Configuring the OpenID connect protocol

A NetScaler appliance can now be configured as an identity provider by using OpenID Connect protocol. OpenID connect protocol strengthens identity providing capabilities of the NetScaler appliance. You can now access enterprise wide hosted application with a single sign-on as OpenID connect offers more security by not transferring user password but works with tokens with specific lifetime. OpenID also is designed to integrate with non-browser clients such as apps and services. Therefore, OpenID connect has been widely adopted by many implementations.

Advantages of having the OpenID connect support

• OpenID eliminates overhead of maintaining multiple authentication passwords as the user has a single identity across organization.
• OpenID provides a robust security for your password as the password is shared only with your identity provider and not with any application you access.
• OpenID has vast interoperability with various systems making it easier for the hosted applications to accept OpenID.
• OpenID is a simple protocol that enables native clients to easily integrate with servers.

To configure NetScaler appliance as an IdP using the OpenID Connect protocol with the GUI**

1. Navigate to Configuration > Security > AAA-Application Traffic > Policies > Authentication > Advanced Policies > OAuth IdP.

2. Click Profile and click Add.

   On the Create Authentication OAuth IDP Profile screen, set values for the following parameters and click Create.

   • Name – Name of the authentication profile.
   • Client ID – Unique string that identifies SP.
   • Client Secret – Unique secret that identifies SP.
   • Redirect URL – Endpoint on SP to which code/token has to be posted.
   • Issuer Name –  String that identifies IdP.
   • Audience – Target recipient for the token being sent by IdP. This might be checked by the recipient.
   • Skew Time – The time for which the token remains valid.
   • Default Authentication Group – A group added to the session for this profile to simplify policy evaluation and help in customizing policies.

3. Click Policies and click Add.

4. On the Create Authentication OAuth IDP Policy screen, set values for the following parameters and click Create.

   • Name – The name of the authentication policy.
   • Action – Name of profile created above.
   • Log Action –Name of messagelog action to use when a request matches this policy. This is not mandatory filed.
   • Undefined-Result Action – Action to perform if the result of policy evaluation is undenfined(UNDEF). This is not mandatory field.
   • Expression – Default syntax expression that the policy uses to respond to specific request. For example, true.
   • Comments –  Any comments about the policy.

Binding the OAuthIDP policy and LDAP policy to the authentication virtual server

1. Navigate to Configuration > Security > AAA-Application Traffic > Policies >Authentication > Advanced Policies > Actions > LDAP.

2. On LDAP Actions screen, click Add.

3. On Create Authentication LDAP Server screen, set the values for the following parameters, and click Create.

   • Name – The name of the ldap action**
   • ServerName/ServerIP – Provide FQDN or IP of the LDAP server**
   • Choose appropriate values for Security Type, Port, Server Type, Time-Out
   • Make sure Authentication is checked
   • Base DN – Base from which to start LDAP search. For example, dc=aaa,dc=local.
   • Administrator Bind DN: Username of the bind to LDAP server. For example, admin@aaa.local.
   • Administrator Password/Confirm Password: **Password to bind LDAP
   • Click Test Connection to test your settings.
   • Server Logon Name Attribute: Choose “sAMAccountName”
   • Other fields are not mandatory and hence can be configured as required.

4. Navigate to Configuration > Security > AAA-Application Traffic > Policies >Authentication > Advanced Policies > Policy.

5. On Authentication Policies screen, click Add.

6. On Create Authentication Policy page, set the values for the following parameters and click Create.

   • Name – Name of the LDAP Authentication Policy.**
   • Action Type – Choose LDAP.
   • Action – Choose the LDAP action created above.**
   • Expression – Default syntax expression that the policy uses to respond to specific request. For example, true.

To configure the NetScaler appliance as an IdP using the OpenID Connect protocol with the command line

At the command prompt, type the following commands:

• add authentication OAuthIDPProfile <name> [-clientID <string>][-clientSecret ][-redirectURL <URL>][-issuer <string>][-audience <string>][-skewTime <mins>] [-defaultAuthenticationGroup <string>]

• add authentication OAuthIdPPolicy <name> -rule <expression> [-action <string> [-undefAction <string>] [-comment <string>][-logAction <string>]

• add authentication ldapAction aaa-ldap-act -serverIP 10.0.0.10 -ldapBase "dc=aaa,dc=local"

• ldapBindDn <administrator@aaa.local> -ldapBindDnPassword <password> -ldapLoginName

sAMAccountName

• add authentication policy aaa-ldap-adv-pol -rule true -action aaa-ldap-act

• bind authentication vserver auth_vs -policy <ldap_policy_name> -priority 100 -gotoPriorityExpression NEXT

• bind authentication vserver auth_vs -policy <OAuthIDPPolicyName> -priority 5 -gotoPriorityExpression END

• bind vpn global –certkey <>

Note

You can bind more than one key. Public parts of certificates bound are sent in response to jwks_uri query (https://gw/oauth/idp/certs)).