Duo Single Sign-On for NetScaler

Overview

As business applications move from on-premises to cloud hosted solutions, users experience password fatigue due to disparate logons for different applications. Single sign-on (SSO) technologies seek to unify identities across systems and reduce the number of different credentials a user has to remember or input to gain access to resources.

While SSO is convenient for users, it presents new security challenges. If a user's primary password is compromised, attackers may be able to gain access to multiple resources. In addition, as sensitive information makes its way to cloud-hosted services it is even more important to secure access by implementing two-factor authentication and zero-trust policies.

About Duo Single Sign-On

Duo Single Sign-On is our cloud-hosted SSO product which layers Duo's strong authentication and flexible policy engine on top of NetScaler logins. Duo Single Sign-On acts as an identity provider (IdP), authenticating your users using existing on-premises Active Directory (AD) or another SSO IdP. Duo SSO prompts users for two-factor authentication and performs endpoint assessment and verification before permitting access to NetScaler.

Duo Single Sign-On is available in Duo Premier, Duo Advantage, and Duo Essentials plans, which also include the ability to define policies that enforce unique controls for each individual SSO application. For example, you can require that Salesforce users complete two-factor authentication at every login, but only once every seven days when accessing NetScaler. Duo checks the user, device, and network against an application's policy before allowing access to the application.

Configure Single Sign-On

Before configuring NetScaler with Duo SSO using Security Assertion Markup Language (SAML) 2.0 authentication you'll first need to enable Duo Single Sign-On for your Duo account and configure a working authentication source.

Once you have your SSO authentication source working, continue to the next step of creating the NetScaler application in Duo.

Prerequisites

• Verify that your NetScaler is licensed for Advanced Authentication Policy. As of Citrix Gateway release 13.0-67.x, the "Standard" license also includes nFactor for Gateway/VPN, while Citrix ADC requires an "Advanced" or "Premium" license to use nFactor. Refer to the nFactor licensing in the Citrix documentation for more information.

• Import a certificate and private key pair issued by a trusted certificate authority to your NetScaler to secure SSL connections to the virtual server you will create for use with Duo SSO. Learn more about binding SSL certificates to virtual servers at the NetScaler site.

Citrix Federated Authentication Service

To provide users with a “True SSO” experience into Citrix XenApp/XenDesktop/Storefront applications, you will need to configure Citrix Federated Authentication Service (FAS). Learn more about FAS deployment in the Citrix product documentation.

Create the NetScaler Application in Duo

1. Log on to the Duo Admin Panel and navigate to Applications.

2. Click Protect an Application and locate the entry for NetScaler with a protection type of "2FA with SSO hosted by Duo (Single Sign-On)" in the applications list. Click Protect to the far-right to start configuring NetScaler. See Protecting Applications for more information about protecting applications in Duo and additional application options. You'll need the information on the NetScaler page under Downloads later.

3. NetScaler uses the Mail attribute when authenticating. We've mapped the <Email Address> bridge attribute to Duo Single Sign-On supported authentication source attributes as follows:

   Bridge Attribute	Active Directory	SAML IdP
   <Email Address>	mail	Email

   If you are using a non-standard email attribute for your authentication source, check the Custom attributes box and enter the name of the attribute you wish to use instead.

4. You can adjust additional settings for your new SAML application at this time — like changing the application's name from the default value, enabling self-service, or assigning a group policy.

5. Keep the Duo Admin Panel tab open. You will come back to it later.

Duo Universal Prompt

The Duo Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.

Universal Prompt	Traditional Prompt

We've already updated the Duo NetScaler application hosted in Duo's service to support the Universal Prompt, so there's no action required on your part to update the application itself. If you created your NetScaler application before March 2024, you can activate the Universal Prompt experience for users from the Duo Admin Panel. NetScaler applications created after March 2024 have the Universal Prompt activated by default.

If you created your NetScaler application before March 2024, it's a good idea to read the Universal Prompt Update Guide for more information, about the update process and the new login experience for users, before you activate the Universal Prompt for your application.

Activate Universal Prompt

Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.

The "Universal Prompt" area of the application details page shows that this application is "Ready to activate", with these activation control options:

• Show traditional prompt: Your users experience Duo's traditional prompt via redirect when logging in to this application.
• Show new Universal Prompt: (Default) Your users experience the Universal Prompt via redirect when logging in to this application.

The application's Universal Prompt status shows "Activation complete" here and on the Universal Prompt Update Progress report.

Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt. However, this will still deliver the Duo prompt via redirect, not in an iframe. Keep in mind that support for the traditional Duo prompt ended for the majority of applications in March 2024.

Universal Update Progress

Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.

Enable NetScaler for SSO

SAML Configuration

1. Log into the NetScaler administrative interface.

2. In the left menu sidebar, navigate to Security → AAA-Application Traffic → Policies → Authentication → Advanced Policies → Actions → SAML.

   Gateway appliances with standard licensing may first need to enable the "Show Unlicensed Features" option in the left menu sidebar to expose the Advanced Authentication Policy items in the configuration menu.

