Citrix ADC as a SAML IdP
The SAML IdP (Identity Provider) is a SAML entity that is deployed on the customer network. The IdP receives requests from the SAML SP and redirects users to a logon page, where they must enter their credentials. The IdP authenticates these credentials with the active directory (external authentication server, such as LDAP) and then generates a SAML assertion that is sent to the SP.
The SP validates the token, and the user is then granted access to the requested protected application.
When the Citrix ADC appliance is configured as an IdP, all requests are received by an authentication virtual server that is associated with the relevant SAML IdP profile.
Note
A Citrix ADC appliance can be used as a IdP in a deployment where the SAML SP is configured either on the appliance or on any external SAML SP.
When used as a SAML IdP, a Citrix ADC appliance:
-
Supports all authentication methods that it supports for traditional logons.
-
Digitally signs assertions.
-
Supports single-factor and two-factor authentication. SAML must not be configured as the secondary authentication mechanism.
-
Can encrypt assertions by using the public key of the SAML SP. This is recommended when the assertion includes sensitive information.
-
Can be configured to accept only digitally signed requests from the SAML SP.
-
Can log on to the SAML IdP by using the following 401-based authentication mechanisms: Negotiate, NTLM, and Certificate.
-
Can be configured to send 16 attributes in addition to the NameId attribute. The attributes must be extracted from the appropriate authentication server. For each of them, you can specify the name, the expression, the format, and a friendly name in the SAML IdP profile.
-
If the Citrix ADC appliance is configured as a SAML IdP for multiple SAML SP, a user can gain access to applications on the different SPs without explicitly authenticating every time. The Citrix ADC appliance creates a session cookie for the first authentication, and every subsequent request uses this cookie for authentication.
-
Can send multi-valued attributes in a SAML assertion.
-
Supports post and redirect bindings. Support for artifact binding is introduced in Citrix ADC release 13.0 Build 36.27.
-
Can specify the validity of a SAML assertion.
If the system time on Citrix ADC SAML IdP and the peer SAML SP is not in sync, the messages might get invalidated by either party. To avoid such cases, you can now configure the time duration for which the assertions are valid.
This duration, called the “skew time,” specifies the number of minutes for which the message must be accepted. The skew time can be configured on the SAML SP and the SAML IdP.
-
Can be configured to serve assertions only to SAML SPs that are pre-configured on or trusted by the IdP. For this configuration, the SAML IdP must have the service provider ID (or issuer name) of the relevant SAML SPs.
Note
Before proceeding, make sure that you have an authentication virtual server that is linked to an LDAP authentication server.
To configure a Citrix ADC appliance as a SAML IdP by using the command line interface
-
Configure a SAML IdP profile.
Example
Adding Citrix ADC appliance as an IdP with SiteMinder as the SP.
add authentication samlIdPProfile samlIDPProf1 -samlSPCertName siteminder-cert -encryptAssertion ON -samlIdPCertName ns-cert -assertionConsumerServiceURL http://sm-proxy.nsi-test.com:8080/affwebservices/public/saml2assertionconsumer -rejectUnsignedRequests ON -signatureAlg RSA-SHA256 -digestMethod SHA256 –acsUrlRule AAA.LOGIN.SAML_REQ_ACS_URL.REGEX_MATCH(re#^https://example2\.com/cgi/samlauth$#)Points to note
-
In SAML IdP profile, configure acsURLRule that takes an expression of the list of applicable service provider URLs for this IdP. This expression depends on the SP being used. If Citrix ADC is configured as SP, ACS URL will be
https://<SP-domain_name>/cgi/samlauth. Citrix recommends having a full URL in the expression for matching. -
SAML supports only RSA certificate. Other certificates like HSM, FIPS, and so on are not supported.
-
You must specify the starting of the domain with “^” sign (example: ^https) along with the dollar sign “$” at the end of the string (example: samlauth$).
For more details on the command, see https://developer-docs.citrix.com/projects/citrix-adc-command-reference/en/latest/authentication/authentication-samlAction and https://support.citrix.com/article/CTX316577.
-
-
Configure the SAML authentication policy and associate the SAML IdP profile as the action of the policy.
add authentication samlIdPPolicy samlIDPPol1 -rule true -action samlIDPProf1 -
Bind the policy to the authentication virtual server.
bind authentication vserver saml-auth-vserver -policy samlIDPPol1 -priority 100For more details on the command, see https://developer-docs.citrix.com/projects/citrix-adc-command-reference/en/latest/authentication/authentication-samlIdPProfile.
To configure a Citrix ADC appliance as a SAML IdP by using the GUI
-
Navigate to Security>AAA-Policies>Authentication>Advanced Policies>SAML IdP.
-
Select Servers tab, click Add, enter values for the following parameters, and click Create.
Parameter description:
Assertion Consumer Service URL - URL that the authenticated user will be redirected to.
IdP Certificate Name - Certificate-Key pair used for the authentication page.
SP Certificate Name - Certificate of the Service Provider in this scenario, the key is not required for this.
Sign Assertion - The option to sign the assertion and the response when redirecting the client back to the Service Provider.
Issuer Name - A string value included in the SAML assertion issued by IdP.
Service Provider ID - Unique ID that is specified on SP to help identify the service provider. The ID can be anything and does not need to be the URL as specified below, but needs to be the same on the SP profile and the IdP profiles.
Reject Unsigned Requests - Option you can specify to ensure only assertions signed with the SP Certificate are accepted.
Signature Algorithm - Algorithm used to sign and verify the assertions between the IdP and SP, this needs to be the same on the IdP profile and the SP profile.
Digest Method - Algorithm used to verify the integrity of the Assertions between IdP and SP, this needs to be the same on the IdP profile and the SP profile.
SAML Binding - Same as described in the SP profile, it needs to be the same on SP and IdP.
-
Associate the SAML IdP policy with an authentication virtual server.
Navigate to Security > AAA - Application Traffic > Virtual Servers, and associate the SAML IdP policy with the authentication virtual server.