UPDATE 13.11.15:  I have a beta version ready, will announce soon with screenshots and features.

The replacement of Citrix Web Interface, StoreFront , does not allow configuring two factor authentication directly on the web interface, you will need NetScaler (virtual or physcal) if you want strong security.

I have a raw prototype of a two-factor authentication system with self-enrollment supporting newest version based on freeradius and StoreFront web API, I am planning to create a system that supports Mobile-OTP and Google Authenticator, however I do not have any Netscalers available to properly test.

Let me know if you are interested in testing this solution : emin at huseynov.com