Two Factor Authentication for Citrix ADC Console
Two factor authentication is a security mechanism where a Citrix ADC appliance authenticates a system user at two authenticator levels. The appliance grants access to the user only after successful validation of passwords by both levels of authentication. If a user is authenticated locally, the user profile must be created in the Citrix ADC database. If the user is authenticated externally then, the user name and password must match the user identity registered in the external authentication server.
Note
Two factor authentication feature works only from Citrix ADC 12.1 build 51.16 onwards.
How two factor authentication works
Consider a user trying to log on to a Citrix ADC appliance. The requested application server sends the user name and password to the first external authentication server (RADIUS, TACACS, LDAP, or AD). Once the user name and password are validated, the user is prompted for a second level of authentication. The user can now provide the second password. Only if both passwords are correct, the user is allowed to access the Citrix ADC appliance. The following diagram is an illustration of how two-factor authentication works for a Citrix ADC appliance.
Following are the different use cases for configuring two factor authentication for external and system users.
You can configure two-factor authentication on a Citrix ADC appliance in different ways. The following are the different configuration scenarios for two factor authentication on a Citrix ADC appliance.
- Two factor authentication (2FA) across Citrix ADC, GUI, CLI, API and SSH.
- External authentication enabled and local authentication disabled for system users.
- External authentication enabled with policy based local authentication for system users.
- External authentication disabled for system users with local authentication enabled.
- External authentication enabled and local authentication enabled for system users.
- External authentication enabled for selected LDAP users
Use case 1: Two factor authentication (2FA) across Citrix ADC, GUI, CLI, API and SSH interfaces
Two-factor authentication is enabled and available across all Citrix ADC management access for GUI, API, and SSH.
Use case 2: Two factor authentication supported on external authentication servers such as LDAP, RADIUS, Active Directory and TACACS
You can configure two-factor authentication on the following external authentication servers for first-level and second-level user authentication.
- RADIUS
- LDAP
- Active Directory
- TACACS
Use case 3: External authentication enabled and local authentication disabled for system users
You begin the authentication process by enabling the external authentication option and disabling local authentication for system users.
Complete the following steps by using the command line interface:
- Add authentication action for LDAP policy
- Add authentication policy for LDAP policy
- Add authentication action for RADIUS policy
- Add authentication policy for RADIUS policy
- Add authentication login schema
- Add and bind authentication policy label to RADIUS server
- Bind system global authentication for LDAP policy
- Disable local authentication in system parameter
Add authentication action for LDAP server (first level authentication)
At the command prompt, type:
add authentication ldapaction
Example:
添加身份验证ldapaction ldapact1 -serverip 1.1.1.1 -ldapbase base -ldapbindDn name -ldapbindDNpassword password -ldapLoginName name -groupAttrName name -subAttributeName name -ssoNameAttribute name
Add authentication policy for LDAP server (first level authentication)
At the command prompt, type:add authentication policy
Example:add authentication policy pol1 -rule true -action ldapact1
Add authentication action for RADIUS server (second level authentication)
At the command prompt, type:
add authentication radiusaction
Example:
add authentication radiusaction radact1 -serverip 1.1.1.1 -radkey 123 -radVendorID 1234 -radAttributeType 2
Add authentication policy for RADIUS server (second level authentication)
At the command prompt, type:
add authentication policy
Example:
add authentication policy radpol11 -rule true -action radact11
Add authentication login schema
You can use the “SingleAuth.xml” login schema for system users to provide the second password for the Citrix ADC appliance. At the command prompt, type:
添加身份验证loginSchema <登录模式名称>-authenticationSchema LoginSchema/SingleAuth.xml
Example:
add authentication loginSchema radschema -authenticationSchema LoginSchema/SingleAuth.xml
Add and bind authentication policy label to RADIUS server
At the command prompt, type:
add authentication policylabel
bind authentication policylabel
Example:
add authentication policylabel label1 -type RBA_REQ -loginSchema radschema
bind authentication policylabel label1 -policyName rad_pol11 -priority 1
Bind authentication system global for LDAP policy
At the command prompt, type:
结合系统global ldappolicy -priority
Example:
结合系统global pol11 -priority 1 -nextFactor label11
Disable local authentication in system parameter
At the command prompt, type:
set system parameter -localauth disabled
Use case 4: External authentication enabled for system user with local authentication policy attached
In this scenario, the user is allowed to log on to the appliance using two-factor authentication with local authentication policy evaluation at the second level of user identification.
Complete the following steps by using the command line interface.
