Configure Citrix Gateway to use RADIUS and LDAP Authentication with Mobile/Tablet Devices
This section describes how to configure the Citrix Gateway appliance to use RADIUS authentication as primary and LDAP authentication as secondary with mobile/tablet devices.
The configuration demonstrated in the section still allows all other connections to use LDAP first and RADIUS second.
When you configure two-factor authentication on the Citrix Workspace app for use with mobile/tablet devices, you must add the RSA SecureID (RADIUS authentication) as the primary authentication. But when the users get the prompt for user name and Password, Passcode on Receiver they are putting LDAP first and RADIUS as second credentials. From an administrator point of view it is a different configuration as compared to a non-mobile configuration.
Complete the following procedure to configure the Citrix Gateway appliance to use RADIUS authentication as primary and LDAP authentication as secondary with mobile/tablet devices.
-
From the Configuration Utility, select Citrix Gateway > Policies > Authentication and create an authentication policy for LDAP and RSA for mobile devices and non-mobile devices. This is necessary to avoid a logic condition that can allow users to bypass the RADIUS authentication.
-
Enter LDAP Server details after clicking the Add option under the Servers tab for LDAP.
-
Create an LDAP policy for the mobile devices by choosing the required LDAP Server.
To bind this policy to only mobile devices, use the following expression:
REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiverThe corresponding advanced expression is:
HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver")
-
Click Expression Editor to create policy:
-
Create a RADIUS policy and RADIUS server for the mobile devices.
-
Navigate to the RADIUS option from Citrix Gateway > Policies > Authentication > RADIUS. Click Add under Server tab.
-
Add the required details. The default port for RADIUS authentication is 1812.
- To bind this policy to only mobile devices, use the following expression:
-
-
Follow the same step to create an LDAP policy for non-mobile devices. To bind this policy to only non-mobile devices, use the following expression:
REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiverThe corresponding advanced expression is:
HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver").NOT
-
Create a RADIUS policy for non-mobile devices. To bind this policy to only non-mobile devices, use the following expression:
REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiverThe corresponding advanced expression is:
HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver").NOT
-
Go to the Properties of the Citrix Gateway Virtual Server and click the Authentication tab. On the Primary Authentication Policies, add the RSA_Mobile policy as top priority and the LDAP_NonMobile policy as secondary priority:
-
In the Secondary Authentication Policies, add the LDAP_Mobile policy as top priority, followed by the RSA_NonMobile policy as secondary priority:
The session policy must have the correct single sign-on Credential Index, that is, it must be the LDAP credentials. For mobile devices, the Credential Index under Session Profile > Client Experience must be set to Secondary which is LDAP.
Therefore you need two session policies, one for mobile devices and the other for non-mobile devices.
- For mobile devices, the session policy, and session profile appear as displayed in the following screenshot. To create session policy, navigate to the required virtual server and, click Edit, go to the policy section, and click + sign:
-
Choose the Session option from the menu.
-
Enter the desired Session Policy name and click + to create a profile. For mobile devices, the Credential Index under Session Profile > Client Experience must be set to Secondary which is LDAP.
- For non-mobile devices, follow the same steps. Credential Index under Session Profile > Client Experience must be set to Primary which is LDAP.
The expression must be changed to:
REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiverThe corresponding advanced expression is:
HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver").NOT
- To create profile for non-mobile user, click + sign.
-
The following figure displays the policies and profiles under the required virtual server.
-
Also on the StoreFront, under the Citrix Gateway configuration set to use “Logon Type” = “Domain and Security token”
