https://worldofeuc.com logo
Join Slack
Powered by
Does anyone use NetScaler as a SAMP IdP? I'm work...
# citrix-netscaler
d
Does anyone use NetScaler as a SAMP IdP? I'm working through a scenario where I have multiple SAML IdP profiles, and multiple SAML SP policies (for IdP chaining) on the one AAA vserver but can't seem to find a way to link a request to a specific SAML IdP policy to use a particular SAML SP policy for the chained auth.
k
Are you doing SP-initiated authentication? I think you should have all the SAML IdP policies with "true" as the expression and then the actual "mapping" occurs on the Service Provider ID
so that the IdP processing is some what similar to cascade authentication...
not sure if you can examine the SP ID on the http request or with AAA parameter, might be, but the cascade should work
AAA.LOGIN.SAML_REQ_ACS_URL.
could get you close, but that's the ACS URL and it should be in the request
d
Between the IdP and the application SP that all works fine - it's where I have the 'chained' policies going to the parent IdP. Ie I have SAML IdP Policy A and SAML IdP policy B bound as SAML IDP policies, the correct policy gets hit because as you said the Service Provider ID in the IdP policy is unique per SP. However I can't figure out how to ensure SAML IdP Policy A uses SAML SP Auth Policy A that goes to my top level IdP (and same for SAML IdP policy B should chain to SAML SP Auth Policy B). The SAML_REQ_ACS_URL in the request from the NetScaler to the top level IdP is always the URL of the NetScaler VIP IdP so I can't use that to choose between the policies
k
urgh... you have just one top level IdP?
isn't it just that the NetScaler AAA/GW is SP for that top level IdP, so all should go there?
d
No there will be multiple - one SP policy for each IdP policy
k
so the NetScaler is in sort of middle of everything, it's SP for multiple IdPs and IdP for multiple SPs? 😄
🤯
d
haha yep
But it's a 1:1, each NetScaler IDP-SP maps to a NetScaler SP -External IDP
k
but you still want to use a single GW/AAA?
I mean if you could use a SAN or wildcard cert and point several FQDNs to that one Gateway and toy around with HTTP.REQ.HOSTNAME.EQ -expression on NetScaler and configure each top level IdP to use a different NetScaler FQDN
d
Yeah that's part of the issue. Client wants one URL/login page
k
so they'll go to "gateway.danielcorp.com" and start off from there?
but that then takes you to different top-level IdPs?
d
Yep - I have a usernameonly login schema where user enters UPN. I use that for a CS policy to direct them to an app server, the app server has a SAML policy that points back to the NS.
k
I have a feeling that there might be a communication problem here, I might not get the whole use-case which makes it a bit dangerous to give out advice
oh, I get that, we've done sth similar
so once you've hit that SP, you bounce back to gateway and from there to the top level IdP
I've done some Responder Redirects to set cookies for that kind of redirection and then use that cookie for routing the traffic
d
Issue is my login schema is on one vserver and the IDP policies are on another, so I can't set a cookie... I tried putting everything on one AAA vserver but the login schema stuff interfered with the SAML policies
I might be onto something now. The NetScaler IDP policy sets the NSC_TASS cookie and the value stays the same throughout the session. If I could store the value and read it again for the NetScaler SP SAML policy that might work. Never done that though, so about to go read up and see if that's possible
Success! If I use this expression for my SAML policy, it works just the way I want 🙂 HTTP.REQ.COOKIE.VALUE("NSC_TASS").B64DECODE.CONTAINS("<SAML-IDP-Profile-Name>")
🙌🏼 1
🙌 1
k
that's cool!
Open in Slack
PreviousNext
Powered by