401 based authentication

With 401 based Authentication, the Citrix ADC appliance presents a pop-up dialog box to the end user.

401 based AAA-TM

Form based AAA-TM works on the redirect messages. However, some applications do not support redirects. In such applications, 401 authentication enabled AAA-TM is used.

Ensure the following for 401 Authentication Enabled AAA-TM to work:

  • ‘authnVsName’ parameter value for the load balancing virtual server must be the name of the authentication virtual server to be used to authenticate users.

  • ‘authn401’ parameter must be enabled. The command for configuring the same is as follows:

     set lb vs lb1 –authn401 on –authnvsName <aaavs-name>

The following steps walk through how the 401 Authentication works:

  1. User tries to access a particular URL using the load balancing virtual server.

  2. The load balancing virtual server sends a 401 HTTP response back to the user indicating that authentication is required for the access.
  3. The user sends its credentials to the load balancing virtual server in the authorization header.
  4. The load balancing virtual server authenticates the user and then connects the user to the back end servers.

    401 based AAA-TM flow diagram


For a load balancing virtual server with 401 authentication ON, multiple authentication and authorization sessions might be created for the same user in a short time. This might lead to spike in memory. In this case, you can apply the following configuration on the Citrix ADC appliance to debug and identify the end client application.

>set syslogparams -userDefinedAuditlog yes
>add audit messageaction 401_log_act InFORMATIONAL '"LB-401 accessed: User: <" + AAA.USER.NAME + "> SessionID <"+ AAA.USER.SESSIONID + "> Client :<" + CLIENT.IP.SRC + "> accessed URL: <" + HTTP.REQ.URL + ">"'
>add rewritepolicy rewrite_401_log true NOREWRITE -logAction 401_log_act
>bind lb vserver <lb_name> -policyName rewrite_401_log -priority 100 -type reqUEST

401 based authentication