F5 APM with DUO w/out replacing the storefront

I am running 13.1.1 and Setup Citrix using the template with DUO and It works fine.

However I cant get Duo to work with the Citrix Webtop. Credentials are failing which doesn't make sense because I am also mapping drives using the same session variables successfully. The Event viewer in the Citrix DDC application log generates an Event ID 2100 "The Citrix Broker Service failed to validate a user's credentials on an XML service.

Verify the trust relationships between your domains.

Error details: User: 'ABCD\jdoe' Error: 'InvalidCredentials' Message: 'Failed Windows logon, error code 1326'

This was working in 12.1.2

If you or anyone else has insight on this issue please let me know.

Thank you!