If you are licensed for Advanced/Enterprise or Premimum/Platinum Edition of ADC, then you can switch to Advanced (aka nFactor, aka AAA vServer), which lets you do LDAP in first factor, and based on group membership decide if a second factor screen is needed or not. -authentication-citrix-gateway-13/