Shibboleth and Citrix Netscaler

[Christopher Bongaarts]

One of our Citrix admins asked me this question yesterday - how timely!

In our case, we're dealing with Office365 specifically.  Auth is working 
via Shib there already.  The question was about whether it was possible 
to get a "single signon" effect across the Netscaler boundary - our user 
has to authenticate once against the Netscaler (using their local 
browser), and then again when they open an Office app within the 
Netscaler (it opens a mini-browser window that throws them to our IdP).

As you noted, LDAP auth gave the impression of single sign-on, since the 
"internal" auth had access to the password (or maybe a forwardable 
kerberos ticket) used for the external auth.

My first thought was to investigate enabling SPNEGO on our IdP, at least 
for the Netscaler IP range or user agent.  We we considering doing that 
anyway in an effort to provide a more SSOish experience for Windows users.

But if there's some magic we're missing to forward something from the 
Netscaler to the backend VM, it might be easier than we think...


On 3/16/2017 10:47 AM, Pallissard, Matthew wrote:
> We implement this,
>
>  From what I remember, on the shib side all that is done is releasing an attribute derived from sAMAccountName.
>
>
> Matt Pallissard
>
> On Mon, 2017-03-13 at 20:09 +0000, Edenfield, Dusty wrote:
>> Has anyone gotten SSO to work to virtual desktop applications that are accessed from the Citrix Netscaler Storefront portal?  We have Shibboleth working to authenticate to Citrix Netscaler Storefront, but when a user launches an application from the portal, they have to enter their username and password again.  In a prior implementation of SSO for Netscaler, LDAP authentication was used and Netscaler could use the credentials to proxy into the virtual applications.  With Shibboleth and SAML, this is not working because the virtual applications can’t use the Shibboleth session to authenticate the user.  Just wondering if anyone else is familiar with this use case and if they have gotten SSO to work all the way through to the virtual desktop applications.
>>   
>> Thanks!
>>   
>> ---------------------
>> Dusty Edenfield
>> Systems/IT Architect
>> OIT-Enterprise Information Systems
>> Georgia Institute of Technology

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%