Configuring Domain and Security Token Authentication for Citrix Endpoint Management

October 5, 2020

Contributed by:

You can configure Citrix Endpoint Management to require users to authenticate with their LDAP credentials plus a one-time password, using the RADIUS protocol. This section describes the required Citrix Gateway configuration for that two-factor authentication type.

Prerequisites

If you have not already run the Citrix ADC for Citrix Endpoint Management wizard, see theCitrix ADC for Citrix Endpoint Management Wizardsection inConfiguring Settings for Your Citrix Endpoint Management Environment. Make sure that your Citrix ADC configuration includes the following:

LDAP port number=636(which is the default port for secure LDAP connections)
Server Logon Name Attribute=samAccountNameor theuserPrincipalNameas per your requirements

To configure domain and security token authentication

Go toCitrix Gateway > Virtual Servers. Select the virtual server and then clickEdit.
ClickNo CA Certificate.
FromSelect CA Certificate, choose a certificate, clickOK, clickBind, and then clickDone.
Go toPolicies > Session > Session Profiles, select the profile which starts withAC_OS, and clickEdit.
Click theClient Experiencetab and go to the bottom of the page.
FromCredential Index, chooseSECONDARY.
ClickOK.
Go toPolicies > Authentication > LDAP, click theLDAP Policytab, and clickEdit.
To use separate Citrix Gateway VIPs for Citrix Endpoint Management and Citrix Virtual Apps and Desktops, inExpression, replaceNS_TRUEwith the following:
REQ.HTTP.HEADER User-Agent CONTAINSCitrixReceiver
Go toPolicies > Authentication > RADIUSand then click theServerstab.
ClickAdd, enter the RADIUS server details, and clickCreate.
Go toPoliciesand then clickAdd.
Enter aNamefor the policy. From theServerdrop-down menu, select the RADIUS server name (Radius_Serverin our example).
ForExpression, enterREQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiverand clickCreate.
Select the virtual server and then clickEdit.
UnderPrimary Authentication, clickLDAP Policy.
Select the policy, clickUnbind, and clickClose.
On theAuthenticationrow, click+to add the RADIUS authentication.
UnderChoose Type, fromChoose Policy, selectRADIUS.
ClickBind.
Select the RADIUS authentication policy you created earlier and then clickInsert.
ClickOK.
To add LDAP as the secondary authentication policy: On theAuthenticationrow, click+.
FromChoose Policy, chooseLDAP.
FromChoose Type, chooseSecondary.
FromSelect Policy, choose the LDAP policy.
Select the policy and then clickOK.
ClickBind.
ClickDone.
Verify that the policies you created have the highest priority. This ensures that they have the highest priority even if more policies get added for non-mobile users. For more information, seeSetting Priorities for Authentication Policies

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring Domain and Security Token Authentication for Citrix Endpoint Management

October 5, 2020

Contributed by:

October 5, 2020

Contributed by:

Configuring Domain and Security Token Authentication for Citrix Endpoint Management

Prerequisites

To configure domain and security token authentication

In this article