Application Delivery Management

SSO Google Apps StyleBook

March 11, 2024

Contributed by:

R C

Google Apps is a collection of cloud computing, productivity and collaboration tools, software and products that are developed by Google. Single Sign-On (SSO) enables users to access all of their enterprise cloud applications—including administrators signing in to the admin console—by signing in one time for all services using their enterprise credentials.

The NetScaler ADM SSO Google Apps StyleBook allows you to enable SSO for Google Apps through NetScaler instances. The StyleBook configures the NetScaler instance as a SAML identity provider for authenticating users to access Google Apps.

Enabling SSO for Google apps in a NetScaler instance using this StyleBook results in the following steps:

Configuring the authentication virtual server
Configuring a SAML IdP policy and profile
Binding the policy and profile to the authentication virtual server
Configuring an LDAP authentication server and policy on the instance
Binding the LDAP authentication server and policy to your authentication virtual server configured on the instance

Configuration details:

The table below lists the minimum required software versions for this integration to work successfully. The integration process will also supports the higher versions of the same.

Product	Minimum Required Version
NetScaler	Release 11.0, Advanced/Premium License

The following instructions assume that you have already created the appropriate external or internal DNS entries to route authentication requests to a NetScaler-monitored IP address.

Deploying SSO Google apps StyleBook configurations:

The following task assists you in deploying the Microsoft SSO Google Apps StyleBook in your business network.

To deploy SSO Google apps StyleBook

In NetScaler ADM, navigate to Applications > Configurations > StyleBooks. The StyleBooks page displays all the StyleBooks available for your use in NetScaler ADM. Scroll down and find SSO Google Apps StyleBook. Click Create Configuration.
The StyleBook opens as a user interface page on which you can enter the values for all the parameters defined in this StyleBook.
Enter values for the following parameters:
1. Application Name. Name of the SSO Google apps configuration to deploy in your network.
2. Authentication Virtual IP address. Virtual IP address used by the authentication, authorization, and auditing virtual server to which the Google apps SAML IdP policy is bound.
3. SAML Rule Expression. By default, the following NetScaler Policy (PI) expression is used: HTTP.REQ.HEADER(“Referrer”).CONTAINS(“google”). Update this field with another expression if your requirement is different. This policy expression matches the traffic to which these SAML SSO settings are applied and makes sure that the Referrer header is coming from a Google domain.
The SAML IdP Settings section allows you to configure your NetScaler Instance as a SAML identity provider by creating the SAML IdP profile and policy that is used by the authentication, authorization, and auditing virtual server created in step 3.
1. SAML Issuer Name. In this field, enter the public FQDN of your authentication virtual server. Example: https://<NetScaler Auth VIP>/saml/login
2. SAML Service Provider (SP) ID. (optional) NetScaler identity provider accepts SAML authentication requests from an issuer name that matches this ID.
3. Assertion Consumer Service URL. Enter the service provider’s URL where NetScaler identity provider needs to send the SAML assertions after successful user authentication. The assertion consumer service URL can be initiated at the identity provider server site or the service provider site.
4. There are other optional fields that you can enter in this section. For example, you can set the following options:
  1. SAML binding profile (the default is the “POST” profile).
  2. Signature algorithm to verify/sign SAML requests/responses (default is “RSA-SHA1”).
  3. Method to digest hash for SAML requests/responses (default is “SHA-1”).
  4. Encryption algorithm (default is AES256), and other settings.
  Note
  
  Citrix recommends that you retain the default settings as these settings have been tested to be compatible with Google Apps.
5. You can also enable User Attributes check box to enter the user details such as:
  1. Name of the user attribute
  2. NetScaler PI expression that is evaluated to extract the attribute’s value
  3. User-friendly name of the attribute
  4. Select the format of the user attribute.
  These values are included in the issued SAML Assertion. You can include as many as five sets of user attributes in an Assertion issued by NetScaler using this StyleBook.
In LDAP Settings section, enter the following details to authenticate Google Apps users. For domain users to be able to log on to the NetScaler instance by using their corporate email addresses, you must configure the following:
1. LDAP (Active Directory) Base. Enter the base domain name for the domain in which the user accounts reside within the Active Directory (AD) for which you want to allow authentication. For example, dc=netscaler,dc=com
2. LDAP (Active Directory) Bind DN. Add a domain account (using an email address for ease of configuration) that has rights to browse the AD tree. For example,cn=Manager,dc=netscaler,dc=com
3. LDAP (Active Directory) Bind DN Password. Enter the password of the domain account for authentication.
4. A few other fields that you need to enter in this section are as follows:
  1. LDAP server IP Address that NetScaler connects to for authenticating users
  2. LDAP server’s FQDN name
    
    Note
    
    You must specify at least one of the above two - the LDAP server IP address or the FQDN name.
  3. LDAP server port that NetScaler connects to for authenticating users (default is 389).
  4. LDAP host name. This is used to validate the LDAP Certificate if validation is turned on (by default, it is turned off).
  5. LDAP login name attribute. The default attribute used to extract login names is “sAMAccountName.”
  6. Other optional miscellaneous LDAP settings
In SAML IdP SSL Certificate section, you can specify the details of the SSL certificate:
1. Certificate Name. Enter the name of the SSL certificate.
2. Certificate File. Choose the SSL certificate file from the directory on your local system or on NetScaler ADM.
3. CertKey Format. Select the format of the certificate and the private-key files from the drop-down list box. The formats supported are .pem and .der extensions.
4. Certificate Key Name. Enter the name of the certificate private key.
5. Certificate Key File. Select the file containing the private key of the certificate from your local system or from NetScaler ADM.
6. Private Key Password. If your private key file is protected by a passphrase, enter it in this field.
7. You can also enable Advanced Certificate Settings check box to enter details such as certificate expiry notification period, enable or disable the certificate expiry monitor.
Optionally, you can select IdP SSL CA Certificate if the SAML IdP Certificate entered above requires a CA public Certificate to be installed on NetScaler. Make sure you select “Is a CA Certificate” in the advanced settings.
Optionally, you can select SAML SP SSL Certificate to specify Google SSL certificate (public key) used to validate authentication requests from Google Apps (SAML SP).
Click Target Instances and select the NetScaler instance(s) on which to deploy this Google Apps SSO configuration. Click Create to create the configuration and deploy the configuration on the selected NetScaler instance(s).

Note

You can also click the refresh icon to add recently discovered NetScaler instances in NetScaler ADM to the available list of instances in this window.

Also,

Tip

Citrix recommends that before running the actual configuration, you select Dry Run to visually confirm the configuration objects that are created on the target NetScaler instance(s) by the StyleBook.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

SSO Google Apps StyleBook

March 11, 2024

Contributed by:

R C

March 11, 2024

Contributed by:

R C

SSO Google Apps StyleBook

To deploy SSO Google apps StyleBook

In this article