Configure protected user as an authentication factor in NetScaler nFactor authentication

December 5, 2025

Contributed by:

The following figure displays Kerberos authentication flow for the protected users:

Protected user authentication workflow

Sample configuration

The following configuration is an example setup for performing authentication based on user group membership:

For users in the protected users group, it applies protected user authentication.
For users not in the protected users group, it applies LDAP authentication.

add server dc1 dc1.aaa.local

add service svc1 dc1.aaa.local HTTP 80

add lb vserver lb2 SSL <> 443 -persistenceType NONE -cltTimeout 180 -AuthenticationHost <ip address pointing to auth_vs> -Authentication ON

bind lb vserver lb2 svc1

add authentication vserver auth_vs SSL <> 443

bind ssl vserver auth_vs -certkeyName <>

add authentication ldapAction ldap_group_extraction -serverIP 10.106.187.40 -ldapBase
"OU=Sanity,dc=aaa,dc=local" -ldapBindDn administrator@aaa.local -ldapBindDnPassword <> -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN -authentication DISABLED
add authentication Policy ldap_group_extraction -rule true -action ldap_group_extraction

add authentication policylabel policy1

add authentication ldapAction ldap_auth_enabled -serverIP 10.106.187.40 -ldapBase "OU=Sanity,dc=aaa,dc=local" -ldapBindDn administrator@aaa.local -ldapBindDnPassword <> -ldapLoginName samAccountName -groupAttrName memberOf

add authentication Policy no_ldap -rule "!AAA.USER.IS_MEMBER_OF(\"Protected Users\")"
-action NO_AUTHN

add authentication Policy no_protected_user -rule "AAA.USER.IS_MEMBER_OF(\"Protected Users\")" -action NO_AUTHN

add dns nameServer 10.106.187.40

add authentication protectedUserAction UserAction1 -realmStr AAA.LOCAL -maxConcurrentUsers 8

add authentication Policy UserAction1 -rule true -action UserAction1

bind authentication policylabel policy1 -policyName no_ldap -priority 1 -gotoPriorityExpression NEXT -nextFactor ldap_auth_enabled

bind authentication policylabel policy1 -policyName no_protected_user -priority 2 -gotoPriorityExpression NEXT -nextFactor UserAction1

bind authentication vserver auth_vs -policy ldap_group_extraction -priority 1 -nextFactor policy1 -gotoPriorityExpression NEXT
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NetScaler Secure Deployment Guide

Configure protected user as an authentication factor in NetScaler nFactor authentication

December 5, 2025

Contributed by:

December 5, 2025

Contributed by:

Configure protected user as an authentication factor in NetScaler nFactor authentication

Sample configuration

In this article