3. On the "SAML Actions" page, click Add.

4. In the Name field, enter a custom name for the SAML server.

5. Uncheck the Import Metadata checkbox.

6. Return to the Duo Admin Panel. Copy the Redirect URL and paste it into the NetScaler Redirect URL field.

   Example: https://sso-abc1def2.sso.duosecurity.com/saml2/sp/DIABC123678901234567/sso

7. Return to the Duo Admin Panel. Copy the Single Logout URL and paste it into the NetScaler Single Logout URL field.

   Example: https://sso-abc1def2.sso.duosecurity.com/saml2/sp/DIABC123678901234567/slo

   

8. Return to the Duo Admin Panel. Under "Downloads", click Download certificate.

9. Return to the NetScaler. Next to the IDP Certificate Name field, click Add.

10. In the Certificate-Key Pair Name field, enter a custom name for the SAML certificate.

11. Click Choose File and then click Local. Select the downloaded NetScaler certificate and then click Install.

12. In the User Field, type "NameID". Scroll to the bottom of the page and click Create.

    

13. Click Export SAML Metadata. The "Export Metadata" window opens.

14. In the Choose a VPN server and click on Export drop-down menu, select the server you want to edit and then click Export.

15. The SAML metadata file opens. Locate the entityID in the file. The entityID is either your domain name or IP address.

16. Copy the entityID and paste it in a text editor (like Notepad). You will need the entityID for the "NetScaler Gateway Virtual Server Configuration" section later.

Authentication Policy Configuration

1. In the left menu sidebar, navigate to Security → AAA-Application Traffic → Policies → Authentication → Advanced Policies → Policy.

2. On the "Authentication Policies" page, click Add.

3. In the Name field, enter a custom name for the authentication policy.

4. Click the Action Type drop-down menu and click SAML.

5. Click the Action drop-down menu and select the SAML server you created earlier.

6. In the Expression field, type "true" and then click Create.

   

Authentication Virtual Server Configuration

Learn more about authentication virtual servers in the NetScaler documentation.

1. In the left menu sidebar, navigate to Security → AAA-Application Traffic → Virtual Servers.

2. On the "Authentication Virtual Servers" page, click Add.

3. In the Name field, enter a custom name for the virtual server. Choose Non-addressable for the IP Address Type and then click OK.

4. Under "Certificate", click Server Certificate.

5. In the Select Server Certificate field, click Click to select.

6. Click the radio button next to the SSL certificate you want to bind to the virtual server, and then click Select. This is a certificate you previously imported to the NetScaler for securing SSL traffic, not the Duo SAML certificate.

7. You now see the certificate in the Select Server Certificate field. Click Bind and then click Continue.

8. Under "Advanced Authentication Policies", click Authentication Policy.

9. In the Select Policy field, click Click to select.

10. Click the radio button next to the policy you created earlier and then click Select. Click OK.

11. Make sure the policy is selected and then click Select.

12. Under "Binding Details", click the Goto Expression drop-down menu and click END.

13. Click Bind and then click Continue.

    

Authentication Profile Configuration

1. In the left menu sidebar, navigate to Security → AAA-Application Traffic → Authentication Profile.

2. On the "Authentication Profile" page, click Add.

3. In the Name field, enter a custom name for the authentication profile.

4. In the Authentication Virtual Server field, click Click to select.

5. Click the radio button next to the server you created earlier and then click Select. Click Create.

   

Duo Service Provider Configuration

1. Copy the entityID you saved during the "SAML Configuration" section earlier.

2. Paste the entityID into the Duo Admin Panel Domain Name or IP Address field.

   • If the entityID is a domain name, it can be left as-is.

   • If the entityID is an IP address, the port is needed. The port is located under "Basic Settings".

   The image below shows an IP address and port example.

   

3. Scroll down and click Save.

NetScaler Gateway Virtual Server Configuration

1. In the left menu sidebar, navigate to NetScaler Gateway → Virtual Servers. In older firmware releases the navigation is Citrix Gateway → Virtual Servers

2. In the "NAME" column, select the server you want to edit.

3. Scroll down to "Authentication Profile" and click the pencil icon.

4. Click the Authentication Profile drop-down menu and select the profile you created earlier. Click OK.

   

5. Scroll down and click Done.

To learn more about NetScaler SSO, refer to the following articles:

• Configuring SAML Authentication

• Configuring nFactor Authentication

Using SSO

You can log on to your NetScaler by navigating to your NetScaler SSO page using your virtual server's IP address or hostname address, with the port included if you did not use the default HTTPS port 443, i.e. https://123.45.6.789:11222 or https://netscaler.example.com.

Active Directory Login

With Active Directory as the Duo SSO authentication source, enter the primary username (email address) on the Duo SSO login page and click or tap Next.

Enter the AD primary password and click or tap Log in to continue.

Enable Duo Passwordless to log in to Duo SSO backed by Active Directory authentication without entering a password in the future.

SAML Login

With another SAML identity provider as the Duo SSO authentication source, Duo SSO immediately redirects the login attempt to that SAML IdP for primary authentication. Users do not see the Duo SSO primary login screen.

Duo Authentication

Successful verification of your primary credentials by Active Directory or a SAML IdP redirects back to Duo. Complete Duo two-factor authentication when prompted and then you'll return to NetScaler to complete the login process.

* Universal Prompt experience shown.

You can also log into NetScaler using Duo Central, our cloud-hosted portal which allows users to access all of their applications in one spot. Link to NetScaler in Duo Central by adding it as an application tile. Once the tile has been added, log into Duo Central and click the tile for IdP-initiated authentication to NetScaler.

Congratulations! Your NetScaler users now authenticate using Duo Single Sign-On.

See the full user login experience, including expired password reset (available for Active Directory authentication sources) in the Duo End User Guide for SSO.

Enable Remembered Devices

To minimize additional Duo two-factor prompts when switching between NetScaler and your other Duo Single Sign-On SAML applications, be sure to apply a shared "Remembered Devices" policy to your SAML applications.

Troubleshooting

Need some help? Try searching our Knowledge Base articles or Community discussions. For further assistance, contact Support.