Shibboleth and Citrix Netscaler

[Pallissard, Matthew]

> But if there's some magic we're missing to forward something from the 
> Netscaler to the backend VM, it might be easier than we think...

I'd imagine that this is likely the case.  I'd engage Citrix on this one.  They have SSO folks that can point you in the right direction.  

If you are logging in successfully I doubt there is much else to do on the shib side of things.


Matt Pallissard

On Thu, 2017-03-16 at 11:54 -0500, Christopher Bongaarts wrote:
> One of our Citrix admins asked me this question yesterday - how timely!
> 
> In our case, we're dealing with Office365 specifically.  Auth is working 
> via Shib there already.  The question was about whether it was possible 
> to get a "single signon" effect across the Netscaler boundary - our user 
> has to authenticate once against the Netscaler (using their local 
> browser), and then again when they open an Office app within the 
> Netscaler (it opens a mini-browser window that throws them to our IdP).
> 
> As you noted, LDAP auth gave the impression of single sign-on, since the 
> "internal" auth had access to the password (or maybe a forwardable 
> kerberos ticket) used for the external auth.
> 
> My first thought was to investigate enabling SPNEGO on our IdP, at least 
> for the Netscaler IP range or user agent.  We we considering doing that 
> anyway in an effort to provide a more SSOish experience for Windows users.
> 
> But if there's some magic we're missing to forward something from the 
> Netscaler to the backend VM, it might be easier than we think...
> 
> 
> On 3/16/2017 10:47 AM, Pallissard, Matthew wrote:
> > We implement this,
> > 
> >  From what I remember, on the shib side all that is done is releasing an attribute derived from sAMAccountName.
> > 
> > 
> > Matt Pallissard
> > 
> > On Mon, 2017-03-13 at 20:09 +0000, Edenfield, Dusty wrote:
> > > Has anyone gotten SSO to work to virtual desktop applications that are accessed from the Citrix Netscaler Storefront portal?  We have Shibboleth working to authenticate to Citrix Netscaler Storefront, but when a user launches an application from the portal, they have to enter their username and password again.  In a prior implementation of SSO for Netscaler, LDAP authentication was used and Netscaler could use the credentials to proxy into the virtual applications.  With Shibboleth and SAML, this is not working because the virtual applications can’t use the Shibboleth session to authenticate the user.  Just wondering if anyone else is familiar with this use case and if they have gotten SSO to work all the way through to the virtual desktop applications.
> > >   
> > > Thanks!
> > >   
> > > ---------------------
> > > Dusty Edenfield
> > > Systems/IT Architect
> > > OIT-Enterprise Information Systems
> > > Georgia Institute of Technology
> 
> -- 
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>