Has anybody configured reCAPTCHA for v14? <reCaptc...
# citrix-netscalere
Eric
02/26/2025, 1:48 PMHas anybody configured reCAPTCHA for v14? reCaptcha configuration for nFactor authentication | Authentication, authorization, and auditing application traffic
Eric
02/26/2025, 1:49 PMDoes the vServer require an internal or external IP address?
Eric
02/26/2025, 1:49 PMadd authentication vserver auth SSL <IP> <Port>
p
Peter Mommerency
02/28/2025, 2:49 PMHi Eric
did you get it to work?
Was looking into that too, but I'm stuck. Captcha is visible, if I check the "not a robot" it just times out. I suppose my NS config is OK, but I'm missing something on the Google side/site.
Did you follow only the docs (which are very limited on the Google side of things), or some other blog?
Thx
e
Eric
02/28/2025, 10:31 PMYes I did, Grok3 worked so much better, even with non-addressable
Eric
02/28/2025, 10:31 PM# Enable AAA feature
enable ns feature AAA
# Create authentication vServer (non-addressable)
add authentication vserver auth_vserver_recaptcha SSL 0.0.0.0
# Create CAPTCHA action
add authentication captchaAction recaptcha_action -siteKey "" -secretKey ""
# Create CAPTCHA policy
add authentication policy recaptcha_policy -rule "true" -action recaptcha_action
# Create login schema (optional)
add authentication loginSchema singleauthcaptcha -authenticationSchema "/nsconfig/loginschema/LoginSchema/SingleAuthCaptcha.xml"
add authentication loginSchemaPolicy singleauthcaptcha_policy -rule "true" -action singleauthcaptcha
# Bind policies to authentication vServer
bind authentication vserver auth_vserver_recaptcha -policy recaptcha_policy -priority 100
bind authentication vserver auth_vserver_recaptcha -policy singleauthcaptcha_policy -priority 100
# Create and bind authentication profile to Gateway vServer
add authentication authnProfile auth_profile_recaptcha -authnVsName auth_vserver_recaptcha
# bind vpn vserver NSGWNAME -authnProfile auth_profile_recaptcha
Eric
02/28/2025, 10:31 PMand of course bind your SSL cert
p
Peter Mommerency
03/03/2025, 6:46 AMThanks. Thing is I already had nFactor in place, using an authenthication profile, so can't follow the guide to the letter.
But as said, I see the Captcha on my GW page, if I click the Not a robot box, it just times out after about a minute. So I believe I'm missing a part on the Captcha config of Google.
e
Eric
03/03/2025, 11:05 AMI have learned that you are not able to edit existing nFactor flows, you need to delete and recreate. I would recommend creating a test Auth Server with the cmds above, and then just link that new authnProfile to your existing GW. It's a learning experience. Once I learn that I needed to recreate the nFactor, I was able to get it working with DUO. nFactor flow reCATPCHA - LDAP - DUO (3 factors).
p
Peter Mommerency
03/04/2025, 7:31 AMI created a new nFactor Flow, 1st factor is just the Captcha, with a loginschema I created (edited the SingleAuthCaptcha.xml and threw out all the stuff I suppose I don't need. I want only the captcha on it, if they forward then second step is username (which validates if the user exists and is found in a specific AD group, if so third factor is SAML/Azure.
But I can't even go past that stage
?xml version="1.0" encoding="UTF-8"?
<AuthenticateResponse xmlns="http://citrix.com/authentication/response/1">
Statussuccess/Status
Resultmore-info/Result
StateContext/
AuthenticationRequirements
PostBack/nf/auth/doAuthentication.do/PostBack
CancelPostBack/nf/auth/doLogoff.do/CancelPostBack
CancelButtonTextCancel/CancelButtonText
Requirements
RequirementCredentialIDnf-recaptcha/IDTypenf-recaptcha/Type/CredentialLabelTextsingleauthcaptcha_captcha/TextTypensg-login-label/Type/Label/Requirement
/Requirements
/AuthenticationRequirements
/AuthenticateResponse
Peter Mommerency
03/04/2025, 7:40 AMAfter clicking the Not a robot checkbox, it takes a minute and gives this error.
e
Eric
03/04/2025, 2:05 PMI would recommend getting reCaptcha only working and build from there. I would not recommend editing the default XML
💡 1
p
Peter Mommerency
03/05/2025, 9:04 AM"Don't run if you can't walk", (need to remind myself of that more often 😉)
Thanks for the recommendation, got it to work 🙂
As you state, I first started with the default login schema (user/pass/captcha) and that worked out of the box.
Then modified the login schema to remove the password field only.
So user needs to enter username and click the captcha.
In the background the first factor is the Captcha, second is LDAP (user exists + group check), then third is SAML.
💯 1
5 Views