Citrix Netscaler 12 integration

[token2]

Netscaler 12 has "hardcoded" order of authentication sources in XenApp configuration wizard and it is OTP first and AD second. And there is no way to change it.
So when users log in, they should put OTP in the first password field and AD password in the second field.
The problem here is that the Netscaler does not allow the empty value of Password, so the users without 2FA active will have to put "something" there, which makes the overall user experience cumbersome.

See screenshots confirming this (Radius is now called RSA)