ADC

View PDF

User identity management

September 14, 2021

反对tributed by:

S C S

An increasing number of security breaches and the growing popularity of mobile devices has emphasized the need to ensure that use of the external internet is compliant with the corporate policies. Only authorized users must be allowed access to external resources provisioned by the corporate personnel. Identity Management makes it possible by verifying the identity of a person or a device. It does not determine what tasks the individual can take or what files the individual can see.

An SSL forward proxy deployment identifies the user before allowing access to the internet. All requests and responses from the user are inspected. User activity is logged, and records are exported to the Citrix Application Delivery Management (ADM) for reporting. In Citrix ADM, you can view the statistics about the user activities, transactions, and bandwidth consumption.

By default, only the user’s IP address is saved, but you can configure the feature to record more details about the user. You can use this identity information to create richer internet usage policies for specific users.

The Citrix ADC appliance supports the following authentication modes for an explicit-proxy configuration.

Lightweight Directory Access Protocol (LDAP)。Authenticates the user through an external LDAP authentication server. For more information, seeLDAP Authentication Policies。
RADIUS。Authenticates the user through an external RADIUS server. For more information, seeRADIUS Authentication Policies。
TACACS+。Authenticates the user through an external Terminal Access Controller Access-Control System (TACACS) authentication server. For more information, seeAuthentication Policies。
Negotiate。通过一个Kerberos authen对用户进行身份验证tication server. If there is an error in Kerberos authentication, the appliance uses NTLM authentication. For more information, seeNegotiate Authentication Policies。

For transparent proxy, only IP-based LDAP authentication is supported. When a client request is received, the proxy authenticates the user by checking an entry for the client IP address in the active directory. It then creates a session based on the user IP address. However, if you configure the ssoNameAttribute in an LDAP action, a session is created by using the user name instead of the IP address. Classic policies are not supported for authentication in a transparent proxy setup.

Note

For explicit proxy, you must set the LDAP login name tosAMAccountName。For transparent proxy, you must set the LDAP login name tonetworkAddressand attribute1 tosAMAccountName。

Example for explicit proxy:

              add authentication ldapAction swg-auth-action-explicit -serverIP 10.105.157.116 -ldapBase "CN=Users,DC=CTXNSSFB,DC=COM" -ldapBindDn "CN=Administrator,CN=Users,DC=CTXNSSFB,DC=COM" -ldapBindDnPassword freebsd123$ -ldapLoginName sAMAccountName 
             

Example for transparent proxy:

              add authentication ldapAction swg-auth-action-explicit -serverIP 10.105.157.116 -ldapBase "CN=Users,DC=CTXNSSFB,DC=COM" -ldapBindDn "CN=Administrator,CN=Users,DC=CTXNSSFB,DC=COM" -ldapBindDnPassword freebsd123$ -ldapLoginName networkAddress -authentication disable -Attribute1 sAMAccountName 
             

Set up user authentication by using the CLI

At the command prompt type:

              add authentication vserver  SSL bind ssl vserver  -certkeyName  add authentication ldapAction  -serverIP  -ldapBase  -ldapBindDn  -ldapBindDnPassword -ldapLoginName  add authentication Policy  -rule  -action  bind authentication vserver  -policy  -priority  set cs vserver  -authn401 ON -authnVsName  
             

Arguments:

Vserver name:

Name of the authentication virtual server to which to bind the policy.

Maximum Length: 127

serviceType:

Protocol type of the authentication virtual server. Always SSL.

Possible values: SSL

Default value: SSL

Action name:

Name for the new LDAP action. Must begin with a letter, number, or the underscore character (_), and must contain only letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at (@), equals (=), colon (:), and underscore characters. Cannot be changed after the LDAP action is added. The following requirement applies only to the CLI:

If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my authentication action” or ‘my authentication action’).

Maximum Length: 127

serverIP:

IP address assigned to the LDAP server.

ldapBase:

Base (node) from which to start LDAP searches. If the LDAP server is running locally, the default value of base is dc=netscaler, dc=com. Maximum Length: 127

ldapBindDn:

Full distinguished name (DN) that is used to bind to the LDAP server.

Default: cn=Manager,dc=netscaler,dc=com

Maximum Length: 127

ldapBindDnPassword:

Password used to bind to the LDAP server.

Maximum Length: 127

ldapLoginName:

LDAP login name attribute. The Citrix ADC appliance uses the LDAP login name to query external LDAP servers or Active Directories. Maximum Length: 127

Policy name:

Name for the advance AUTHENTICATION policy. Must begin with a letter, number, or the underscore character (_), and must contain only letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at (@), equals (=), colon (:), and underscore characters. Cannot be changed after an AUTHENTICATION policy is created. The following requirement applies only to the CLI:

If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my authentication policy” or ‘my authentication policy’).

Maximum Length: 127

rule:

Name of the rule, or a default syntax expression, that the policy uses to determine whether to attempt to authenticate the user with the AUTHENTICATION server.

Maximum Length: 1499

action:

Name of the authentication action to be performed if the policy matches.

Maximum Length: 127

priority:

Positive integer specifying the priority of the policy. A lower number specifies a higher priority. Policies are evaluated in the order of their priorities, and the first policy that matches the request is applied. Must be unique within the list of policies bound to the authentication virtual server.

Minimum value: 0

Maximum Value: 4294967295

Example:

              add authentication vserver swg-auth-vs SSL Done bind ssl vserver explicit-auth-vs -certkeyName ns-swg-ca-certkey Done add authentication ldapAction swg-auth-action-explicit -serverIP 192.0.2.116 -ldapBase "CN=Users,DC=CTXNSSFB,DC=COM" -ldapBindDn "CN=Administrator,CN=Users,DC=CTXNSSFB,DC=COM" -ldapBindDnPassword zzzzz -ldapLoginName sAMAccountName Done add authenticationpolicy swg-auth-policy -rule true -action swg-auth-action-explicit Done bind authentication vserver swg-auth-vs -policy swg-auth-policy -priority 1 Done set cs vserver testswg -authn401 ON -authnVsName swg-auth-vs Done 
             

Enable user name logging by using the CLI

At the command prompt, type:

set appflow param -AAAUserName ENABLED

Arguments:

AAAUserName

Enable AppFlow authentication, authorization, and auditing user name logging.

Possible values: ENABLED, DISABLED

Default value: DISABLED

Example:

set appflow param -AAAUserName ENABLED

官方版本的内容是用英语。Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

User identity management

September 14, 2021

反对tributed by:

S C S

September 14, 2021

反对tributed by:

S C S

User identity management

Set up user authentication by using the CLI

Enable user name logging by using the CLI

In this article