Citrix Gateway supported versions, clients, features and factors

The Citrix Gateway supports the following versions, clients, features and factors.

Supported Versions

This guide has been verified with the following Citrix Gateway versions:

  • Version 10.5.x
  • Version 11.x
  • Version 12.x
  • Version 13.0.x

Supported Clients

The following Citrix clients have been validated:

  • Citrix Web Receiver
  • Citrix Windows \ Mac Receiver
  • Citrix iOS \ Android Receiver

Supported features

The following Okta features are supported:

  • Authentication with Okta Credentials via RADIUS
  • Authentication with Okta Credentials via SAML
  • Multi-factor authentication via RADIUS
  • Multi-factor authentication via SAML
  • Group memberships/Attributes via RADIUS – passes the username and password to storefront for AD group permissions

Supported factors

The following MFA Factors are supported:

Important Note

When integrating with Okta RADIUS, the maximum supported number of enrolled factors is dependent on the size of resulting challenge message. Okta recommends that no more than eight ( 8 ) be enrolled at one time.

MFA Factor Password Authentication Protocol
PAP		 Extensible Authentication Protocol - Generic Token Card
EAP-GTC		 Extensible Authentication Protocol - Tunneled Transport Layer Security
EAP-TTLS
Custom TOTP Authentication Supported Supported Supported
Duo(Push, SMS and Passcode only) Supported Not supported Not supported

Email

Supported

Supported

Not supported

Google Authenticator

Supported Supported Supported - as long as challenge is avoided.
For example MFA only or password, MFA.

Okta Verify (TOTP and PUSH)

Supported Supported Supported - as long as challenge is avoided.
For example:
MFA-only or password, MFA for TOTP.
Push can work with primary auth + MFA as the push challenge is sent out-of-band.

Okta Verify (number challenge)

Not supported

Not supported

Not supported

RSA Token

Supported

Supported

Supported

Security Question

Supported Supported Not supported
SMS authentication Supported Supported Not supported
Symantec VIP Supported Supported Supported

Voice Call

Supported Supported Not supported

YubiKey

Supported Supported Supported
Caution

EAP-TTLS does not support enrollment
Authentication will fail unexpectedly when EAP-TTLS is enabled, either Okta Verify or Phone are specified as required enrollment policy, and the user is not enrolled in that factor.

Info

Note

The U2F Security and Windows Hello MFA factors are not compatible with RADIUS-enabled implementations.
For additional information about the RADIUS apps refer to Configuring RADIUS applications in Okta.