Certificates are always checked first. Depending on your authentication preference (cert AND auth, or cert OR auth) will take priority and skip SAML, or will be required before going to SAML
Combining both companies on the same portal would require the OR condition, so no SAML for C1
after that first hurdle, the different gateways can be set up by creating an agent profile with a config selection criteria set to for example user groups. tricky thing there is that the C1-certificate-only users wont be able to match a group so you'll need to set the C2 profile on top with the group selection criteria and the C1 profile below with no selection criteria ( which could lead to cross-contamination if a C2 user falls outside the group mapping !)
the above is messy, so might i propose you try something different?
you can run the same URL on different ports and then use destination NAT to run different portals on loopback interfaces
e.g.
vpn.doamin.com:1443 -> DNAT loopback 172.16.0.1:443
vpn.doamin.com:2443 -> DNAT loopback 172.16.0.2:443
that way you can run 2 completely separate portals
... View more
