Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Smart card-based authentication for management GUI access

December 5, 2024
Contributed by: 
C

Note:

Smart card-based authentication feature is available in NetScaler FIPS release from 13.1-37.219 version onwards.

NetScaler supports smart card-based authentication for NetScaler management GUI, where a user can be authenticated using the client certificate stored in the smart card (for example, Common Access Card, Personal Identity Verification). This feature simplifies the login process for smart card users, granting them access to the NetScaler management GUI without the need for entering their credentials (user name and password).

When the user inserts the smart card into the smart card reader, NetScaler first validates the smart card certificate to ensure its authenticity. Once the certificate is successfully validated, the user name associated with the smart card is extracted and cross-checked against the LDAP server (active directory) to verify that the user exists. The details of the group to which the user belongs to is retrieved from the external LDAP server. Based on the user group the user is allowed to access authorized resources and perform permitted actions on the GUI.

You can configure smart card-based authentication as mandatory or optional authentication. When configured as optional, users can authenticate to NetScaler by using the smart card or by entering the user name and password. When configured as mandatory, users can authenticate to NetScaler only by using the smart card.

To support smart card-based authentication, NetScaler automatically creates an internal SSL service that listens on port 8443 for each management-enabled IP address.

Notes:

  • Ensure that HTTPS is enabled for the NetScaler management GUI access. Smart card-based authentication for the NetScaler management GUI is only available over HTTPS.
  • Ensure that LDAP is configured. It is mandatory to configure LDAP for smart card-based authentication.
  • Ensure that port 8443 is not blocked by any firewall.

Configure smart card-based authentication by using the CLI

To configure smart card-based authentication, perform the following steps:

  1. Create an LDAP authentication action.

    Note:

    Ensure that you configure -authentication as DISABLED and -PasswordlessMgmtAccess as ENABLED.

    add authentication ldapAction <action> -serverIP <LDAPServerIP> -ldapBase <LdapBase> -ldapBindDn <LdapAdminUser> -ldapBindDnPassword <LdapAdminPassword> -ldapLoginName samAccountName -groupAttrName memberOF -subAttributeName CN -authentication DISABLED -PasswordlessMgmtAccess ( ENABLED | DISABLED )
<!--NeedCopy-->

    Example:

    add authentication ldapAction ldapaction1 -serverIP 10.1.2.3 -ldapBase "dc=myldap-test, dc=com" -ldapBindDn administrator@myldap-test.com -ldapBindDnPassword pwd@123 -ldapLoginName testuser -groupAttrName memberOf -subAttributeName CN -authentication DISABLED -PasswordlessMgmtAccess ENABLED
<!--NeedCopy-->

  2. Add an LDAP authentication policy.

    add authentication policy <policyname> -rule true -action <ldap action name>
<!--NeedCopy-->

    Example:

    add authentication policy ldappolicy1 -rule true -action ldapaction1
<!--NeedCopy-->

  3. Bind the LDAP policy globally.

    bind system global <policyName> [-priority <positive_integer]
<!--NeedCopy-->

    Example:

    bind system global ldappolicy1  -priority 2
<!--NeedCopy-->

  4. Create a user group and bind a command policy to a user group for authorization.

    Note:

    LDAP authorization requires identical group names in the Active directory, on the LDAP server, and on NetScaler. Therefore, ensure to use the same group name as in the LDAP server on the NetScaler. The characters and case must also be the same.

    add system group <group name>

bind system group <group name> -policyName <commandpolicy Name> <priority>
<!--NeedCopy-->

    Example:

    add system group superusergroup

bind system group superusergroup -policyName ldappolicy1
<!--NeedCopy-->

  5. Add an SSL certificate-key pair by specifying the CA certificate path. The certificate configured here is used to validate the certificates stored on the smart card.

    add ssl certKey <certificate-key> -cert <certificate>
<!--NeedCopy-->

    Example:

    add ssl certKey mycertificatekey -cert certificatename.cer
<!--NeedCopy-->

  6. Add a Certificate Revocation List (CRL). A Certificate Revocation List (CRL) identifies invalid certificates by serial number and issuer.

    add ssl crl <crlName> <crlPath> [-inform (DER | PEM)] -refresh [ENABLED | DISABLED] -CAcert <certificate> -method [HTTPS] -URL <url> -port <portnumber>
<!--NeedCopy-->

    Example:

    add ssl crl mycrlpath-CRL crlnameA.crl -inform DER -refresh ENABLED -CAcert certificatename -method HTTPS -url "https://xxyy.crl" -port 443
<!--NeedCopy-->

