Configure protected user as an authentication factor in NetScaler nFactor authentication
The following figure displays Kerberos authentication flow for the protected users:
Related information
Sample configuration
The following configuration is an example setup for performing authentication based on user group membership:
-
For users in the protected users group, it applies protected user authentication.
-
For users not in the protected users group, it applies LDAP authentication.
add server dc1 dc1.aaa.local
add service svc1 dc1.aaa.local HTTP 80
add lb vserver lb2 SSL <> 443 -persistenceType NONE -cltTimeout 180 -AuthenticationHost <ip address pointing to auth_vs> -Authentication ON
bind lb vserver lb2 svc1
add authentication vserver auth_vs SSL <> 443
bind ssl vserver auth_vs -certkeyName <>
add authentication ldapAction ldap_group_extraction -serverIP 10.106.187.40 -ldapBase
"OU=Sanity,dc=aaa,dc=local" -ldapBindDn administrator@aaa.local -ldapBindDnPassword <> -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN -authentication DISABLED
add authentication Policy ldap_group_extraction -rule true -action ldap_group_extraction
add authentication policylabel policy1
add authentication ldapAction ldap_auth_enabled -serverIP 10.106.187.40 -ldapBase "OU=Sanity,dc=aaa,dc=local" -ldapBindDn administrator@aaa.local -ldapBindDnPassword <> -ldapLoginName samAccountName -groupAttrName memberOf
add authentication Policy no_ldap -rule "!AAA.USER.IS_MEMBER_OF(\"Protected Users\")"
-action NO_AUTHN
add authentication Policy no_protected_user -rule "AAA.USER.IS_MEMBER_OF(\"Protected Users\")" -action NO_AUTHN
add dns nameServer 10.106.187.40
add authentication protectedUserAction UserAction1 -realmStr AAA.LOCAL -maxConcurrentUsers 8
add authentication Policy UserAction1 -rule true -action UserAction1
bind authentication policylabel policy1 -policyName no_ldap -priority 1 -gotoPriorityExpression NEXT -nextFactor ldap_auth_enabled
bind authentication policylabel policy1 -policyName no_protected_user -priority 2 -gotoPriorityExpression NEXT -nextFactor UserAction1
bind authentication vserver auth_vs -policy ldap_group_extraction -priority 1 -nextFactor policy1 -gotoPriorityExpression NEXT