SAML IDP on NetScaler to Move Citrix Cloud

[Asyraf Mohd]

Hi Anyone,

We currently working on migrating the on prem SAML Authentication to Daas. Current Design is, got 3 different Farm Prod, UAT, DR. All different URL under same Domain.

Client requirement is :

• Client want to remain 3 URL when move to cloud.
• ADC to still remain on prem (Context Switching, AppFlow, )
• Less impact on user interface once cut over to Daas. ( Means no need to re-register the MFA)

We already suggest to remove the ADC on prem since Daas able to do the SAML Authentication. The problem is how we can remain this 3 different URL since the limitation for Custom Daas URL is only allow 1 URL. Plus, if not mistake, once we integrate On prem ADC to the Daas it will allow the openID Connect instead of SAML Authentication. 

We already suggest to allow the ADC to redirect the URL to Daas URL but this will terminate ADC features and function.

Appreciate if you guys can share any suggest to overcome this issue.

Thanks.