ADC

401 based authentication

May 2, 2022

Contributed by:

C S

With 401 based Authentication, the Citrix ADC appliance presents a pop-up dialog box to the end user.

401 based AAA-TM

Form based AAA-TM works on the redirect messages. However, some applications do not support redirects. In such applications, 401 authentication enabled AAA-TM is used.

Ensure the following for 401 Authentication Enabled AAA-TM to work:

‘authnVsName’ parameter value for the load balancing virtual server must be the name of the authentication virtual server to be used to authenticate users.
‘authn401’ parameter must be enabled. The command for configuring the same is as follows:
```
 set lb vs lb1 –authn401 on –authnvsName <aaavs-name>
```

The following steps walk through how the 401 Authentication works:

User tries to access a particular URL using the load balancing virtual server.
The load balancing virtual server sends a 401 HTTP response back to the user indicating that authentication is required for the access.
The user sends its credentials to the load balancing virtual server in the authorization header.
The load balancing virtual server authenticates the user and then connects the user to the back end servers.

Important:

For a load balancing virtual server with 401 authentication ON, multiple authentication and authorization sessions might be created for the same user in a short time. This might lead to spike in memory. In this case, you can apply the following configuration on the Citrix ADC appliance to debug and identify the end client application.

>set syslogparams -userDefinedAuditlog yes
>
>add audit messageaction 401_log_act InFORMATIONAL '"LB-401 accessed: User: <" + AAA.USER.NAME + "> SessionID <"+ AAA.USER.SESSIONID + "> Client :<" + CLIENT.IP.SRC + "> accessed URL: <" + HTTP.REQ.URL + ">"'
>
>add rewritepolicy rewrite_401_log true NOREWRITE -logAction 401_log_act
>
>bind lb vserver <lb_name> -policyName rewrite_401_log -priority 100 -type reqUEST

<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

401 based authentication

May 2, 2022

Contributed by:

C S

May 2, 2022

Contributed by:

C S

401 based authentication

In this article