This message was deleted.
# citrix-netscalers
Slackbot
04/23/2021, 12:23 PMThis message was deleted.
c
c4rm0
04/23/2021, 12:39 PMif the AAA group matches a AD group it will only work if you are using ldap so you would need a username only schema with a ldap advanced auth policy that does ldap group extraction as 1st factor before then moving onto the next factor which would be your policy label that contains your saml advanced auth policy/no loginschema
c4rm0
04/23/2021, 12:43 PMYou cant use AAA groups if you just have have an advanced SAML auth policy bound either at the AAA vserver with no loginschema or bound at the NS GW Vserver in the case of the basic auth saml policy. There isnt any LDAP so groups cant be extracted from AD which means your AAA groups wont work
🍻 1
💯 1
j
John Gallacher
04/23/2021, 12:54 PMGot it, John. Makes sense... any other tricks to direct certain users to a choice session policy bound to the saml vserver gateway? Its only used by 10% of the workforce so I would like to avoid enabling choices for all, cheers
c
Carl Stalhood
04/23/2021, 1:08 PMYou can add LDAP Group Extraction. https://www.carlstalhood.com/citrix-federated-authentication-service-saml/#nfactorsamlldapgroupextract
c
c4rm0
04/23/2021, 1:11 PMyeah thats what i use Carl the ldap group extraction advanced auth policy bound to my AAA vserver has authentication turned off and its using the username only login schema with next factor my policy label that contains my saml advanced auth policy / no login schema. I then use a AAA group which has a session profile bound which has my FAS enabled storefront store
c4rm0
04/23/2021, 1:12 PMNot that i am aware of John as you will need ldap to extract the groups for AAA. client choices is set on the session profile and you can only really bind that session policy globally/NS GW vserver/AAA groups and users
f
Frank Vandebergh
04/23/2021, 1:37 PMThere might be another way but it gets quite complicated.
You could add “WebAuth” as a next factor where the webauth is designed as some dummy ‘always success’ action. In that webauth action you can specify ‘Default Authentication Group’ to assign and on that AAA group attach the session policy.
I did similar in the past to go to next factor depending on SAML attribute and in next factor use a dummy WebAuth action to set a default group
j
John Gallacher
04/23/2021, 2:46 PMNice one folks, I'll have a look and do some testing 🙂
John Gallacher
04/28/2021, 3:30 PM@c4rm0 trying to replicate your method, I have my test account in a new group which has been added as a AAA group, I have a session policy bound to this that hits Choices HTML but its not working.. I have the LDAP extraction setup but I think I'm missing something with the Schema / binding for next factor... when I hit the vserver Im get promted for SAML / Azure AD auth then land on SF... cheers
c
c4rm0
04/28/2021, 3:35 PMon my AAA vserver i only have the advanced auth policy (LDAP Group extraction) this has my Azure MFA policy label configured as next factor (that policy label has the Azure MFA SAML advanced auth policy and no loginschema) then i have the usernameonly login schema bound to my AAA vserver
c4rm0
04/28/2021, 3:43 PMyou will get the error "The saml authentication request property "subject is not supported and must not be set" after being redirected to Azure AD because your using saml with nfactor https://www.leeejeffries.com/azure-ad-saml-subject-is-not-supported-and-must-not-be-set/ but if you add the commands leee mentions it works flawlessly
c4rm0
04/28/2021, 3:56 PMThe flow will go like this - user goes to GW page and is presented with username only loginschema they enter there username (Samaccoutname) the advanced ldap auth policy will perform group extraction to get a list of AD groups the user belongs to (No auth performed as authentication turned off) it will then move onto the next factor which is your policy label with your SAML policy/server and user will get redirected to IDP and be prompted for login creds /MFA. Because the groups was extracted in earlier step the session policy/profile bound to the AAA group should take affect (give it a low priority eg priority 10 when binding to the AAA group) and you should get your client choices
j
John Gallacher
04/28/2021, 4:03 PMAh! Legend... I will test this evening and feedback, beers in the post 😉
c
c4rm0
04/28/2021, 4:04 PMjust tested it and works fine
c4rm0
04/28/2021, 4:06 PMi created a new session policy / profile with client choices enabled that was bound to a AAA group called clientchoices (priority 10) which my test user was a member of in AD. 100% worked as not got client choices enabled on the session polices / profile bound to my NS GW Vserver 🙂
🍻 1
j
John Gallacher
04/29/2021, 8:47 AM@c4rm0 - Works perfectly! Another one I owe you 😉
👍 1