This message was deleted.

A common option is to deploy Network Policy Server (NPS, a RADIUS server) with Azure MFA plugin.

So when a user hits the GW VIP, they're redirected to the Azure login, once they are authenticated, it would redirect them to the SF login. Then once they launch the published resource, they might be prompted to login again using LDAP or back to the Azure login page?

Correct. Anything saml will require FAS to convert saml to user cert which the VDA then understands. Windows doesn’t understand saml and thus you get prompted

They would be prompted for their LDAP password at Windows, it would not go back to Azure. FYI

so in the article it says to enable kerberos delegation to the NetScaler

Kerberos is generic web servers, not CVAD. CVAD 7 and newer don't support Kerberos to the VDAs.

Split the auth in two. One for the side and one for the cad side. Web side is handled with the SAML assertion, CVAD side is handled by FAS and presents an automatically generated certificate in place of the users certificate.

OKTA actually has a solution which encodes the encrypted password into the SAML request. Looks like there is a post about it here: https://alchemytechgroup.com/integrating-okta-with-citrix-netscaler-gateway-without-citrix-federated-authentication-service/ and another one here: https://www.ferroquesystems.com/resource/howto-okta-saml-at-citrix-gateway-with-sso-without-fas/ Also, there is one on using Azure MFA without FAS here: https://www.ferroquesystems.com/resource/howto-azure-mfa-saml-and-citrix-gateway-with-sso-without-fas/

These „workarounds“ are nice until they stop working and you need to call Citrix support. I am 100% sure they will not be able to help you in a I efficient way. Great job using the nFactor framework but in a real world production environment I would always go the official way which is FAS.