- Add authentication action for LDAP server
- Add authentication policy for LDAP policy
- Add local authentication policy
- Add authentication policy label
- Bind LDAP policy as system global
- Disable local authentication in system parameter
Add authentication action for LDAP server (first level authentication)
At the command prompt, type:
add authentication ldapaction
Example:
添加身份验证ldapaction ldapact1 -serverip 1.1.1.1 -ldapbase base -ldapbindDn name -ldapbindDNpassword password -ldapLoginName name -groupAttrName name -subAttributeName name -ssoNameAttribute name –ssoNameAttribute name
Add authentication policy for LDAP server (first level authentication)
At the command prompt, type:
add authentication policy
Example:
添加身份验证ldapaction ldapact1 -serverip 1.1.1.1 -ldapbase base -ldapbindDn name -ldapbindDNpassword password -ldapLoginName name -groupAttrName name -subAttributeName name -ssoNameAttribute name
Add local authentication policy for system users (second level authentication)
At the command prompt, type:
add authentication radiusaction
Example:
add authentication radiusaction radact1 -serverip 1.1.1.1 -radkey 123 -radVendorID 1234 -radAttributeType 2
Add and bind authentication policy label
At the command prompt, type:
add authentication policylabel
bind authentication policylabel
Example:
add authentication policylabel label1 -type RBA_REQ -loginSchema radschema
bind authentication policylabel label1 -policyName rad_pol11 -priority 1
Disable local authentication in system parameter
At the command prompt, type:
set system parameter -localauth disabled
Use case 5: External authentication disabled and local authentication enabled for system user
If the user has “externalAuth” disabled, it indicates the user does not exist on the authentication server. User is not authenticated with the external authentication server even if a user with the same user name exists on the external authenticated server. User is authenticated locally.
To enable system user password and disable external authentication
At the command prompt, type the following:
add system user
Example:
add system user user1 password1 –externalAuth DISABLED
Use case 6: External authentication enabled and local authentication enabled for system users
To configure the appliance to authenticate system users by using a local password. If this authentication fails, the user is then authenticated by using an external authentication password on the external authentication servers at two levels.
To configure by using the command line interface, follow the steps given below:
- Add authentication action for LDAP server
- Add authentication policy for LDAP policy
- Add authentication action for RADIUS policy
- Add authentication policy for RADIUS policy
- Add authentication login schema
- Add authentication policy label
- Bind authentication policy label for login schema
- Bind authentication system global for RADIUS policy
- Bind authentication system global for LDAP policy
Add authentication action for LDAP server
At the command prompt, type:
add authentication ldapaction
Example:
添加身份验证ldapaction ldapact1 -serverip 1.1.1.1 -ldapbase base -ldapbindDn name -ldapbindDNpassword password -ldapLoginName name -groupAttrName name -subAttributeName name -ssoNameAttribute name
Add authentication policy for LDAP policy
At the command prompt, type:
add authentication policy
Example:
add authentication policy pol1 -rule true -action ldapact1
Add authentication action for RADIUS server
At the command prompt, type:
add authentication radiusaction
Example:
add authentication radiusaction radact1 -serverip 1.1.1.1 -radkey 123 -radVendorID 1234 -radAttributeType 2
Add advanced authentication policy for RADIUS server
At the command prompt, type:
add authentication policy
Example:
add authentication policy radpol11 -rule true -action radact11
Add authentication login schema
You can use the SingleAuth.xml login schema to display the login page and authenticate the system user at the second level authentication.
At the command prompt, type:
add authentication loginSchema
Example:
add authentication loginSchema radschema -authenticationSchema LoginSchema/SingleAuth.xml
Add and bind authentication policy label to RADIUS authentication policy for user login
At the command prompt, type:
add authentication policylabel
Example:
add authentication policylabel label1 -type RBA_REQ -loginSchema radschema
bind authentication policylabel
Example:
bind authentication policylabel label1 -policyName rad_pol11 -priority 1
Bind authentication policy global
At the command prompt, type:
结合系统global [
Example:
结合系统global radpol11 -priority 1 -nextFactor label11
Use case 7: External authentication enabled for selected external users only
To configure selective external users with two-factor authentication as per the search filter configured in the LDAP action while other system users are authenticated using single factor authentication.
To configure using the command line interface, follow the steps given below:
- Add authentication action for LDAP server
- Add authentication policy for LDAP policy
- Add authentication action for RADIUS policy
- Add authentication policy for RADIUS policy
- Add authentication login schema
- Add authentication policy label
- Bind authentication policy label for login schema
- Bind authentication system global for RADIUS policy
Add authentication action for LDAP server
At the command prompt, type:
add authentication ldapaction
Example:
添加身份验证ldapaction ldapact1 -serverip 1.1.1.1 -ldapbase base -ldapbindDn name -ldapbindDNpassword password -ldapLoginName name -groupAttrName name -subAttributeName name -ssoNameAttribute name
Add authentication policy for LDAP policy
At the command prompt, type:
add authentication policy
Example:
add authentication policy pol1 -rule true -action ldapact1
Add authentication action for RADIUS server
At the command prompt, type:
add authentication radiusaction
Example:
add authentication radiusaction radact1 -serverip 1.1.1.1 -radkey 123 -radVendorID 1234 -radAttributeType 2
Add advanced authentication policy for RADIUS server
At the command prompt, type:
add authentication policy
Example:
add authentication policy radpol11 -rule true -action radact11
Add authentication login schema
You can use the SingleAuth.xml login schema to provide the login page for the appliance to authenticate a system user at a second level of authentication.
