PoC Guide: Secure Access to Azure-managed SaaS Applications and Citrix Secure Private Access

Overview

As users access confidential content within SaaS applications, organizations must be able to simplify user login operations while still enforcing authentication standards. Organizations must be able to secure SaaS applications even though it exists beyond the confines of the data center. Citrix Workspace provides organizations with enhanced security controls for SaaS applications.

In this scenario, a user authenticates to Citrix Workspace using Active Directory as the primary user directory and launches an Azure-managed SaaS app.

If the Citrix Secure Private Access service is assigned to the Citrix subscription, enhanced security policies, ranging from applying screen-based watermarks, restricting printing/downloading actions, screen grabbing restrictions, keyboard obfuscation, and protecting users from untrustworthy links, are applied on top of the SaaS applications.

下面的动画显示了用户访问aaS app with Azure-provided SSO and secured with Citrix Secure Private Access.

该演示展示了IdP-initiated SSOflow where the user launches the application from within Citrix Workspace. This PoC guide also supports an SP-initiated SSO flow where the user tries to access the SaaS app directly from their preferred browser.

Assumptions:

• Azure is already configured to provide SSO to a SaaS app
• Users can successfully sign into the Azure app portal and launch the SaaS app

This proof of concept guide demonstrates how to:

1. Setup Citrix Workspace
2. Integrate a primary user directory
3. Incorporate Single Sign-On for SaaS applications
4. Define website filtering policies
5. Validate the configuration

Setup Citrix Workspace

The initial steps for setting up the environment is to get Citrix Workspace prepared for the organization, which includes

1. Setting up the Workspace URL
2. Enabling the appropriate services

Set Workspace URL

1. Connect toCitrix Cloudand log in as your administrator account
2. Within Citrix Workspace, accessWorkspace Configurationfrom the upper-left menu
3. From theAccesstab, enter a unique URL for the organization and select Enabled

Enable Services

From theService Integrationtab, enable the following services to support the secure access to SaaS apps use case.

1. Secure Private Access
2. Secure Browser

Verify

Citrix Workspace takes a few moments to update services and URL settings. From a browser, verify that the custom Workspace URL is active. However, logon will be available once a primary user directory gets defined and configured.

Integrate a Primary User Directory

Before users can authenticate to Workspace, aprimary user directorymust be configured. The primary user directory is the only identity the user requires as all requests for apps within Workspace utilize single sign-on to secondary identities.

An organization can use any one of the following primary user directories:

• Active Directory: To enable Active Directory authentication, a cloud connector must be deployed within the same data center as an Active Directory domain controller by following theCloud Connector Installationguide.
• Active Directory with Time-Based One Time Password: Active Directory-based authentication can also include multifactor authentication with a Time-based One Time Password (TOTP). Thisguidedetails the required steps to enable this authentication option.
• Azure Active Directory:用户可以验证Citrix工作区an Azure Active Directory identity. Thisguidedetails the required steps to enable this authentication option.

  Note

  When using AAD as your primary authentication directory, you cannot federate the primary domain (user’s login domain) because this creates a loop. In such cases,you must federate a new domain.

  AAD user accounts must have the attributeimmutableIDset; otherwise, the authentication will fail with the error message:AADSTS51004
  Azure AD Connect synchronized accounts get this attribute set automatically.

• Citrix Gateway: Organizations can utilize an on-premises Citrix Gateway to act as an identity provider for Citrix Workspace. Thisguideprovides details on the integration.
• Okta: Organizations can use Okta as the primary user directory for Citrix Workspace. Thisguideprovides instructions for configuring this option.

Create SaaS App

To successfully create the SaaS with Citrix Workspace, the administrator needs to do the following:

• Configure SaaS App
• Authorize SaaS App

Configure SaaS App

With the SaaS app configured within Azure, the SaaS app can get configured within Citrix Workspace.

