Product Documentation
ADC
14.1-Current Release 13.1
View PDF

nFactor authentication

September 27, 2025
Contributed by: 
C

Important

  • nFactor authentication is supported from NetScaler 11.0 Build 62.x onwards.
  • For nFactor authentication to work with NetScaler, an Advanced license or a Premium license is required.
  • Starting from release 13.0 build 67.x, nFactor authentication is supported with Standard license only for Gateway/VPN virtual server. For more information about nFactor authentication with NetScaler Gateway, see nFactor for Gateway Authentication.

Multifactor authentication enhances the security of an application by requiring users to provide multiple proofs of identity to gain access. NetScaler provides an extensible and flexible approach to configuring multifactor authentication. This approach is called nFactor authentication.

How nFactor authentication works

Each authentication factor performs the following tasks:

  • Collects credentials from the user. NetScaler supported authentication mechanisms include LDAP, RADIUS, SAML assertion, Client Certificate, OAuth OpenID Connect, Kerberos, and so on.

  • Evaluates the supplied credentials to decide whether the authentication succeeded, failed or the actions like Group extraction, Attribute extraction is to be performed.

  • Based on the evaluation results, access is either granted, denied, or a next factor is selected.

  • Repeat these steps, until there are no more next factors to evaluate.

With nFactor authentication you can:

  • Configure any number of authentication factors.
  • Select the next factor based on the result of the previous factor.
  • Customize the login interface. For example, you can customize the label names, error messages, and help text.
  • Extract user group information without doing authentication.
  • Configure a pass-through for an authentication factor. This means that no explicit login interaction is required for that factor.
  • Configure the order in which different types of authentication are applied. Any supported authentication mechanism on NetScaler can be configured as a factor in the nFactor authentication setup. These factors run in the order in which they are configured.
  • Configure NetScaler to proceed to the next required authentication factor when authentication fails. To do so, you configure another authentication policy with the same condition, but with the next highest priority and with the action set to “NO_AUTH”. You must configure the next factor, which must specify the alternative authentication mechanism to apply.

Encryption of NetScaler Gateway login information for nFactor authentication

NetScaler Gateway with nFactor authentication can encrypt the login request fields submitted by a client (browser or SSO apps) during the authentication process. The encrypted login request fields provide an extra layer of security to protect the user’s sensitive data from being disclosed.

Compatible browsers

The following table lists the browsers along with version details that support login encryption.

Browsers Version
Chrome 78 and above
Firefox 69 and above
Edge 42 and above
Safari 11.0 and above
Opera 66

Compatible clients

The following section lists the clients along with version details that support encryption of NetScaler Gateway login information.

  • Citrix Workspace app in Mac supports encryption only when OS version is 10.14.x and above.
  • Citrix SSO app in Mac supports encryption only when OS version is 10.14.x and above.
  • Windows SSO app does not have restrictions on the compatibility.

To enable the login encryption by using the CLI

At the command prompt, type:

set aaa parameter [-loginEncryption (ENABLED | DISABLED)]

Note

  • The loginEncryption parameter is DISABLED by default. You must ENABLE it.

  • Policy expressions that rely on the post body containing encrypted login data are not supported because policy evaluation occurs before the login payload is decrypted.

To enable the login encryption by using the GUI

  1. Navigate to Security > AAA – Application Traffic, click Change authentication AAA settings under Authentication Settings section.
  2. On the Configure AAA Parameter page, scroll down to the Login Encryption option, and enable it.

Important note about login encryption:

When you try logging on to NetScaler Gateway, you see an error message that the password encryption has failed and that you must disable password encryption to continue with the logon, in the following scenarios:

  • Login encryption is enabled.
  • An unsupported browser is used.

You can ignore the suggestion to disable login encryption. But, ensure that you use a supported browser for a successful logon.

nFactor authentication
September 27, 2025
Contributed by: 
C
September 27, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.