Native OTP support for authentication 编辑

Citrix ADC supports one-time passwords (OTPs) without having to use a third-party server. One-time password is a highly secure option for authenticating to secure servers as the number or passcode generated is random. Previously, specialized firms, such as RSA with specific devices that generate random numbers offered the OTPs.

In addition to reducing capital and operating expenses, this feature enhances the administrator’s control by keeping the entire configuration on the Citrix ADC appliance.

Note:

Because third-party servers are no longer needed, the Citrix ADC administrator has to configure an interface to manage and validate user devices.

User must be registered with a Citrix ADC virtual server to use the OTP solution. Registration is required only once per unique device, and can be restricted to certain environments. Configuring and validation of a registered user is similar to configuring an extra authentication policy.

Advantages of native OTP support

• Reduces operating cost by eliminating the need to have an extra infrastructure on an authenticating server in addition to the Active Directory.
• Consolidates configuration only to Citrix ADC appliance thus offering great control to administrators.
• Eliminates the client’s dependence on an extra authentication server for generating a number expected by clients.

Native OTP workflow

The native OTP solution is a two-fold process and the workflow is classified as the following:

• Device registration
• End user login

Important:

You can skip the registration process if you are using third-party solutions or managing other devices apart from the Citrix ADC appliance. The final string that you add must be in the Citrix ADC specified format.

The following figure depicts the device registration flow to register a new device to receive OTP.

Note:

The device registration can be done using any number of factors. The single factor (as specified in the previous figure) is used as an example to explain the device registration process.

The following figure depicts the verification of OTP through the registered device.

The following figure depicts the device registration and management flow.

The following figure depicts the end user flow for the Native OTP feature.

Prerequisites

To use the native OTP feature, make sure that the following prerequisites are met.

• Citrix ADC feature release version is 12.0 build 51.24 and later.
• Advanced or Premium edition license is installed on Citrix Gateway.
• Citrix ADC is configured with management IP and the management console is accessible both using a browser and command line.
• Citrix ADC is configured with authentication, authorization, and auditing virtual server to authenticate users. For more information, see Authentication virtual server
• Citrix ADC appliance is configured with Unified Gateway and the authentication, authorization, and auditing profile is assigned to the Gateway virtual server.
• Native OTP solution is restricted to nFactor authentication flow. Advanced policies are required to configure the solution. For more details, see Native OTP

Also ensure the following for Active Directory:

• A minimum attribute length of 256 characters.
• Attribute type must be ‘DirectoryString’ such as UserParameters. These attributes can hold string values.
• Attribute string type must be Unicode, if device name is in non-English characters.
• Citrix ADC LDAP administrator must have write access to the selected AD attribute.
• Citrix ADC appliance and client machine must be synced to a common Network Time Server.

Configure Native OTP using the GUI

The native OTP registration is not just a single factor authentication. The following sections help you to configure the single and second factor authentication.

Create Login Schema for first factor

1. Navigate to Security AAA > Application Traffic > Login Schema.
2. Go to Profiles and click Add.
3. On the Create Authentication Login Schema page, enter lschema_single_auth_manage_otp under the Name field and click Edit next to noschema.
4. Click the LoginSchema folder.
5. Scroll down to select SingleAuth.xml and click Select.
6. Click Create.
7. Click Policies and Click Add.

8. On the Create Authentication Login Schema Policy screen, enter the following values.

   Name: lpol_single_auth_manage_otp_by_url

   Profile: Select lschema_single_auth_manage_otp from the list.

   Rule: HTTP.REQ.COOKIE.VALUE(“NSC_TASS”).EQ(“manageotp”)

Configure authentication, authorization, and auditing virtual server

1. Navigate to Security > AAA – Application Traffic > Authentication Virtual Servers. Click to edit the existing virtual server. For more information, see Authentication virtual server

2. Click the + icon next to Login Schemas under Advanced Settings in the right pane.
3. Select No Login Schema.
4. Click the arrow and select the lpol_single_auth_manage_otp_by_url Policy, click Select, and click Bind.
5. Scroll up and select 1 Authentication Policy under Advanced Authentication Policy.
6. Right-click the nFactor Policy and select Edit Binding. Right-click the already configured nFactor Policy or refer to nFactor to create one and select Edit Binding.
7. Click the arrow under Select Next Factor to select an existing configuration or click Add to create a factor.

8. On the Create Authentication PolicyLabel screen, enter the following, and click Continue:

   Name: manage_otp_flow_label

   Login Schema: Lschema_Int

9. On the Authentication PolicyLabel screen, click Add to create a Policy.

   Create a policy for a normal LDAP server.

10. On the Create Authentication Policy screen, enter the following:

    Name: auth_pol_ldap_native_otp

11. Select the Action type as LDAP using the Action Type list.

12. In the Action field, click Add to create an action.

    Create the first LDAP action with authentication enabled to be used for single factor.

13. In the Create Authentication LDAP server page, select the Server IP radio button, deselect the check box next to Authentication, enter the following values, and select Test Connection. The following is a sample configuration.

    Name: ldap_native_otp

    IP Address: 192.8.xx.xx

    Base DN: DC=training, DC=lab

    Administrator: Administrator@training.lab

    Password: xxxxx

    Create a policy for OTP .

14. On the Create Authentication Policy screen, enter the following:

    Name: auth_pol_ldap_otp_action

15. Select the Action type as LDAP using the Action Type list.

16. In the Action field, click Add to create an action.

    Create the second LDAP action to set OTP authenticator with OTP secret configuration and authentication unchecked.

