Configuring Authorization Policies
When you configure an authorization policy, you can set it to allow or deny access to network resources in the internal network. For example, to allow users access to the 10.3.3.0 network, use the following expression:
CLIENT.IP.DST.IN_SUBNET(10.3.0.0/16)
Authorization policies are applied to users and groups. After a user is authenticated, NetScaler Gateway performs a group authorization check by obtaining the user’s group information from either an RADIUS, LDAP, or TACACS+ server. If group information is available for the user, NetScaler Gateway checks the network resources allowed for the group.
To control which resources users can access, you must create authorization policies. If you do not need to create authorization policies, you can configure default global authorization.
If you create an expression within the authorization policy that denies access to a file path, you can only use the subdirectory path and not the root directory. For example, use fs.path contains “\\dir1\\dir2” instead of fs.path contains “\\rootdir\\dir1\\dir2”. If you use the second version in this example, the policy fails.
After you configure the authorization policy, you then bind it to a user or group as shown in the tasks below.
By default, authorization policies are validated first against policies that you bind to the virtual server and then against policies bound globally. If you bind a policy globally and want the global policy to take precedence over a policy that you bind to a user, group, or virtual server, you can change the priority number of the policy. Priority numbers start at zero. A lower priority number gives the policy higher precedence.
For example, if the global policy has a priority number of one and the user has a priority of two, the global authentication policy is applied first.
Important:
- Classic authorization policies are applied only on TCP traffic.
Advanced authorization policy can be applied on all types of traffic (TCP/UDP/ICMP/DNS).
To apply policy on UDP/ICMP/DNS traffic, policies must be bound at type UDP_REQUEST, ICMP_REQUEST, and DNS_REQUEST respectively.
- While binding, if “type” is not explicitly mentioned or “type” is set to REQUEST, the behavior does not change from earlier builds, that is these policies are applied only to TCP traffic.
- The policies bound at UDP_REQUEST do not apply for DNS traffic. For DNS, policies must be explicitly bound to DNS_REQUEST TCP_DNS is similar to other TCP requests.
For more details on advanced authorization policies, see article https://support.citrix.com/article/CTX232237.
Sample authorization policy expressions
Following are the expression examples of authorization policies:
-
add authorization policy athzPol1 "HTTP.REQ.USER.IS_MEMBER_OF(\"allowedGroup\")" ALLOW -
add authorization policy athzPol2 "CLIENT.IP.DST.BETWEEN(10.102.75.10,10.102.75.20)" DENY -
add authorization policy athzPol3 "HTTP.REQ.HOSTNAME.CONTAINS(\"portal-srv") || CLIENT.IP.DST.IN_SUBNET(10.102.75.0/25)" ALLOW
To configure an authorization policy by using the GUI
- Navigate to NetScaler Gateway > Policies > Authorization.
- In the details pane, click Add.
- In Name, type a name for the policy.
- In Action, select Allow or Deny.
- In Expression, click Expression Editor.
- To start to configure the expression, click Select and choose the necessary elements.
- Click Done when your expression is complete.
- Click Create.
To bind an authorization policy to a user by using the GUI
- Navigate to NetScaler Gateway > User Administration.
- Click AAA Users.
- In the details pane, select a user and then click Edit.
- In Advanced Settings, click Authorization Policies.
- In Policy Binding page, select a policy or create a policy.
- In Priority, set the priority number.
- In Type, select the request type and then click OK.
To bind an authorization policy to a group by using the GUI
- Navigate to NetScaler Gateway > User Administration.
- Click AAA Groups.
- In the details pane, select a group and then click Edit.
- In Advanced Settings, click Authorization Policies.
- In Policy Binding page, select a policy or create a policy.
- In Priority, set the priority number.
- In Type, select the request type and then click OK.