View Source

Create a Logon Procedure for ADC Citrix Gateway

Login to the DualShield Administration Console
In the main menu, select Authentication > Logon Procedures

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav51142a5b0308a47f8df9e836ad8cb01d.png

3. Click the "Create" button on the toolbar

4. Enter "Name" and select Web SSO as the type.

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav72b8ea0c95e543b71ef20c6f6ac75974.png

5. Click Save

6. Click the Context Menu icon of the newly create logon procedure, select Logon Steps

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddavaf7d1ca77729b3803b84118468e9fd81.png

7. In the popup windows, click on Add

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav03830c12bdb33d8b1ed9ebd254d6e0a3.png

8. Select the desired authentication method, e.g. Static Password

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav0f6e9a25247d003c8c228c8622059ace.png

9. Click Save

10.Repeat step 7-9 to add more logon steps if desired, e.g. One-Time Password.

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddavb246e2abaae948bb089947003def48b1.png

Create an Application for ADC Citrix Gateway

In the main menu, select Authentication > Application

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav0fcf52eb61c8b2d3d0223b1ffd4acbb4.png

2. Click on Create

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddavafdc6841fe24f41e391b91b75ee9d7c6.png

3. Enter Name

4. Select Realm from drop-down list and Logon Procedure from search button.

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav0372ff42490eb61f6a7b10da6c6eeced.png

5. Click Save

6. Click the context menu of the newly created application, select Agents

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav5bba2d4fc0d82531d2b773701362f7b7.png

7. Select Single Sign-on Server

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav572050e21c2e8ced8074c69605ae28a2.png

8. Click Save

9. Click the context menu of the newly created application, select Self Test

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav5e74f0eecc93597755c0630cbb683996.png

If configured correctly all the tests should pass, as below.

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav419b6a919db231990b330167508374e8.png

Create a SAML Service Provider for ADC Citrix Gateway

In the main menu, select SSO > Service Providers

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddavf55391ea01493f864f7bc310f52dee94.png

2. Click Create

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav339e0dc447680ad7e363b174320a96cc.png

3. In the SSO Server field, select your DualShield SSO server from the list

4. In the Name field, enter the name for the Service Provider to be created

5. In the Type field, select SAML 2.0

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav5fd294ace3f777bd23102a85b4fdaa66.png

6. Click on Create Metadata

7. In the Metadata box, enter the metadata of the service provider to be created. (*see template below)

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddavdde6ce38de8ba9f5ee98745401b96710.png

Use the template below to create the metadata. Change the value of the entityID, ACS and SLO location attributes (highlighted in red) to the FQDN of your Citrix Gateway Virtual Server.
<?xml version="1.0" encoding="UTF-8" ?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://citrix.gateway.fqdn">
<SPSSODescriptor WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
<AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://citrix.gateway.fqdn/cgi/samlauth" index="0" isDefault="true">
</AssertionConsumerService>
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://citrix.gateway.fqdn/cgi/logout" />
</SPSSODescriptor>
</EntityDescriptor>

Click Save.

8. Enable Sign on SAML Assertion under SAML Option

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav41ab5a832489082d15085552f25f3e64.png

9. Click on Attributes tab at the top

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddavf0c1fc96b7a2828460a542a92eb4c38a.png

10. Click Create

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav404d6b7b5661eb8cd3a1bf575635aa98.png

11. On the Attributes builder specify Location as HTTP Body and enter a name for this attribute. In this case I have used the name loginName .

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav1fdce2dc0770d6587e6d8dbfb6308c1b.png

12. Click on the search symbol to the right of the Maps To field.

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav95e95506147b844bbe263c521754b9bd.png

13. Select the identity source that will be used and select Login Name from the Maps to drop down list:

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav281ba219b6ce752f05b067b45d04f01c.png

14. Click Save

15. Click Save again

16. Repeat steps 10 & 11 but this time name the attribute passwd

17. Copy this syntax clearPassword.encodeAsBase64() and paste it into the Maps To field

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav58cf41d4f30018adb10f520e39639175.png

18. Click Save

DualShield MFA Platform > Part 1: Initial configuration on the DualShield Administration Console. > worddav68c30a262b878978fe0204215f8cfd3c.png

19. Click Save again.