Citrix ADC

Configuring nFactor authentication

The following diagram illustrates the high-level steps involved in nfactor configuration.


To understand the step-wise configurations for nFactor authentication, let us consider a 2-factor authentication deployment where the 1st factor is LDAP authentication and the 2nd factor is RADIUS authentication.

This sample deployment requires the user to login to both factors using a single login form. Therefore, we define a single login form that accepts two passwords. The first password is used for LDAP authentication and the other for RADIUS authentication. View XML file.

Here are the configurations that are performed.

  1. Configure the load balancing virtual server for authentication

    add lb vserver lbvs55 HTTP 80 -AuthenticationHost -Authentication ON`

  2. Configure the authentication virtual server.

    add authentication vserver auth56 SSL 443 -AuthenticationDomain

  3. Configure the login schema for the login form and bind it to a login schema policy.

    add authentication loginSchema login1 -authenticationSchema login-2passwd.xml -userCredentialIndex 1 -passwordCredentialIndex 2

    add authentication loginSchemaPolicy login1 -rule true -action login1

  4. Configure a login schema for the pass-through and bind it to a policy label

    add authentication loginSchema login2 -authenticationSchema noschema

    add authentication policylabel label1 -loginSchema login2

  5. Configure the LDAP and RADIUS policies.

    add authentication ldapAction ldapAct1 -serverIP -ldapBase “dc=aaatm, dc=com” -ldapBindDn -ldapBindDnPassword 71ca2b11ad800ce2787fb7deb54842875b8f3c360d7d46e3d49ae65c41550519 -encrypted -encryptmethod ENCMTHD_3 -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN

    add authentication Policy ldap -rule true -action ldapAct1

    add authentication radiusAction radius -serverIP -radKey a740d6a0aeb3288fa0a6fbe932d329acddd8f448ecb4a3038daa87b36599fd16 -encrypted -encryptmethod ENCMTHD_3 -radNASip ENABLED -radNASid NS28.50 -radAttributeType 11 -ipAttributeType 8

    add authentication Policy radius -rule true -action radius

  6. Bind the login schema policy to the authentication virtual server

    bind authentication vserver auth56 -policy login1 -priority 1 -gotoPriorityExpression END

  7. Bind the LDAP policy (first factor) to the authentication virtual server.

    bind authentication vserver auth56 -policy ldap -priority 1 -nextFactor label1 -gotoPriorityExpression next

  8. Bind the RADIUS policy (second factor) to the authentication policy label.

    bind authentication policylabel label1 -policyName radius -priority 2 -gotoPriorityExpression end

Configuring nFactor authentication