17. In the Create Authentication LDAP server page, select the Server IP radio button, deselect the check box next to Authentication, enter the following values, and select Test Connection. The following is a sample configuration.

    Name: ldap_otp_action

    IP Address: 192.8.xx.xx

    Base DN: DC=training, DC=lab

    Administrator: Administrator@training.lab

    Password: xxxxx

18. Scroll down to the Other Settings section. Use the drop-down menu to select the following options. Server Logon Name Attribute as New and type userprincipalname.
19. Use the drop-down menu to select SSO Name Attribute as New and type userprincipalname.
20. Enter “UserParameters” in the OTP Secret field and click More.

21. Enter the following Attributes.

    Attribute 1 = mail Attribute 2 = objectGUID Attribute 3 = immutableID

22. Click OK.
23. On the Create Authentication Policy page, set the Expression to true and click Create.
24. On the Create Authentication Policylabel page, click Bind, and click Done.
25. On the Policy Binding page, click Bind.

26. On the Authentication policy page, click Close and click Done.

    Create OTP for OTP verification.

27. On the Create Authentication Policy screen, enter the following:

    Name: auth_pol_ldap_otp_verify

28. Select the Action type as LDAP using the Action Type list.

29. In the Action field, click Add to create an action.

    Create the third LDAP action to verify OTP.

30. In the Create Authentication LDAP server page, select the Server IP radio button, deselect the check box next to Authentication, enter the following values, and select Test Connection. The following is a sample configuration.

    Name: ldap_verify_otp

    IP Address: 192.168.xx.xx

    Base DN: DC=training, DC=lab

    Administrator: Administrator@training.lab

    Password: xxxxx

31. Scroll down to the Other Settings section. Use the drop-down menu to select the following options. Server Logon Name Attribute as New and type userprincipalname.
32. Use the drop-down menu to select SSO Name Attribute as New and type userprincipalname.
33. Enter “UserParameters” in the OTP Secret field and click More.

34. Enter the following Attributes.

    Attribute 1 = mail Attribute 2 = objectGUID Attribute 3 = immutableID

35. Click OK.
36. On the Create Authentication Policy page, set the Expression to true and click Create.
37. On the Create Authentication Policylabel page, click Bind, and click Done.
38. On the Policy Binding page, click Bind.
39. On the Authentication policy page, click Close and click Done.

You probably don’t already have an Advanced Authentication Policy for your normal LDAP server. Change the Action Type to LDAP. Select your normal LDAP server, which is the one that has Authentication enabled. Enter true as the expression. This uses Advanced policy instead of Classic Syntax. Click Create.

Note:

The authentication virtual server must be bound to the RFWebUI portal theme. Bind a server certificate to the server. The server IP ‘1.2.3.5’ must have a corresponding FQDN that is, otpauth.server.com, for later use.

Create login schema for second factor OTP

1. Navigate to Security > AAA-Application Traffic > Virtual Servers. Select the virtual server to be edited.
2. Scroll down and select 1 Login Schema.
3. Click Add Binding.
4. Under the Policy Binding section, click Add to add a policy.
5. On the Create Authentication Login Schema Policy page, enter Name as OTP, and click Add to create a profile.
6. On the Create Authentication Login Schema page, enter Name as OTP, and click the pencil icon next to noschema.
7. Click the LoginSchema folder, select DualAuthManageOTP.xml, and then click Select.
8. Click More and scroll down.
9. In the Password Credential Index field, enter 1. This causes nFactor to save the user’s password into Citrix ADC AAA Attribute #1, which can be used later in a Traffic Policy to single sign-on to StoreFront. If you don’t do this, then Citrix Gateway tries to use the Passcode to authenticate to StoreFront, which does not work.
10. Click Create.
11. In the Rule section, enter True. Click Create.
12. Click Bind.
13. Notice the two factors of authentication. Click Close and click Done.

Traffic Policy for single sign-on

1. Navigate to Citrix Gateway > Policies > Traffic
2. On the Traffic Profiles tab, click Add.
3. Enter a name for the traffic profile for OTP.

4. Scroll down, in the SSO Password Expression box, enter the following, and click Create. This is where we use the login schema password attribute specified for the second factor OTP.

   http.REQ.USER.ATTRIBUTE(1)

5. On the Traffic Policies tab, click Add.

6. In the Name field, enter a name for the traffic policy.

7. In the Request Profile field, select the traffic profile you created.

8. In the Expression box, enter True. If your Citrix Gateway virtual server allows full VPN, change the expression to the following.

   http.req.method.eq(post)||http.req.method.eq(get) && false

9. Click Create.

Configure content switching policy for manage OTP

The following configurations are required if you are using Unified Gateway.

1. Navigate to Traffic Management > Content Switching > Policies. Select the content switching policy, right click, and select Edit.

2. Edit the expression to evaluate the following OR statement and click OK:

   is_vpn_url\|\|HTTP.REQ.URL.CONTAINS("manageotp")

Configure Native OTP using the CLI

You must have the following information to configure the OTP device management page:

• IP assigned to authentication virtual server
• FQDN corresponding to the assigned IP
• Server certificate for authentication virtual server

Note:

Native OTP is a web-based solution only.

To configure the OTP device registration and management page

Create authentication virtual server

```
add authentication vserver authvs SSL 1.2.3.5 443
bind authentication vserver authvs -portaltheme RFWebUI
bind ssl vserver authvs -certkeyname otpauthcert
<!--NeedCopy--> ```