  7. Bind the certificates to the internal SSL service (nshttps-certauth-127.0.0.1-8443) created to support smart card authentication.

    bind ssl service <service name> -certkeyName <certificate keyname> -CA
<!--NeedCopy-->

    Example:

    bind ssl service nshttps-certauth-127.0.0.1-8443 -certkeyName mycertificatekey -CA
<!--NeedCopy-->

  8. Enable client authentication for the internal service and configure the client certificate as optional or mandatory.

    set ssl service nshttps-certauth-127.0.0.1-8443 -clientAuth ENABLED -clientCert <Optional | Mandatory>
<!--NeedCopy-->

    Example:

    set ssl service nshttps-certauth-127.0.0.1-8443 -clientAuth ENABLED -clientCert Optional
<!--NeedCopy-->

Configure smart card-based authentication by using the GUI

To configure smart card-based authentication by using the GUI, perform the following steps:

  1. Add an LDAP authentication policy and LDAP authentication action.

    1. Navigate to System > Authentication > Advanced Policies > Policy and click Add.
    2. Enter a Name, choose Action Type as LDAP.
    3. Click Add under Action and provide a name for the LDAP action. Provide the required details. Ensure that the Authentication checkbox is cleared and Passwordless Management Access is set to Enabled. Click Create.
    4. Enter the Expression, click Create, and then click Close.

  2. Bind the LDAP authentication policy globally.

    1. Navigate to System > Authentication > Advanced Policies > Policy, click Global Binding, and then click Add Binding.
    2. On the Policy Binding page, select the required LDAP policy and enter the other binding details.
    3. Click Bind and then click Done.

  3. Create a user group and bind the command policy to a user group for authorization.

    1. Navigate to System > User Administration > Groups and click Add.
    2. Enter the required details, add members, bind command policies and click Create.

  4. Add an SSL certificate-key pair by specifying the CA certificate path. The certificate configured here is used to validate the certificates stored on the smart card.

    1. Navigate to Traffic Management > SSL > Certificates > CA Certificates and click Install.
    2. In Install CA Certificate, type the details, such as the certificate and key file name, and click Install.

  5. Add a Certificate Revocation List (CRL). A Certificate Revocation List (CRL) identifies invalid certificates by serial number and issuer.

    1. Navigate to Traffic Management > SSL > CRL and click Add.
    2. Enter CRL Name, choose a CRL File, fill in the required details, and click Create.

  6. Bind the certificates to the internal SSL service (nshttps-certauth-127.0.0.1-8443) created to support smart card authentication.

    1. Navigate to Traffic Management > Load Balancing > Services > Internal Services tab, select nshttps-certauth-127.0.0.1-8443 and click Edit.
    2. In the Certificate > CA Certificate section, click Add Binding.
    3. On the CA Certificate Binding page, select the required CA certificates and click Bind.

  7. Enable the client authentication for the internal service and configure the client certificate as optional or mandatory.

    1. Navigate to Traffic Management > Load Balancing > Services > Internal Services tab, select nshttps-certauth-127.0.0.1-8443 and click Edit.
    2. Click the edit icon in the SSL Parameters section.
    3. Select the Client Authentication checkbox and then choose Mandatory or Optional from Client Certificate.
    4. Click OK and then Done.

Access NetScaler management GUI by using smart card-based authentication

To access NetScaler management GUI by using the smart card, perform the following steps:

  1. Insert the smart card into the smart card reader.

  2. Open a browser and use HTTPS to access the NetScaler management IP address.

  3. Click Sign in using Smart Card. The browser gets redirected to port 8443 and a pop-up to select the certificate appears.

    Smart card-based authentication sign-in page

  4. Select the required certificate and click OK.

    Smart card-based authentication certificate selection

  5. Enter the PIN when prompted. NetScaler management access home page appears.

  6. To sign out, click the user name at the top right corner and click Sign Out. Take out the smart card from the smart card reader.

This section provides tips for troubleshooting issues related to smart card-based authentication.

  • When a user is unable to authenticate to NetScaler management GUI using a smart card,
    • Check if the user is accessing the NetScaler management GUI over HTTPS.
    • Check if the user has selected the correct certificate.
    • Check if the user has entered the correct PIN.
    • Check if the certificate is valid and not expired.

References

Smart card-based authentication for management GUI access
December 5, 2024
Contributed by: 
C
December 5, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.