in Security

Basic web authentication setup

With the Netscaler 10.5 release came a new feature: Web Authentication. This feature allows us to use a web service to authenticate users. This basically means the Netscaler does a web request to a server and based on the response of that server accepts or denies the users authentication request.

A web authentication policy requires five items to function:

  • Server IP–the IP address of the webserver.
  • Server Port–the port to which the request is sent.
  • Scheme–HTTP or HTTPS.
  • Authentication rule–the authentication request in Netscaler default syntax.
  • Success Rule–an expression that tells us when authentication is successful.

The first three do not require much explanation, but the last two are a bit more complicated.

Authentication rule

In order to create a authentication rule it is important to know what de authentication web service expects. Most form based authentication is based on a user submitting credentials through a form. The form contains the fields and uses a POST Method to send its information to the server.

Here’s an example of a post request:

This request sends login=test and passwd=test123 to authtest.php. But with this request every user would be named test and their password would be test123.

Normally using Netscaler default syntax HTTP.REQ.USER.NAME would hold the username associated with the request, but it remains empty. HTTP.REQ.USER.PASSWD also remains empty. In order to get the username and password we will have to extract it from the original request. Which looks like this: login=<entered username>&passwd=<entered password>.

Extracting the username:

And the password:

Edited: Changed the extraction to the suggested method by ehoneycutt, thanks for the suggestion.

Using a TYPECAST_LIST_T will also work when a secondary authentication method is selected on the authentication vserver.

When POSTing data to the authentication webserver, I used the variables: username and password instead of login and passwd. These can be changed to whatever is required by the authenticating webserver.

The request in Netscaler default syntax looks like this:

Now all we need is the Success rule.

Success rule

The Success rule is an expression that tells us whether the authentication was successful or not. I tested using a simple php script that return either “SUCCESS” or “FAILURE”. My Success rule look like this:

How to

Below the commands to create a vserver and bind the policies to it. Don’t forget to setup the LB vserver to require authentication.

I’ve also made some screenshot’s to help configure this.

 

webAuth1.1webAuth2

References

http://support.citrix.com/proddocs/topic/ns-security-10-5-map/ns-aaa-setup-policies-auth-web-tsk.html

What do you think?

Comment

  1. Nice article.
    I would suggest a switch to TYPECAST_LIST_T for extracting values in order to deal with situations where you could have PASSWD as well as PASSWD1.
    HTTP.REQ.BODY(HTTP.REQ.CONTENT_LENGTH).TYPECAST_LIST_T(‘&’).get(1).AFTER_STR(“=”)

  2. Hi Pim,

    Thanks for the write-up. I have a question though. does this work with NetScaler Standard licenses or would you still need an Enterprise license to make use of AAA features of NS?