NetScaler as a SAML IdP
The SAML IdP (Identity Provider) is a SAML entity that is deployed on the customer network. The IdP receives requests from the SAML SP and redirects users to a logon page, where they must enter their credentials. The IdP authenticates these credentials with the active directory (external authentication server, such as LDAP) and then generates a SAML assertion that is sent to the SP.
The SP validates the token, and the user is then granted access to the requested protected application.
When the NetScaler appliance is configured as an IdP, all requests are received by an authentication virtual server that is associated with the relevant SAML IdP profile.
Note
A NetScaler appliance can be used as a IdP in a deployment where the SAML SP is configured either on the appliance or on any external SAML SP.
When used as a SAML IdP, a NetScaler appliance:
-
Supports all authentication methods that it supports for traditional logons.
-
Digitally signs assertions.
-
Supports single-factor and two-factor authentication. SAML must not be configured as the secondary authentication mechanism.
-
Can encrypt assertions by using the public key of the SAML SP. This is recommended when the assertion includes sensitive information.
-
Can be configured to accept only digitally signed requests from the SAML SP.
-
Can log on to the SAML IdP by using the following 401-based authentication mechanisms: Negotiate, NTLM, and Certificate.
-
Can be configured to send 16 attributes in addition to the NameId attribute. The attributes must be extracted from the appropriate authentication server. For each of them, you can specify the name, the expression, the format, and a friendly name in the SAML IdP profile.
-
If the NetScaler appliance is configured as a SAML IdP for multiple SAML SP, a user can gain access to applications on the different SPs without explicitly authenticating every time. The NetScaler appliance creates a session cookie for the first authentication, and every subsequent request uses this cookie for authentication.
-
Can send multi-valued attributes in a SAML assertion.
-
Supports post and redirect bindings. Support for artifact binding is introduced in NetScaler release 13.0 Build 36.27.
-
Can specify the validity of a SAML assertion.
If the system time on NetScaler SAML IdP and the peer SAML SP is not in sync, the messages might get invalidated by either party. To avoid such cases, you can now configure the time duration for which the assertions are valid.
This duration, called the “skew time,” specifies the number of minutes for which the message must be accepted. The skew time can be configured on the SAML SP and the SAML IdP.
-
Can be configured to serve assertions only to SAML SPs that are pre-configured on or trusted by the IdP. For this configuration, the SAML IdP must have the service provider ID (or issuer name) of the relevant SAML SPs.
Note
Before proceeding, make sure that you have an authentication virtual server that is linked to an LDAP authentication server.
To configure a NetScaler appliance as a SAML IdP by using the command line interface
-
Configure a SAML IdP profile.
Example
Adding NetScaler appliance as an IdP with SiteMinder as the SP.
add authentication samlIdPProfile samlIDPProf1 -samlSPCertName siteminder-cert -encryptAssertion ON -samlIdPCertName ns-cert -assertionConsumerServiceURL http://sm-proxy.nsi-test.com:8080/affwebservices/public/saml2assertionconsumer -rejectUnsignedRequests ON -signatureAlg RSA-SHA256 -digestMethod SHA256<!--NeedCopy--> -
Configure the SAML authentication policy and associate the SAML IdP profile as the action of the policy.
add authentication samlIdPPolicy samlIDPPol1 -rule true -action samlIDPProf1<!--NeedCopy--> -
Bind the policy to the authentication virtual server.
bind authentication vserver saml-auth-vserver -policy samlIDPPol1 -priority 100<!--NeedCopy-->For more details on the command, see https://developer-docs.citrix.com/projects/citrix-adc-command-reference/en/latest/authentication/authentication-samlIdPProfile/
To configure a NetScaler appliance as a SAML IdP by using the GUI
-
Configure the SAML IdP profile and policy.
Navigate to Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > SAML IDP, and create a policy with SAML IdP as the action type, and associate the required SAML IdP profile with the policy.
-
Associate the SAML IdP policy with an authentication virtual server.
Navigate to Security > AAA - Application Traffic > Virtual Servers, and associate the SAML IdP policy with the authentication virtual server.