• Within Azure, selectAzure Active Directory
• SelectEnterprise Applications

• Within the list, select the SaaS app, which brings up the application overview
• SelectProperties

• Copy theUser Access URLand remember for later use
• Within Citrix Cloud, selectManagefrom the Secure Private Access tile.

• Within Secure Private Access menu, selectApplications
• In the Application section, selectAdd an app

Applications - Template

• In the Choose a template wizard, find the correct template. In this example, selectHumanity

• SelectNext

Applications - App details

• In theApp detailsscreen, replace theURLwith theUser Access URLcopied from Azure.
• At the end of theURL, add the following:&whr=federated_domainreplacingfederated_domainwith the domain associated with the user’s identity (information after the @ sign in the user’s email). The federated domain entry informs Azure to redirect to the correct federated domain configuration. The federated domain information gets configured within Azure in an upcoming section.

Note: You can also route the traffic through the Connector Appliance deployed in your data center. Therefore you need to switch from “Outside my corporate network” to “Inside my corporate network”.

• SelectNext

Applications - Single Sign-On

• In theSingle Sign-Onwindow, setAssertion URLto behttps://login.microsoftonline.com/login.srf(1)
• SetAudienceto beurn:federation:MicrosoftOnline(2)
• Verify theName ID Format=PersistentandName ID=Active Directory GUID(3)
• Select the box labeledLaunch the app using the specified URL (SP Initiated). (4)
  Once authenticated, the user automatically gets redirected to the SaaS app instead of the Azure App Portal.
• Under Advanced attributes, verifyAttribute Name=IDPEmail,Attribute Format=Unspecified, andAttribute Value=Email(5)

Note

The second Advanced attribute option is added automatically to suppress the MFA authentication request when the user has already entered the MFA during user authentication to Citrix Workspace.

Attribute Name:http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod
Attribute Format:Unspecified
Attribute Value:Custom value
Custom Value:http://schemas.microsoft.com/claims/multipleauthn

For Azure AD to accept this claim, we must add a parameter-SupportsMfa $truewhen setting up the domain federation.

Note:The steps (6), (7), and (8) are only needed to be done for the first app.

• SelectDownloadto capture theCRT-basedcertificate. (6)
• Next to theLogin URL, select theCopybutton to capture the Login URL. This URL gets used later. (7)
• Select theSAML Metadatalink (8)

• Within the SAML Metadata file, look forEntityID. Please copy the entire URL and store it for later use. Once captured, the SAML Metadata file can be closed.

• SelectNext

Applications - App Connectivity

• In theApp Connectivitywindow, verify how the traffic should be routed (in this case, direct from the client to the SaaS application)

• SelectNext
• SelectFinishto complete the configuration of the Humanity SaaS apps.

Authorize SaaS App and configure enhanced security

• Within Secure Private Access menu, selectAccess Policies
• In the Access Policy section, selectCreate policy

• In theApplicationsdrop-down list, search for “Humanity” and select it.
• Add the appropriate users/groups who are authorized to launch the app
• Specify if the app can be accessed with or without enhanced security.
  The above screenshot has no enhanced security configured.
  If enhanced security is needed, change “Allow access” to “Allow with restrictions” and enable all that should apply.

Note: For initial SSO testing, it is always a good idea to configure enhanced security with the option “Open in remote browser” set.

Federate Azure Authentication to Citrix Workspace

To successfully federate the SaaS app with Citrix Workspace, the administrator needs to do the following:

• Verify Authentication Domain
• Configure Domain Federation

Verify Authentication Domain

Azure must verify the fully qualified domain name to federate authentication to Citrix Workspace. Within the Azure Portal, do the following:

• Access Azure Active Directory
• SelectCustom domain namesin the navigation window
• SelectAdd custom domain
• Enter the fully qualified domain name

• SelectAdd domain
• Azure provides records to incorporate into your domain name registrar. Once done, selectVerify.

