This message was deleted.

are you using nFactor?

I have used the alternate config and have had success with it. If you are still using Classic authentication policy, I would use this as an opportunity to convert to Advanced Auth.

I would agree with switching over to nFactor if you are licensed for it at that time. If you are using classic policies on the native Workspace App/Receiver you will be presented with a 3rd field where you have to type in push/phone/sms.

we haven't switched to nfactor because, according to DUO and Citrix's website, it doesn't work with iOS workspace app.

It does indeed work with iOS, documentation just hasn't been updated to reflect it

I was surprised it wouldn't when our Network Engineer pointed that out. The citrix document that states that was updated on 4-23-20 and still shows that

Oh I understand and have seen the documentation say it's not supported and had customers tell me the same. Test it and prove it out is the path forward.

sigh, now my NE is saying he doesn't want DUO to be secondary and that it "needs" to be primary for security reasons.

In order to change password you still would have to successfully auth at the gateway before the password change form is displayed

so both the expired password and duo?

Ya, typically

ah, good to know

Not with the setup on DUO’s page for alternate auth. David, you are correct that they would be able to change the password without MFA. You would need to do nFactor to work that out how your security admin wants it.

I was looking, initially, at the alternate configuration on duo's website. However, it sounds like nfactor is the better way to go

@Johnny Ma - I have tested nFactor on iOS devices and it is not supported. Alternatively, we are adding the Store as legacy Web Interface (Manual Setup). https://worldofeuc.slack.com/archives/CL7B5GFHR/p1583593936004700

so on an ipad a user would need to do the manual setup and select Web Interface. It would then still connect through the ADC Gateway?

yea, iOS and nFactor isn't supported yet in GA. Behind the scenes, it is something being asked about many times and worked on for that support. There is a tech preview out now I think for that, so its close.

@David Prows - Yes, it does with nFactor flow.

Yea, The Web Interface toggle. I think that basically flips it to web auth/skin, whatever you want to call it on the Workspace App side instead of the Classic front end.