This message was deleted.

to distinguish between SAML and non-SAML auth?

Spot on rene. LDAP and RADIUS for one group and SAML for the other.

Never tested, but I guess you can't combine them in this way

That's what I'm being told , cheers Rene. My question is why???

have a look at my blog lee https://c4rm0.wordpress.com/netscaler-nfactor-authentication/ i use group extraction as the first factor using nfactor then based off group membership you get saml or just plain ldap

I fixed it may. Nsapi_mgr tweak. Courtesy of @Mads Petersen