Citrix ADC as a SAML IdP
The SAML IdP (Identity Provider) is a SAML entity that is deployed on the customer network. The IdP receives requests from the SAML SP and redirects users to a logon page, where they must enter their credentials. The IdP authenticates these credentials with the user directory (external authentication server, such as LDAP) and then generates a SAML assertion that is sent to the SP.
The SP validates the token, and the user is then granted access to the requested protected application.
When the Citrix ADC appliance is configured as an IdP, all requests are received by an authentication virtual server that is associated with the relevant SAML IdP profile.
A Citrix ADC appliance can be used as a IdP in a deployment where the SAML SP is configured either on the appliance or on any external SAML SP.
When used as a SAML IdP, a Citrix ADC appliance:
Supports all authentication methods that it supports for traditional logons.
Digitally signs assertions. Support for the SHA256 algorithm is introduced in NetScaler 11.0 Build 55.x.
Supports single-factor and two-factor authentication. SAML must not be configured as the secondary authentication mechanism.
Can encrypt assertions by using the public key of the SAML SP. This is recommended when the assertion includes sensitive information. Support introduced in NetScaler 11.0 Build 55.x.
Can be configured to accept only digitally signed requests from the SAML SP. Support introduced in NetScaler 11.0 Build 55.x.
Can log on to the SAML IdP by using the following 401-based authentication mechanisms: Negotiate, NTLM, and Certificate. Support introduced in NetScaler 11.0 Build 55.x.
Can be configured to send 16 attributes in addition to the NameId attribute. The attributes must be extracted from the appropriate authentication server. For each of them, you can specify the name, the expression, the format, and a friendly name in the SAML IdP profile. Support introduced in NetScaler 11.0 Build 55.x.
If the Citrix ADC appliance is configured as a SAML IdP for multiple SAML SP, a user can gain access to applications on the different SPs without explicitly authenticating every time. The Citrix ADC appliance creates a session cookie for the first authentication, and every subsequent request uses this cookie for authentication. Support introduced in NetScaler 11.0 Build 55.x.
Can send multi-valued attributes in a SAML assertion. Support introduced in NetScaler 11.0 Build 64.x.
Supports post and redirect bindings. Support for redirect bindings is introduced in NetScaler 11.0 Build 64.x. Support for artifact binding is introduced in Citrix ADC release 13.0 Build 36.27.
Can specify the validity of a SAML assertion.
If the system time on Citrix ADC SAML IdP and the peer SAML SP is not in sync, the messages might get invalidated by either party. To avoid such cases, you can now configure the time duration for which the assertions are valid.
This duration, called the “skew time,” specifies the number of minutes for which the message must be accepted. The skew time can be configured on the SAML SP and the SAML IdP.
Support introduced in NetScaler 11.0 Build 64.x.
Can be configured to serve assertions only to SAML SPs that are pre-configured on or trusted by the IdP. For this configuration, the SAML IdP must have the service provider ID (or issuer name) of the relevant SAML SPs. Support introduced in NetScaler 11.0 Build 64.x.
Before proceeding, make sure that you have an authentication virtual server that is linked to an LDAP authentication server.
To configure a Citrix ADC appliance as a SAML IdP by using the command line interface
Configure a SAML IdP profile.
Adding Citrix ADC appliance as an IdP with SiteMinder as the SP.
add authentication samlIdPProfile samlIDPProf1 -samlSPCertName siteminder-cert -encryptAssertion ON -samlIdPCertName ns-cert -assertionConsumerServiceURL http://sm-proxy.nsi-test.com:8080/affwebservices/public/saml2assertionconsumer -rejectUnsignedRequests ON -signatureAlg RSA-SHA256 -digestMethod SHA256
Configure the SAML authentication policy and associate the SAML IdP profile as the action of the policy.
add authentication samlIdPPolicy samlIDPPol1 -rule true -action samlIDPProf1
Bind the policy to the authentication virtual server.
bind authentication vserver saml-auth-vserver -policy samlIDPPol1 -priority 100
To configure a Citrix ADC appliance as a SAML IdP by using the GUI
Configure the SAML IdP profile and policy.
Navigate to Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > Policy, and create a policy with SAML IdP as the action type, and associate the required SAML IdP profile with the policy.
Associate the SAML IdP policy with an authentication virtual server.
Navigate to Security > AAA - Application Traffic > Virtual Servers, and associate the SAML IdP policy with the authentication virtual server.
Support for artifact binding in SAML IdP
Citrix ADC appliance configured as SAML Identity Provider (IdP) supports artifact binding. The artifact binding enhances the security of SAML IdP and restricts the malicious users from inspecting the assertion.
Assertion Consumer Service URL support for SAML IdP
A Citrix ADC appliance configured as a SAML Identity Provider (IdP) now supports Assertion Consumer Service (ACS) indexing to process SAML Service Provider (SP) request. The SAML IdP imports ACS indexing configuration from SP metadata or allows for entering ACS indexes information manually.