Gateway

Configure domain and security token authentication for Citrix Endpoint Management

January 8, 2024

Contributed by:

You can configure Citrix Endpoint Management to require users to authenticate with their LDAP credentials plus a one-time password, using the RADIUS protocol. This section describes the required NetScaler Gateway configuration for that two-factor authentication type.

Prerequisites

If you have not already run the NetScaler for Citrix Endpoint Management wizard, see the NetScaler for Citrix Endpoint Management Wizard section in Configuring Settings for Your Citrix Endpoint Management Environment. Make sure that your NetScaler configuration includes the following:

LDAP port number = 636 (which is the default port for secure LDAP connections)
Server Logon Name Attribute = samAccountName or the userPrincipalName as per your requirements

To configure domain and security token authentication

Go to NetScaler Gateway > Virtual Servers. Select the virtual server and then click Edit.
Click No CA Certificate.
In Select CA Certificate, choose a certificate, click OK, click Bind, and then click Done.
Go to Policies > Session > Session Profiles, select the profile, and click Edit.
Click the Client Experience tab.
In Credential Index, choose SECONDARY.
Click OK.
Go to Policies > Authentication > LDAP, click the LDAP Policy tab, and click Edit.
Use the following expression to use separate NetScaler Gateway VIPs for Citrix Endpoint Management and Citrix Virtual Apps and Desktops.

REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver
Go to Policies > Authentication > RADIUS and then click the Servers tab.
Click Add, enter the RADIUS server details, and click Create.
Go to Policies and then click Add.
Enter a Name for the policy. From the Server drop-down menu, select the RADIUS server name that you have created.
In Expression, enter REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver and click Create.
Select the virtual server and then click Edit.
Under Primary Authentication, click LDAP Policy.
Select the policy, click Unbind, and click Close.
On the Authentication row, click + to add the RADIUS authentication.
Under Choose Type, from Choose Policy, select RADIUS.
Click Bind.
Select the RADIUS authentication policy that you created earlier and then click Insert.
Click OK.
To add LDAP as the secondary authentication policy: On the Authentication row, click +.
From Choose Policy, choose LDAP.
From Choose Type, choose Secondary.
From Select Policy, choose the LDAP policy.
Select the policy and then click OK.
Click Bind.
Click Done.
Verify that the policies you created have the highest priority. This ensures that they have the highest priority even if more policies get added for non-mobile users. For more information, see Setting Priorities for Authentication Policies

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Configure domain and security token authentication for Citrix Endpoint Management

January 8, 2024

Contributed by:

January 8, 2024

Contributed by:

Configure domain and security token authentication for Citrix Endpoint Management

Prerequisites

To configure domain and security token authentication

In this article