NetScaler nFactor Authentication with Azure MFA on NPS Server

Recently we found out that we could not update the NetScaler to the latest build of the 13.0 firmware version if the customer was also using the Citrix Workspace App account to log in to the Citrix portal. Somehow Citrix wants us to build the nFactor authentication and is not supporting the classic configuration on the gateway anymore in higher firmware versions. Any version higher then 13.0-84.11 will break the log in process for the Workspace App.

In this post, I will configure NetScaler nFactor Authentication to simplify the onboarding of Azure MFA Authentication via the NPS Extension.

Tip! if you still need to set up an NPS server, you can find a nice post here from Christiaan Brinkhoff.

Configuring NetScaler nFactor Authentication

  • Go to Security > AAA – Application Traffic > Virtual Servers
  • Click on Add to create a Authentication Virtual Server
  • Create a name for example: AuthVS_nFactor_AzureMFA
  • Set the IP Address Type to Non Addressable
  • Click on OK
  • Now you need to bind a certificate, in most scenarios, this will be the wildcard certificate already configured on the gateway
  • Click on Select Server Certificate and Bind the certificate
  • Once the certificate is bound, you can skip any additional steps for now, just click Done at the bottom

Add LDAP and RADIUS Authentication Server Profile

  • Go to Security > AAA – Application Traffic > Policies > Authentication > Basic Policies > LDAP
  • Click on Add to create an ldap authentication policy
  • Create a name for example ldaps_auth_AzureMFA
  • In this case, we have LDAP load-balanced, so we will select the lbvip for ldap
  • Type ns_true in the Expression field (from version 13.1, the classic expressions will change to “True”)
  • Now we need to repeat the steps for radius
  • Go to Security > AAA – Application Traffic > Policies > Authentication > Basic Policies > RADIUS
  • Click on Add to create an radius authentication policy
  • Create a name for example radius_auth_AzureMFA
  • In this case radius is not load balanced, so I will select the NPS server
  • Type ns_true in the Expression field (from version 13.1, the classic expressions will change to “True”)

Authentication Login Schema Profile and Policy

  • Go to Security > AAA – Application Traffic > Login SchemaPolicies
  • Click on Add to create an Authentication Login Schema Policy
  • Create a name for example SingleAuth_AzureMFA
  • Click on Add to create an configure Login Schema Profile
  • Now select the SingleAuth.xml and click on Edit
  • You can edit the labels if you like
  • Also create a name for example SingleAuth_AzureMFA
  • Click on Save
  • Click on Select to select the profile
  • Click on Create
  • Type True in the Rule field and click on OK
  • Confirm the Login Schema Policy and Profile are created (you can switch between the tabs)

Create a Policy Label

  • Go to Security > AAA – Application Traffic > Policies > Authentication > Advanced Policies > Policy Label
  • Click on Add to create an Authentication Policy Label
  • Create a name for example nFactor_Radius_AzureMFA_PolicyLabel
  • Click on Continue
  • Now Bind the PolicyLabel

Assign Authentication Policy and Login Schema to the Authentication vServer

  • Go to Security > AAA – Application Traffic > Virtual Servers
  • Now click under Advanced Authentication Policy on No Authentication Policy
  • Click on Select Policy
  • Select the LDAP Policy
  • Now for the Next Factor Select the RADIUS Policy Label
  • Now assign the Login Schema you created earlier
  • Click on + Login Schema
  • Click on No Login Schema
  • Click on Select Policy
  • Select you Login Schema you created earlier and click on Bind

Create Authentication Profile and Assign to the Gateway

  • Go to NetScaler Gateway > Virtual Servers > Edit your Gateway > Select Authentication Profile
  • Click on + Authentication Profile
  • Click on Add to create an Authentication Profile
  • Create a name for example nFactor_Auth_AzureMFA_Profile
  • Click on Select to add the Authentication Virtual Server and click on Create

We have now configured a simple nFactor configuration for Microsoft MFA. You can also use this configuration for SMS/TEXT. If you use the Microsoft Authenticator App, you will get a prompt in the Microsoft Authenticator App you need to approve. If you use SMS/TEXT you will get an second screen for you confirmation. The nFactor authentication will be the same on the Workspace App.

That’s all folks!

Summary

I was kind of proud of myself for making this configuration on trail and error and some digging on the internet (Credits to James Kindon). This is probably not the most complex configuration you can build, but it works for the needs of the customer where I build this. Maybe nice to know you can also use a simplified way using the nFactor Visualizer. I hope you can use this for your advantage. If you have any questions, please let me know.

Leave a Comment

Your email address will not be published.

Scroll to Top