Jump to content
Welcome to our new Citrix community!

nfactor, mfa and waiting page


Recommended Posts

Hi, I hope you guys can help me.

 

I've deployed an access gateway with nfactor auth, which authenticates against AD with ldap and Azure MFA with radius. This works as expected.

 

But in terms of user experience, I'm not happy with it. With MFA, a user can choose how the second factor is handled. Ranging from SMS code and app code to app approve. In the later case, the website stays the same (only the mouse is changed into an hourglass). (SMS and app code display a new website, which asks the user to enter the code)

 

I'd love to display a simple website saying something like "Contacting Microsoft MFA services. Please check your phone now.". This page should lack any user input, it's supposed to be just an information. (Yes, I'm aware, if the user has chosen SMS code, this website will only display for a moment, only to be changed to the please-enter-code site. But that's ok)

 

Is there a way to achieve this?

 

I tried a simple xml with just a label and no auth, didn't work. I also tried using a modified OnlyDeviceID.xml, hoping this would display a page and then simply ignoring the ID, but no avail either.

 

Regards,

Melbinger

 

Link to comment
Share on other sites

In your Azure MFA settings, you should be able to deselect all other authentication methods except for the one you want to force the users to use (push notification):

 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings

 

image.thumb.png.310894b6df19428fc8794311c87e380c.png

 

As for the user experience, I wonder if that will change when you eliminate the other options from being available.

Link to comment
Share on other sites

Hm, no, I don't want to restrict the users choice. If app push is what he likes most, i don't want to prevent that.

 

Julian, thanks for that idea, i'll probably end up doing it like that. It's not my favorite solution, but if there's no way of displaying a page that will automatically call on the next step, then this will be my only choice.

 

Thanks, everyone

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...