For end users to successfully launch Citrix virtual apps, the Citrix Gateway server or XenApp server to which Workspace ONE Access connects must allow password-based authentication. If multifactor authentication is configured on the Citrix Gateway server, you must set up conditional access policies for the Citrix Gateway server in a way that traffic from the Virtual App service goes through password-based authentication, while other traffic goes through multifactor authentication.

Configure the authentication policies based on the Workspace ONE Access connector instances' IP addresses.

Procedure

  1. Log into the Citrix ADC console.
  2. In the Configuration tab, select Citrix Gateway > Virtual Servers.
  3. Click the server you want to configure.
  4. Under Basic Authentication, Primary Authentication, add two authentication policies, one for LDAP and the other for multifactor authentication.
    1. Create the LDAP policy with the following expression:
      REQ.IP.SOURCEIP == WorkspaceONEAccessConnectorIPaddress

      WorkspaceONEAccessConnectorIPaddress is the IP address of the Workspace ONE Access connector on which the Virtual App service is running. To specify multiple connector instances, separate the entries with ||. For example:

      REQ.IP.SOURCEIP == 198.51.100.0 || 198.51.100.1

    2. Create the multifactor authentication policy with the following expression:
      REQ.IP.SOURCEIP != WorkspaceONEAccessConnectorIPaddress

      WorkspaceONEAccessConnectorIPaddress is the IP address of the Workspace ONE Access connector on which the Virtual App service is running. To specify multiple instances, separate the entries with ||. For example:

      REQ.IP.SOURCEIP != 198.51.100.0 || 198.51.100.1

    3. Make sure the LDAP policy has higher priority and is evaluated first.

Results

With these policies in place, launch traffic from the Virtual App service succeeds even if multifactor authentication is configured on the Citrix Gateway server.