The AP-HP messaging system passes through a Citrix NetScaler Gateway portal that requires multifactor authentication for each remote connection. This technical layer, often reduced to a simple “code in addition” in internal guides, deserves a more granular reading to understand what it protects, where it falters, and how to maintain it operational on a daily basis.
Role of Citrix NetScaler Gateway in the AP-HP Authentication Chain
The portal messagerie.aphp.fr does not directly serve the webmail. It exposes a Citrix Receiver for Web interface that virtualizes access to applications, including Exchange messaging. The user session first goes through NetScaler Gateway, which manages SSL termination, client device inspection, and access control before relaying to the internal infrastructure.
This architecture implies that authentication occurs even before the mail client is opened. The AD (Active Directory) password is the first factor. The second factor, now required for remote access, relies on Microsoft Authenticator or an equivalent TOTP-compatible token. The internal enrollment guide describes the procedure for pairing the work account with the mobile application.
We recommend checking that the Citrix Workspace profile is up to date on the workstation or mobile device, as an outdated client version can cause silent failures at the time of the second factor. An article detailing the enhanced authentication system of APHP messaging precisely describes this enrollment sequence and the common errors encountered during token provisioning.
Multifactor Authentication and AP-HP IT Charter Requirements
The AP-HP IT charter, in its February 2022 version, sets a strict framework. Access to the information system is conditioned on compliance with confidentiality rules related to medical secrecy, and any illegitimate connection engages the civil and criminal liability of the user.
MFA is not a comfort option but a compliance obligation. The charter explicitly states that remote access permissions (smartphone, tablet, offline Outlook client) are subject to authorization from local IT departments. In practice, this means that an internal employee who configures their personal phone without going through the official enrollment procedure is in violation, even if the connection technically works.
Recurring Friction Points for Users
- The limited online storage (interns’ messaging has restricted storage space) pushes some agents to transfer emails to personal addresses, thereby bypassing the entire security chain.
- The address [email protected] with incrementation in case of homonymy complicates the initial setup on mobile clients, as the user does not always know their exact identifier.
- Restarting the workstation, recommended as a first recourse by support (accessible at *75 internally or at 01 40 27 40 00 from outside), does not resolve issues related to an expired MFA token or an expired Citrix certificate.
Cyber Hospital Context and Strengthening Security Strategy
French hospitals are facing a wave of increasingly large-scale cyberattacks. Cybersecurity analyses published since 2024 consistently advocate for strong authentication on critical systems: messaging, remote access, patient records. Protection, according to these recommendations, involves tested backups, rapid updates, network segmentation, strict access management, and widespread MFA.
AP-HP is not exempt from this pressure. The current configuration via NetScaler Gateway partially meets these requirements, but the Citrix Receiver for Web layer dates back to 2016 in its version displayed on the portal. An aging web publishing infrastructure increases the attack surface, even if MFA compensates for part of the risk.
Limitations of the Current System
The portal messagerie.aphp.fr uses Citrix Receiver in a mode that does not natively support Azure AD conditional access policies. Integration with Microsoft Authenticator works, but without the compliance checks of the workstation (disk encryption status, OS version, presence of active antivirus) that a more recent hybrid architecture would allow.
The 2022 charter imposes a GDPR compliance review for any processing of personal data involving a new IT tool. Any migration of the portal to a Citrix Cloud solution or to direct access via Exchange Online would therefore require a prior impact analysis, especially if messaging flows transit through data centers outside the current hosted perimeter.
Network Configuration and Remote Access to AP-HP Messaging
Internal access to webmail historically goes through the URL courriel.aphp.fr, accessible from the hospital network without MFA in certain configurations. External access via messagerie.aphp.fr imposes the NetScaler layer and the second factor.
This duality creates a blind spot. A user connected to the hospital Wi-Fi can potentially access their messaging with a single factor, while the same user from home undergoes the full process. The security of the messaging system therefore depends on the network segment, not just on the user’s identity.
We observe that local IT departments manage mobile access permissions heterogeneously across sites. An internal employee changing assignments may temporarily lose their remote access if the transfer of permissions between two entities has not been anticipated. The coded trigram of the affiliated site, visible in the messaging directory, serves as an assignment marker but is not always updated in real-time.
The robustness of the system relies less on the Citrix technology itself than on the rigor of the enrollment and revocation processes. An orphaned MFA token (agent left, account not deactivated) remains an exploitable access vector. The charter reminds us: any access to a patient record by a professional not part of the concerned care team is illegitimate, whether the MFA has been correctly validated or not.