Device Certificate in nFactor as an EPA component
Device Certificate can be configured in nFactor as an EPA component. Device certificate can appear as any factor as a part of EPA.
Following are the benefits of configuring Device Certificate in nFactor as an EPA component.
The failure in device certificate validation does not result in a logon failure. Based on the configuration, the logon can proceed and the user can be placed under groups with limited access.
Because the Device Certificate check is policy driven, you can selectively allow or block access of your corporate intranet resources based on Device Certificate authentication. For example, Device Certificate authentication can be used to provide conditional access to the Office 365 application only on the corporate managed laptops.
Device certificate validation cannot be a part of a periodic EPA scan.
Important:
By default, Windows mandates admin privileges for accessing device certificates. To add the device certificate check for non-admin users, you must install the VPN plug-in of the same version as the EPA plug-on on the device.
You can add multiple CA certificates to the gateway and validate the device certificate.
Configure Device Certificate in nFactor as an EPA component
To configure Device Certificate in nFactor as an EPA component using the command line interface, at the command prompt, type:
add authentication epaAction epa-act -csecexpr sys.client_expr("device-cert_0_0") -defaultgroup epa_pass -quarantine_group epa_fail To configure Device Certificate in nFactor as an EPA component for the VPN virtual server using the Citrix ADC GUI:
- In the NetScaler GUI, navigate toConfiguration> Citrix Gateway>Virtual Servers.
- On theCitrix Gateway Virtual Serverspage, select the Virtual server to be modified and clickEdit.
On theVPN Virtual Serverpage, click the Edit icon.
ClickMore.
ClickAddnext to the CA for Device Certificate section and click OK.
不选择启用设备证书检查box. Enabling it enables the Device Certificate validation in the classic EPA.
In the NetScaler GUI, navigate toConfiguration> Security>AAA – Application Traffic>Policies>Authentication>Advanced Policies>Actions>EPA>.
On theAuthentication EPA Actionpage, clickAdd. You can clickEditto edit an existing EPA action.
On theCreate Authentication EPA Actionpage, provide the values for the required fields to create an authentication EPA action, and click theEPA Editorlink.
SelectCommonfrom theExpression Editormenu.
SelectDevice Certificatefrom the subsequent menu that appears and clickDoneto complete the configuration.
To configure Device Certificate in nFactor as an EPA component for the Citrix ADC AAA virtual server using the Citrix ADC GUI:
In the Citrix DC GUI, navigate toSecurity> AAA-Application Traffic>Virtual Servers.
On theCitrix Gateway Virtual Serverspage, select the Virtual server to be modified and click Edit.
- On theAuthentication Virtual Serverpage, click the Edit icon.
ClickMore.
ClickAddnext to theCA for Device Certificatesection.
Select the certificate to be added and clickOKto complete the configuration.
- Repeatstep 6 to step 10listed in the previous section to complete the configuration.