properly

Yea, I think that (UPN) is the way we are going to move... we have 4 different sites, so having 4 policies on 4 ADC Pairs, etc is a lot to manage.

the AAAgroup method gets messy pretty fast

Great blog from Citrix : <https://www.citrix.com/blogs/2017/10/26/multi-domain-considerations-with-netscaler-gateway-and-storefront/|https://www.citrix.com/blogs/2017/10/26/multi-domain-considerations-with-netscaler-gateway-and-storefront/>