• Once complete, the domain includes a verified mark

Configure Domain Federation

The final configuration is to have Azure use Citrix Workspace as the federated authority for the verified domain. Configuring federation must be done with PowerShell.

• Launch PowerShell
• Add the appropriate modules with the following commands

Install-ModuleAzureAD-ForceImport-ModuleAzureAD-ForceInstall-ModuleMSOnline-ForceImport-moduleMSOnline-Force<!--NeedCopy-->

• Connect to Microsoft Online via PowerShell and authenticate using a Microsoft cloud account (e.g.,admin.user@onmicrosoft.com)

Connect-MSOLService<!--NeedCopy-->

• Verify the domain is currently set toManagedwithin Azure by running the following PowerShell command

Get-MsolDomain<!--NeedCopy-->

• Use the following code in a PowerShell script to make this domainFederatedby changing the variables to align with your environment

dom美元="workspaces.wwco.net"# The fully qualified domain name verified within Azure$fedBrandName="CitrixWorkspaceSAMLIdP"# A name to help remember the configuration purpose$uri="https://app.netscalergateway.net/ngs/[entityID]/saml/login?APPID=[APPID]"# The Login URL from the Humanity app configuration$logoffuri="https://app.netscalergateway.net/cgi/logout"# Standard entry for all. Do not change$cert=New-ObjectSystem.Security.Cryptography.X509Certificates.X509Certificate2("")# Path to the downloaded certificate file from Humanity app configuration (e.g., C:\temp\filename.crt)$certData=[system.convert]::tobase64string($cert.rawdata)$IssuerUri="//m.giftsix.com/[entityID]"# The entityID taken from the Office365 app configuration SAML Metadata fileSet-MsolDomainAuthentication`-DomainNamedom美元`–federationBrandName$fedBrandName`-AuthenticationFederated`-PassiveLogOnUri$uri`-LogOffUri$logoffuri`-SigningCertificate$certData`-IssuerUri$IssuerUri`-PreferredAuthenticationProtocolSAMLPTosuppressanMFAauthenticationrequestwhentheuserhasalreadyenteredtheMFAduringuserauthenticationtoCitrixWorkspace,usethefollowingcommand:Set-MsolDomainAuthentication`-DomainNamedom美元`–federationBrandName$fedBrandName`-AuthenticationFederated`-PassiveLogOnUri$uri`-LogOffUri$logoffuri`-SigningCertificate$certData`-IssuerUri$IssuerUri`-PreferredAuthenticationProtocolSAMLP`-SupportsMfa$true<!--NeedCopy-->

• Verify the domain is currently set toFederatedwithin Azure by running the following PowerShell command

Get-MsolDomain<!--NeedCopy-->

• Verify the federation settings in Azure by running the following PowerShell command

Get-MsolDomainFederationSettings-DomainNamedom美元<!--NeedCopy-->

Note

If the federation settings need to be removed, run the following PowerShell command:
Set-MsolDomainAuthentication -DomainName $dom -Authentication Managed

Validate

IdP-Initiated Validation

• Log into Citrix Workspace as a user
• Select the SaaS application
• Observe the URL to see it briefly redirect through Azure
• The SaaS portal successfully launches

SP-Initiated Validation

• Launch a browser
• Go to the company-defined URL for the SaaS application
• The browser redirects to Azure Active Directory and then to Citrix Workspace for authentication
• Once the user authenticates with the primary user directory, the SaaS app launches with Citrix providing single sign-on

Define website filtering policies

Citrix Secure Private Access provides website filtering within SaaS and Web apps to help protect users from phishing attacks. The following shows how to set up website filtering policies.

