Gateway

Configuring Client Certificate Authentication

January 8, 2024

Contributed by:

Users logging on to a NetScaler Gateway virtual server can also be authenticated based on the client certificate attributes presented to the virtual server. Client certificate authentication can also be used with other authentication types, such as LDAP or RADIUS, to provide two-factor authentication.

To authenticate users based on the client-side certificate attributes, client authentication must be enabled on the virtual server and the client certificate must be requested. You must bind a root certificate to the virtual server on NetScaler Gateway.

When users log on to the NetScaler Gateway virtual server, after authentication, the user name information is extracted from the specified field of the certificate. Typically, this field is Subject:CN. If the user name is extracted successfully, the user is then authenticated. The authentication fails in the following cases.

If the user does not provide a valid certificate during the Secure Sockets Layer (SSL) handshake.
The user name extraction fails, authentication fails.

You can authenticate users based on the client certificate by setting the default authentication type to use the client certificate. You can also create a certificate action that defines what is to be done during the authentication based on a client SSL certificate.

To configure the client certificate as the default authentication type by using the GUI

Go to Configuration > NetScaler Gateway, and then click Global Settings.
In the details pane, under Authentication Settings, click Change authentication CERT settings.
Select ON to enable two factor authentication using the certificate as per your requirement.
In User Name Field, select the type of certificate field that holds the user names.
In Group Name Field, select the type of the certificate field that holds the group name.
In Default Authorization Group, type the name of the default group, and then click OK.

Extracting the User Name from the Client Certificate

If client certificate authentication is enabled on NetScaler Gateway, users are authenticated based on certain attributes of the client certificate. After authentication is successful, the user name or the user and group name of the user are extracted from the certificate. Also, the policies specified for that user are applied.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring Client Certificate Authentication

January 8, 2024

Contributed by:

January 8, 2024

Contributed by:

Configuring Client Certificate Authentication

To configure the client certificate as the default authentication type by using the GUI

Extracting the User Name from the Client Certificate

In this article