Use Case: Access control and authentication
In high security zones, it is mandatory to externally authenticate the user before a resource is accessed by clients. On the Citrix ADC appliance, you can use HTTP callouts to externally authenticate the user by evaluating the credentials supplied. In this example, the assumption is that the client is sending the user name and password through HTTP headers in the request. However, the same information could be fetched from the URL or the HTTP body.
To implement this configuration, you must perform the following tasks:
- Enable the responder feature on the Citrix ADC appliance.
- Create an HTTP callout on the appliance and configure it with details about the external server and other required parameters.
- Configure a responder policy to analyze the response, and then bind the policy globally.
- Create a callout agent on the remote server.
Enabling Responder
The responder feature must be enabled before it is used on the Citrix ADC appliance.
To enable responder by using the configuration utility
- Make sure that the responder license is installed.
- In the configuration utility, expand AppExpert, and right-click Responder, and then clickEnable Responder feature.
Creating an HTTP callout on the Citrix ADC appliance
Create an HTTP callout, HTTP-Callout-3, with the parameter settings shown in the following table. For more information about creating an HTTP callout, seeConfiguring an HTTP Callout.
Table 1. Parameters and Values for HTTP-Callout-3
Parameter | Value | Name |
---|---|---|
Name | Policy-Responder-3 |
Parameter
Value
Name
HTTP-Callout-3
Server to receive callout request:
IP Address
10.103.9.95
Port
80
Request to send to the server:
Method
GET
Host Expression
10.102.3.95
URL Stem Expression
“/cgi-bin/authenticate.pl”
Headers:
Name
Request
Value-expression
Callout Request
Parameters:
Name
Username
Value-expression
HTTP.REQ.HEADER(“Username”).VALUE(0)
Name
Password
Value-expression
HTTP.REQ.HEADER(“Password”).VALUE(0)
Server Response:
Return Type
TEXT
Expression to extract data from the response
HTTP.RES.BODY(100)
Creating a Responder Policy to Analyze the Response
Create a responder policy, Policy-Responder-3, that will check the response from the callout server and RESET the connection if the source IP address has been blacklisted. Create the policy with the parameters settings shown in the following table. While you can create a responder policy in the Policies subnode and then bind it globally by using the Responder Policy Manager, this demonstration uses the Responder Policy Manager to create the responder policy and bind the policy globally.
Table 2. Parameters and Values for Policy-Responder-3
Parameter | Value |
---|---|
Name | Policy-Responder-3 |
Action | RESET |
Undefined-Result-Action | -Global undefined-result action- |
Expression | “HTTP.REQ.HEADER(\“Request\”).EQ(\“Callout Request\”).NOT && SYS.HTTP_CALLOUT(HTTP-Callout-3).CONTAINS(\“Authentication Failed\”)” |
To create a responder policy and bind it globally by using the configuration utility
- Navigate toAppExpert>Responder.
- In the details pane, underPolicy Manager, clickResponder Policy Manager.
- In theResponder Policy Mangerdialog box, clickOverride Global.
- ClickInsert Policy, and then, in thePolicy Namecolumn, clickNew Policy.
In theCreate Responder Policydialog box, do the following:
- In Name, type Policy-Responder-3.
- In Action, selectRESET.
- In Undefined-Result Action , select Global undefined-result action.
- In the Expression text box, type:
"HTTP.REQ.HEADER(\"Request\").EQ(\"Callout Request\").NOT && SYS.HTTP_CALLOUT(HTTP-Callout-3).CONTAINS(\"Authentication Failed\")"
- ClickCreate, and then clickClose.
- ClickApply Changes, and then clickClose.
Creating an HTTP Callout Agent on the Remote Server
You now need to create an HTTP callout agent on the remote callout server. The HTTP callout agent receives callout requests from the Citrix ADC appliance and responds appropriately. The callout agent is a script that is different for each deployment and must be written with server specifications in mind, such as the type of database and the scripting language supported.
Following is sample callout agent pseudo-code that verifies whether the supplied user name and password are valid. The agent can be implemented in any programming language of your choice. The pseudo-code is to be used only as a guideline for developing the callout agent. You can build additional functionality into the program.
To verify the supplied user name and password by using pseudo-code
- Accept the user name and password supplied in the request and format them appropriately.
- Connect to the database that contains all the valid user names and passwords.
- Check the supplied credentials against your database.
- Format the response as required by the HTTP callout.
- Send the response to the Citrix ADC appliance.