• From Citrix Cloud,Managewithin the Secure Private Access tile

• If this guide was followed, theSet up end-user authenticationstep and theConfigure end-user access to SaaS, web and virtual applicationssteps are complete. SelectSettings
• Switch to the tabWeb Filtering
• SelectEdit
• EnabletheFilter website categoriesoption
• Within theBlocked categoriesbox, selectAdd
• Select the categories to block users from accessing

• When all applicable categories are selected, selectAdd

• Do the same for allowed categories
• Do the same for redirected categories. These categories redirect to a Secure Browser instance
• If needed, admins can filter denied, allowed, and redirected actions for specific URLs following the same process used for defining categories. Website URLs take precedence over categories.

Validate the Configuration

IdP-Initiated Validation

• Log into Citrix Workspace as a user
• Select the SaaS app.
  If enhanced security is disabled, the app launches within the local browser. Otherwise, the enterprise browser is used.
• The user automatically signs on to the app
• The appropriate enhanced security policies are applied
• If configured, select a URL within the SaaS app that is in the blocked, allowed, and redirected categories
• If configured, select a URL within the SaaS app that is in the blocked, allowed, and redirected URLs
• The SaaS App successfully launches

SP-Initiated Validation

• Launch a browser
• Go to the SaaS app website andSign In. If there is an option to do SSO, select the option.
• The browser redirects the browser to Citrix Workspace for authentication
• Enter the user name.
• Once the user authenticates with the primary user directory, Office365 launches in the local browser if enhanced security is disabled.
  If enhanced security is enabled, a Secure Browser instance launches the SaaS app.

Stay Signed In

In the default configuration, Azure Active Directory displays a dialog box during the logon process allowing the users to remain signed in.

This is an Azure setting that can be easily changed by doing the following:

• Within Azure, selectAzure Active Directory
• SelectCompany Branding
• Select the enabled Locale
• In the Edit company branding pane, selectNoin theShow option to remain signed in

• SelectSave

Troubleshooting

User Account Does Not Exist in the Directory

When trying to launch Microsoft 365, the user might receive the following error:
AADSTS51004: The user account "account name" does not exist in the "GUID" directory. To sign into this application, the account must be added to the directory.

The following are suggestions on how to solve this issue:

• Verify that the user is authorized to use the SaaS app within Azure Active Directory
• Verify that the identified email address within the error matches the primary user directory, Azure Active Directory, and the SaaS app.

• Verify that the attributeimmutableIdis set at the user object.
  (This is not the case in pure AAD environments!)
  TheimmutableId可以很容易地计算和设置使用following PowerShell commands:

  $userUPN="john.doh@company.com" #change the userPricipalName before executing Install-Module AzureAD -Force Import-Module AzureAD -Force Install-Module MSOnline -Force Import-module MSOnline -Force Connect-MsolService $userObjectID=(Get-MsolUser -UserPrincipalName $userUPN).objectId $userImmutableId=[System.Convert]::ToBase64String([System.Guid]::New($userObjectID).ToByteArray()) Set-MsolUser -UserPrincipalName $userUPN -ImmutableId $userImmutableId 

Federation Realm Object

During validation, a user might receive the following error:
AADSTS50107: The requested federation realm object 'https:///adfs/services/trust' does not exist.

This is often caused by the domain not being verified or properly federated. Review the following sections of the PoC guide:

• Verify Authentication Domain
• Configure Domain Federation

Enhanced Security Policies Failing

Users might experience enhanced security policy (watermark, printing, or clipboard access) failure. Typically, this happens because the SaaS application uses multiple domain names. Within the application configuration settings for the SaaS app, there was an entry forRelated Domains.

The enhanced security policies are applied to those related domains. To identify missing domain names, an administrator can access the SaaS app with a local browser and do the following:

• Navigate to the section of the app where the policies fail
• In Google Chrome and Microsoft Edge (Chromium version), select the three dots in the upper right side of the browser to show a menu screen.
• SelectMore Tools.
• SelectDeveloper Tools
• Within the developer tools, selectSources. This provides a list of access domain names for that application section. To enable the enhanced security policies for this portion of the app, those domain names must be entered into therelated domains领域内的应用程序配置。相关的领域s are added like the following*.domain.com