Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Use Case: Access control and authentication

September 14, 2021
Contributed by: 
S C S

In high security zones, it is mandatory to externally authenticate the user before a resource is accessed by clients. On the Citrix ADC appliance, you can use HTTP callouts to externally authenticate the user by evaluating the credentials supplied. In this example, the assumption is that the client is sending the user name and password through HTTP headers in the request. However, the same information could be fetched from the URL or the HTTP body.

To implement this configuration, you must perform the following tasks:

  1. Enable the responder feature on the Citrix ADC appliance.
  2. Create an HTTP callout on the appliance and configure it with details about the external server and other required parameters.
  3. Configure a responder policy to analyze the response, and then bind the policy globally.
  4. Create a callout agent on the remote server.

Enabling Responder

The responder feature must be enabled before it is used on the Citrix ADC appliance.

To enable responder by using the configuration utility

  1. Make sure that the responder license is installed.
  2. In the configuration utility, expand AppExpert, and right-click Responder, and then click Enable Responder feature.

Creating an HTTP callout on the Citrix ADC appliance

Create an HTTP callout, HTTP-Callout-3, with the parameter settings shown in the following table. For more information about creating an HTTP callout, see Configuring an HTTP Callout.

Table 1. Parameters and Values for HTTP-Callout-3

Parameter Value Name
Name Policy-Responder-3  

Parameter

Value

Name

HTTP-Callout-3

Server to receive callout request:

IP Address

10.103.9.95

Port

80

Request to send to the server:

Method

GET

Host Expression

10.102.3.95

URL Stem Expression

“/cgi-bin/authenticate.pl”

Headers:

Name

Request

Value-expression

Callout Request

Parameters:

Name

Username

Value-expression

HTTP.REQ.HEADER(“Username”).VALUE(0)

Name

Password

Value-expression

HTTP.REQ.HEADER(“Password”).VALUE(0)

Server Response:

Return Type

TEXT

Expression to extract data from the response

HTTP.RES.BODY(100)

Creating a Responder Policy to Analyze the Response

Create a responder policy, Policy-Responder-3, that will check the response from the callout server and RESET the connection if the source IP address has been blacklisted. Create the policy with the parameters settings shown in the following table. While you can create a responder policy in the Policies subnode and then bind it globally by using the Responder Policy Manager, this demonstration uses the Responder Policy Manager to create the responder policy and bind the policy globally.

Table 2. Parameters and Values for Policy-Responder-3

Parameter Value
Name Policy-Responder-3
Action RESET
Undefined-Result-Action -Global undefined-result action-
Expression “HTTP.REQ.HEADER(\“Request\”).EQ(\“Callout Request\”).NOT && SYS.HTTP_CALLOUT(HTTP-Callout-3).CONTAINS(\“Authentication Failed\”)”

To create a responder policy and bind it globally by using the configuration utility

  1. Navigate to AppExpert > Responder.
  2. In the details pane, under Policy Manager, click Responder Policy Manager.
  3. In the Responder Policy Manger dialog box, click Override Global.
  4. Click Insert Policy, and then, in the Policy Name column, click New Policy.

  5. In the Create Responder Policy dialog box, do the following:

    1. In Name, type Policy-Responder-3.
    2. In Action, select RESET.
    3. In Undefined-Result Action , select Global undefined-result action.
    4. In the Expression text box, type:
    "HTTP.REQ.HEADER(\"Request\").EQ(\"Callout Request\").NOT && SYS.HTTP_CALLOUT(HTTP-Callout-3).CONTAINS(\"Authentication Failed\")"
<!--NeedCopy-->
    1. Click Create, and then click Close.
  6. Click Apply Changes, and then click Close.

Creating an HTTP Callout Agent on the Remote Server

You now need to create an HTTP callout agent on the remote callout server. The HTTP callout agent receives callout requests from the Citrix ADC appliance and responds appropriately. The callout agent is a script that is different for each deployment and must be written with server specifications in mind, such as the type of database and the scripting language supported.

Following is sample callout agent pseudo-code that verifies whether the supplied user name and password are valid. The agent can be implemented in any programming language of your choice. The pseudo-code is to be used only as a guideline for developing the callout agent. You can build additional functionality into the program.

To verify the supplied user name and password by using pseudo-code

  1. Accept the user name and password supplied in the request and format them appropriately.
  2. Connect to the database that contains all the valid user names and passwords.
  3. Check the supplied credentials against your database.
  4. Format the response as required by the HTTP callout.
  5. Send the response to the Citrix ADC appliance.
Use Case: Access control and authentication
September 14, 2021
Contributed by: 
S C S
September 14, 2021
Contributed by: 
S C S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.