mardi 3 mars 2015

Using Netscaler as ADFS proxy - Exported configuration

After my last blog article on how to replace the Microsoft ADFS Proxy, I've been asked to provide the configuration of my Netscaler for the ADFS proxy replacement so I've exported the part that are needed to achieve this, please comment with a little thanks if it was helpful to you. Note that I'm using Netscaler 10.1 with ADFS 2.0 on windows 2008r2.

I found a Citrix article about ADFS 3.0 that refer to the fact that Netscaler doesn't support the sni feature for the backend server that is used in ADFS 3.0 which is most likely causing headache to ADFS 3.0 users.
The citrix article refer you to this microsoft article that talk about a way to partially disable the SNI feature for ADFS 3.0...

Here's the code and some comments :

********* Begin Starting Notes *******
This config is for Netscaler 10.1 (Currently at Build 129.11 but it's been working with previous 10.1. build)
Your Netscaler must be licensed for "AAA - Traffic management" and it must be enable under settings -> "Configure Basic Features" (Authentication, Authorization and Auditing)
Your ADFS URL must be reachable by DNS externally (you can't authenticate using IP address, it has to be a DNS name, worst case scenario you can edit your host file temporarily for testing)
you need to have an external IP address available to Setup the Reverse Proxy

If you have multiple domain, you can easily repeat the config for the second domain and add the 2nd LDAP policy to the authentication Vserver with a different priority

Example: bind authentication Vserver -policy -priority 110
The domain settings in the Netscaler is not related to the AD domain but to the domain in the FQDN url (i.e.: email domain, If your internal domain is company.local and your website is then the domain you set in the Netscaler is

********* End Starting Notes *******

********* Begin configuration code *******


add serviceGroup SG_LDAP_CORP_389 TCP -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -cltTimeout 9000 -svrTimeout 9000 -CKA NO -TCPB NO -CMP NO -appflowLog DISABLED
bind serviceGroup SG_LDAP_CORP_389 DomainControllerCorp1 389 -CustomServerID "\"None\""
bind serviceGroup SG_LDAP_CORP_389 DomainControllerCorp2 389 -CustomServerID "\"None\""

add lb vserver LB_LDAP_CORP TCP 389 -persistenceType NONE -cltTimeout 9000
bind lb vserver LB_LDAP_CORP SG_LDAP_CORP_389

add authentication ldapAction LDAP-LB_LDAP_corp -serverIP -authTimeout 5 -ldapBase "DC=corp,DC=Company,DC=com" -ldapBindDn -ldapBindDnPassword TypeThePasswordForTheAccountHere -encrypted -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN -nestedGroupExtraction ON -maxNestingLevel 4 -groupNameIdentifier samAccountName -groupSearchAttribute memberOf -groupSearchSubAttribute CN
add authentication ldapPolicy ns_true LDAP-LB_LDAP_corp

add authentication vserver SSL 443 -AuthenticationDomain
bind authentication vserver -policy -priority 100

set tm sessionParameter -SSO ON

add serviceGroup SG_ADFS_HTTPS SSL -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP NO -appflowLog DISABLED
bind serviceGroup SG_ADFS_HTTPS ADFS_Server1 443 -CustomServerID "\"None\""
bind serviceGroup SG_ADFS_HTTPS ADFS_Server2 443 -CustomServerID "\"None\""
bind serviceGroup SG_ADFS_HTTPS -monitorName https-ecv

add lb vserver LB_ADFS_Proxy_Replacement_FullAuth_Forest SSL 443 -persistenceType COOKIEINSERT -timeout 0 -cltTimeout 180 -AuthenticationHost -Authentication ON
bind lb vserver LB_ADFS_Proxy_Replacement_FullAuth_Forest SG_ADFS_HTTPS
bind ssl vserver LB_ADFS_Proxy_Replacement_FullAuth_Forest -certkeyName Company-wildcard

*************** This part is related to RSA and is optional but we require that user authenticate using their AD password AND RSA token, make sure the LDAP part works fine before adding secondary authentication ***************

add serviceGroup SG_RSA_1645 RADIUS -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport NO -cltTimeout 120 -svrTimeout 120 -CKA NO -TCPB NO -CMP NO -appflowLog DISABLED

bind serviceGroup SG_RSA_1645 RSA-AM-Server1 1645 -CustomServerID "\"None\""
bind serviceGroup SG_RSA_1645 RSA-AM-Server2 1645 -CustomServerID "\"None\""
bind serviceGroup SG_RSA_1645 -monitorName ping

add lb vserver LB_RSA-AM RADIUS 1645 -persistenceType SOURCEIP -timeout 700 -cltTimeout 120
bind lb vserver LB_RSA-AM SG_RSA_1645

add authentication radiusAction LB_RSA-AM_srv -serverIP -serverPort 1645 -radKey YourRadiusSharedSecretHere -encrypted
add authentication radiusPolicy Radius-Company ns_true LB_RSA-AM_srv

bind authentication vserver -policy Radius-Company -priority 100 -secondary

********* End configuration code *******

*************** Begin Ending Notes ***************

For LDAP authentication action, you have to create a standard user (no special right required except "password never expire") for the netscaler to use this account to log in to the LDAP server and check for the user credential. The GUI offer an option to test the LDAP credential to make sure the connection works.

The Domain you set on your ADFS_Proxy_replacement and on your MUST MATCH with the domain in the URL your users are sent for the ADFS authentication. My ADFS is setup as, this is the name clients will connect to, and so it must be resolvable via DNS externally. must resolve to your LB_ADFS_Proxy_Replacement_FullAuth_Forest

*************** Finish Ending Notes ***************

5 commentaires:

  1. Hi - does this config work ok for full Outlook and Lync clients?

  2. I have not tested if this ADFS setup work with the full outlook and Lync client as we're not using ADFS to authenticate external Outlook or Lync client since they are on premise and not in the cloud. We're using this to authenticate only using passive ADFS to log in O365 and other federated partner. Outlook services are authenticated by our netscaler using AAATM either as Form base (OWA/ECP) or 401 Auth (ActiveSync, EWS). As for Lync it was deployed with the Lync Edge before we started using ADFS or doing authentication on the Netscaler.

  3. Hi, can you please share your ActiveSync configuration on the Netscaler using AAA? Thanks

  4. Hi, can you please share your ActiveSync configuration on the Netscaler using AAA? Thanks

    1. I posted a new blog article with the exchange configuration on my Netscaler.