trying to block AD group from accessing Gateway; ...
# citrix-netscalerc
Corey Tracey
04/07/2025, 7:27 PMtrying to block AD group from accessing Gateway; along with blocking at SAML IDP, trying to block at gateway. We are using AAA groups and EPA as well. What I am experiencing is that if EPA passes, i can see the AD Group extraction, along with my EPA allowed group, being aggregated, in the ns.log. If EPA fails, I only see my EPA quarantine group being aggregated, and I lose my ability to filter on my AD group to block access. Is this normal behavior?
a
Arnaud Pain
04/08/2025, 6:03 AMWhy are you not trying to filter as group with pre authentication?
r
Richard Faulkner
04/08/2025, 1:27 PMI would need to see the fails action and policy to see. If it passes, does it aggregate all group membership? If it fails it aggregates only the fail group? Are you doing the EPA scan before any authentication?
c
Corey Tracey
04/08/2025, 2:39 PM@Richard Faulkner Yes. when it passes, it aggregates EPA allow group and LDAP groups; when it fails, it only aggregates the EPA quarantine fail group. EPA is after SAML and LDAP group extraction.
Corey Tracey
04/08/2025, 2:40 PM@Arnaud Pain They do SAML 1st then LDAP group extraction then EPA so currently no plans to change the user facing authentication process.
r
Richard Faulkner
04/08/2025, 2:57 PMI am confused. If it does the SAML, then LDAP and you have a block group, it should block the group before it gets to the EPA scan since it should pull the group from either SAML or LDAP.
c
Corey Tracey
04/08/2025, 3:02 PMand it does if EPA Scan is successful. I see my AD block group and and I see my EPA allow group being aggregated so i can filter on the block group. But if EPA scan fails, i am only presented with my EPA fail quarantine group. (i do see LDAP group extraction occurring prior to this). So the behavior is clearly tied to an EPA failure...
Corey Tracey
04/08/2025, 4:43 PMThis is from ns.log:
1st pair from EPA Pass: two AD groups from LDAP group extraction and then my EPAPass group is aggregated
Apr 8 123803 <local0.info> 10.10.100.140 04/08/20251638:03 GMT CLT-CXADC-03 0-PPE-2 : default AAA EXTRACTED_GROUPS 526713 0 : Extracted_groups "Citrix.BlockGateway,Citrix.AllowSAMLGateway"
Apr 8 123808 <local0.info> 10.10.100.140 04/08/20251638:08 GMT CLT-CXADC-03 0-PPE-2 : default AAA EXTRACTED_GROUPS 526781 0 : Extracted_groups "Citrix.BlockGateway,Citrix.AllowSAMLGateway,EPAPass"
2nd pair from EPA Fail: two AD groups from LDAP group extraction and then only my EPAFail group is presented
Apr 8 123900 <local0.info> 10.10.100.140 04/08/20251639:00 GMT CLT-CXADC-03 0-PPE-1 : default AAA EXTRACTED_GROUPS 377421 0 : Extracted_groups "Citrix.BlockGateway,Citrix.AllowSAMLGateway"
Apr 8 123902 <local0.info> 10.10.100.140 04/08/20251639:02 GMT CLT-CXADC-03 0-PPE-2 : default AAA EXTRACTED_GROUPS 527047 0 : Extracted_groups "EPAFail"
Corey Tracey
04/08/2025, 8:44 PMusing this as a hint, i reworked my epa actions to not use allowed/quarantine groups and use next factor logic to set my allowed/quarantine groups. this allowed my AD group extraction to continue to 'work' . nFactor - EPA - Quarantine Group Issue - Authentication Terminates Prematurely - Core ADC use cases - Citrix Community
👍 3
2 Views