Web authentication policies
Authentication, authorization, and auditing is now able to authenticate a user to a web server, providing the credentials that the web server requires in an HTTP request and analyzing the web server response to determine that user authentication was successful. As with other types of authentication policies, a Web authentication policy is comprised of an expression and an action. After creating an authentication policy, you bind it to an authentication virtual server and assign a priority to it. When binding it, you also designate it as either a primary or a secondary policy.
To set up web-based authentication with a specific web server, first you create a web authentication action. Since authentication to web servers does not use a rigid format, you must specify exactly which information the web server requires and in which format when creating the action. To do this, you create an expression in Citrix ADC appliance default syntax that contains the following items:
- Server IP—The IP address of the authentication Web server.
- Server Port—The port of the authentication Web server.
- Authentication Rule—An expression in Citrix ADC appliance default syntax that contains the user’s credentials in the format that the Web server expects.
- Scheme—HTTP (for unencrypted web authentication) or HTTPS (for encrypted web authentication).
- Success Rule—An expression in Citrix ADC appliance default syntax that matches the web server response string that signifies that the user authenticated successfully.
For all other parameters, follow the normal rules for the add authentication action command.
接下来,您创建一个活动的相关政策on. The policy is similar to an LDAP policy, and like LDAP policies uses Citrix ADC appliance syntax.
Note
These instructions assume that you are already familiar with the authentication requirements of the web server(s) to which you want to authenticate, and have already configured the web authentication server.
To configure a Web authentication action by using the command line interface
To create a web authentication action at the command line, at the command line type the following command:
```add authentication webAuthAction
Example
add authentication webAuthAction webauth1 -serverIP 10.214.56.31 -serverPort 80 -
```
To configure a Web authentication action by using the configuration utility
Note
In the configuration utility, the term server is used instead of action, but refers to the same task.
- Navigate toSecurity > AAA - Application Traffic > Policies > LDAP.
- In the details pane, on theServerstab, do one of the following:
- If you want to create a new web authentication action, clickAdd.
- If you want to modify an existing web authentication action, in the data pane select the action, and then clickEdit.
- If you are creating a new web authentication action, in theCreate Authentication Webserver dialog box,Nametext box, type a name for the new web authentication action. The name can be from one to 127 characters in length, and can consist of upper- and lowercase letters, numbers, and the hyphen (-) and underscore (_) characters. If you are modifying an existing web authentication action, skip this step. The name is read-only; you cannot change it.
- In theWeb Server IP Addresstext box, type the IPv4 or IPv6 IP address of the authentication web server. If the address is an IPv6 IP address, select the IPv6 check box first.
- In the Port text box, type the port number on which the web server accepts connections.
- SelectHTTPorHTTPSin theProtocoldrop-down list.
- In the HTTP Request Expression text area, type a PCRE-format regular expression that creates the web server request that contains the user’s credentials in the exact format expected by the authentication web server.
- 在表达式验证身份验证text area, type a Citrix ADC appliance default syntax expression that describes the information in the web server response that indicates that user authentication was successful.
- Fill out the remaining fields as described in the general authentication action documentation.
- ClickOK.