When running CA Access Gateway (SPS), how to configure a resource protection with Multi Factor Authentication (MFA) which involves a fallback to another Multi Factor Authentication?
At first glance, SiteMinder is limited to offer Fall back authentication for Windows to HTML Form and Kerberos to HTML Form as per documentation, without MFA (1)(2).
There's a Certificate or HTML Form (This isn't a fallback, but a choice offered to the user, when there's no certificate presented) (3)(4) .
To have MFA availability, use VIP Authentication Hub (5)(6).
To get more flexibility about the login phase, take a look at the VIP Authentication Hub, as per some use cases given by the documentation (7).
VIP Authentication Hub integrates with SiteMinder using the MFA Chain Authentication Scheme, that allows to use the NTLM/Kerberos with fallback to HTML Form AND keep the MFA (8).
VIP Authentication Hub brings the risks functionalities as per Advanced Authentation module. Note that the VIP Authentication Hub is a standalone application (9).