Product Documentation

Use Case: Access Control and Authentication

Aug 31, 2016

In high security zones, it is mandatory to externally authenticate the user before a resource is accessed by clients. On the NetScaler appliance, you can use HTTP callouts to externally authenticate the user by evaluating the credentials supplied. In this example, the assumption is that the client is sending the user name and password through HTTP headers in the request. However, the same information could be fetched from the URL or the HTTP body.

To implement this configuration, you must perform the following tasks:

  1. Enable the responder feature on the NetScaler appliance.
  2. Create an HTTP callout on the appliance and configure it with details about the external server and other required parameters.
  3. Configure a responder policy to analyze the response, and then bind the policy globally.
  4. Create a callout agent on the remote server.

Enabling Responder

Updated: 2013-08-30

The responder feature must be enabled before it is used on the NetScaler appliance.

To enable responder by using the configuration utility

  1. Make sure that the responder license is installed.
  2. In the configuration utility, expand AppExpert, and right-click Responder, and then click Enable Responder feature.

Creating an HTTP Callout on the NetScaler Appliance

Updated: 2013-08-30

Create an HTTP callout, HTTP-Callout-3, with the parameter settings shown in the following table. For more information about creating an HTTP callout, see "Configuring an HTTP Callout."
Table 1. Parameters and Values for HTTP-Callout-3
Parameter Value
Name HTTP-Callout-3
Server to receive callout request
IP Address 10.103.9.95
Port 80
Request to send to the server
Method GET
Host Expression 10.102.3.95
URL Stem Expression “/cgi-bin/authenticate.pl”
Headers
Name Request
Value-expression Callout Request
Parameters
Name

Username

Value-expression HTTP.REQ.HEADER("Username").VALUE(0)
Name Password
Value-expression HTTP.REQ.HEADER("Password").VALUE(0)
Server Response
Return Type TEXT
Expression to extract data from the response HTTP.RES.BODY(100)

Creating a Responder Policy to Analyze the Response

Updated: 2013-08-30

Create a responder policy, Policy-Responder-3, that will check the response from the callout server and RESET the connection if the source IP address has been blacklisted. Create the policy with the parameters settings shown in the following table. While you can create a responder policy in the Policies subnode and then bind it globally by using the Responder Policy Manager, this demonstration uses the Responder Policy Manager to create the responder policy and bind the policy globally.
Table 2. Parameters and Values for Policy-Responder-3
Parameter Value
Name Policy-Responder-3
Action RESET
Undefined-Result-Action -Global undefined-result action-
Expression "HTTP.REQ.HEADER(\"Request\").EQ(\"Callout Request\").NOT && SYS.HTTP_CALLOUT(HTTP-Callout-3).CONTAINS(\"Authentication Failed\")"

To create a responder policy and bind it globally by using the configuration utility

  1. Navigate to AppExpert > Responder.
  2. In the details pane, under Policy Manager, click Responder Policy Manager.
  3. In the Responder Policy Manger dialog box, click Override Global.
  4. Click Insert Policy, and then, in the Policy Name column, click New Policy.
  5. In the Create Responder Policy dialog box, do the following:
    1. In Name, type Policy-Responder-3.
    2. In Action, select RESET.
    3. In Undefined-Result Action , select Global undefined-result action.
    4. In the Expression text box, type:
      "HTTP.REQ.HEADER(\"Request\").EQ(\"Callout Request\").NOT && SYS.HTTP_CALLOUT(HTTP-Callout-3).CONTAINS(\"Authentication Failed\")"
    5. Click Create, and then click Close.
  6. Click Apply Changes, and then click Close.

Creating an HTTP Callout Agent on the Remote Server

You now need to create an HTTP callout agent on the remote callout server. The HTTP callout agent receives callout requests from the NetScaler appliance and responds appropriately. The callout agent is a script that is different for each deployment and must be written with server specifications in mind, such as the type of database and the scripting language supported.

Following is sample callout agent pseudo-code that verifies whether the supplied user name and password are valid. The agent can be implemented in any programming language of your choice. The pseudo-code is to be used only as a guideline for developing the callout agent. You can build additional functionality into the program.

To verify the supplied user name and password by using pseudo-code

  1. Accept the user name and password supplied in the request and format them appropriately.
  2. Connect to the database that contains all the valid user names and passwords.
  3. Check the supplied credentials against your database.
  4. Format the response as required by the HTTP callout.
  5. Send the response to the NetScaler appliance.