At the command prompt, type:
add authentication loginSchema
Example:
add authentication loginSchema radschema -authenticationSchema LoginSchema/SingleAuth.xml
Add and bind authentication policy label to RADIUS authentication policy for user login
At the command prompt, type:
add authentication policylabel
Example:
add authentication policylabel label1 -type RBA_REQ -loginSchema radschema
bind authentication policylabel
Example:
bind authentication policylabel label1 -policyName rad_pol11 -priority
Bind authentication policy global
At the command prompt, type:
结合系统global [
Example:
结合系统global radpol11 -priority 1 -nextFactor label11
To configure without two-factor authentication for group users using the search filter:
- Add authentication action for LDAP server
- Add authentication policy for LDAP server
- Bind authentication system global for LDAP server
Add authentication action for LDAP server
At the command prompt, type:
add authentication ldapaction
Example:
添加身份验证ldapaction ldapact1 -serverip 1.1.1.1 -ldapbase base -ldapbindDn name -ldapbindDNpassword password -ldapLoginName name -groupAttrName name -subAttributeName name - searchFilter "memberOf=CN=grp4,CN=Users,DC=aaatm-test,DC=com"
Add authentication policy for LDAP server
At the command prompt, type:
add authentication policy
Example:
add authentication policy pol1 -rule true -action ldapact1
Bind authentication system global for LDAP policy
At the command prompt, type:
结合系统global ldappolicy -priority
Example:
结合系统global pol11 -priority 1 -nextFactor label11
Display customized prompt message for two factor authentication
When you configure two factor password field with SingleAuth.xml file at/flash/nsconfig/loginschema/LoginSchema
Following is the snippet of a SingleAuth.xml file where ‘SecondPassword:’ is the second password field name which is prompted to the user to enter a second password.
success more-info /nf/auth/doAuthentication.do /nf/auth/doLogoff.do Cancel login ExplicitForms-Username username singleauth_please_supply_either_domain\username_or_user@fully.qualified.domain false false .+ passwd ExplicitForms-Password password true false .+ none saveCredentials savecredentials false loginBtn none
Configuring two-factor authentication by using the Citrix ADC GUI
- Log on to Citrix ADC appliance.
- Go toSystem>Authentication>先进的波利奇ies>Policy.
- Click Add to create the first level authentication policy.
- In克雷亚te Authentication Policy页面,设置以下参数。
- Name. Name of the policy
- Action Type. Select action type as LDAP, Active Directory, RADIUS, TACACS, and so on
- 行动。身份验证行动(剖面)的屁股ociate with the policy. You can choose an existing authentication action, or click the plus and create an action of the proper type.
- Expression. Provide an advanced policy expression.
- Click克雷亚teand thenClose.
- Expression. Provide an advanced policy expression.
- Click克雷亚te.
- ClickAddto create the second level authentication policy.
- In the克雷亚te Authentication Policypage, set the follow parameters
- Name. Name of the policy
- Action Type. Select action type as LDAP, Active Directory, RADIUS, TACACS, and so on
- 行动。身份验证行动(剖面)的屁股ociate with the policy. You can choose an existing authentication action, or click the + icon to create an action of the proper type.
- Expression. Provide an advanced policy expression
- Click克雷亚teand thenClose.
- Expression. Provide an advanced policy expression.
- Click克雷亚te.
- In theAuthentication Policiespage, clickGlobal Binding.
- In the克雷亚te Global Authentication Policy Bindingpage, select the first level authentication policy, and clickAdd Binding.
- In thePolicy Bindingpage, select the authentication policy and set the following policy binding parameter.
- Next Factor. Select the second level authentication policy label.
ClickBindandClose.
- ClickDone.
- Log on to the Citrix ADC appliance for the second level authentication. The user can now provide the second password. Only if both passwords are correct, the user is allowed to access the Citrix ADC appliance.
Note
The TACACS configured for a second factor authentication does not support authorization and accounting even if you enable it on the “tacacsAction” command. The second factor is used for the authentication purpose only.
Also, seeTwo factor authentication in Citrix ADC nFactor authenticationtopic.
In this article
- How two factor authentication works
- Use case 1: Two factor authentication (2FA) across Citrix ADC, GUI, CLI, API and SSH interfaces
- Use case 2: Two factor authentication supported on external authentication servers such as LDAP, RADIUS, Active Directory and TACACS
- Use case 3: External authentication enabled and local authentication disabled for system users
- Use case 4: External authentication enabled for system user with local authentication policy attached
- Use case 5: External authentication disabled and local authentication enabled for system user
- Use case 6: External authentication enabled and local authentication enabled for system users
- Use case 7: External authentication enabled for selected external users only
- Configuring two-factor authentication by using the Citrix ADC GUI