How can two-factor authentication with tokens be provided in a XenDesktop with NetScaler Gateway environment?

• A. Create a SAML IDP policy and bind it to the existing virtual server
• B. Configure a TACACS authentication policy and bind it to the existing virtual server
• C. Create an authentication policy and bind it to the existing virtual server
• D. Configure a RADIUS authentication policy and bind it to the existing virtual server

Answer: (D)

Two-factor authentication with tokens is typically implemented by routing the login through a token MFA service. In a XenDesktop environment with NetScaler Gateway, this is done by configuring a RADIUS authentication policy and binding it to the gateway virtual server. NetScaler acts as a RADIUS client and forwards the user’s credentials plus the one-time token to the RADIUS server. If the RADIUS server validates both factors, access is granted. This approach directly supports OTP/token MFA providers (for example, RSA SecurID) and is the standard way to add token-based 2FA at the gateway. SAML IdP can provide MFA, but for token-based 2FA at the gateway level, RADIUS is the most straightforward and supported method. TACACS is for device administration, and a generic authentication policy alone does not inherently integrate with a token MFA service.