Knowledge Blog

By /

Setting up ManageOTP nfactor authentication schema with NetScaler 14.1

Create AAA Virtual server

  1. Go to Security>> AAA Application Traffic >> Virtual Servers.
  2. Click Create Add
  1. Set a name, Ex: OTP-AAA
  2. Set Non Addressable under IP Address Type
  3. Click OK
  1. Add your server Certificate at above screen and leave everything as they are.
  2. Click Done or use back button.

That’s it, we will add nfactor flow to this AAA Server later.

Create LDAP Authentication Servers

We will be adding 3 LDAP actions to accomplish this.

Create Normal LDAP Server

  1. Go to Security > AAA – Application Traffic > Policies > Authentication > Advanced Policies > Actions > LDAP.
  2. Create a normal LDAP Server with just Authentication enabled. Leave rest of the options as default.

Create LDAP Action for OTP Device Registration

  1. Under LDAP Actions Click Add
  1. Uncheck the Authentication field.
  2. In the Other Settings Tab you have enter an AD attribute name under OTP secret filed. We use userParameters for it.
  1. Click OK.

Create LDAP Action for OTP Authentication

  1. Under LDAP Actions Click Add
  2. Repeat your settings just exactly like the 2nd LDAP action.
  3. Under Other Settings in Search Filter field add userParameters>=#@
  1. Click OK and complete.

nFactor Flows

Create First Factor Flow that selects Manage or Authenticate

  1. Go to Security > AAA – Application Traffic > nFactor Visualizer > nFactor Flows. Or search the menu for nFactor.
  2. click Add.
  3. Click the blue plus icon to create a factor.
  1. Name the factor based on this goal (Ex: OTPManageOrAuthenticate). And click Create.
  1. Click the blue create button
  1. Name your Policy based on the goal (ex: ManageOrOTP since this decides to move manageOTP page or OTP authentication page.
  2. Select NO_AUTHN from the Action Type Drop down.
  1. Insert below expression in the expression editor.
http.req.cookie.value ("NSC_TASS").eq("/manageotp") || http.req.cookie.value("NSC_TASS").contains("manageotp")
  1. Click OK and then Click Add.
  2. In the first factor, below the policy you just added, click the blue plus arrow to create another policy.
  1. Click Add to create another policy.
  2. Name the policy (Ex: SelectOTPAuthentication).

Create second factor for manageotp

  1. In the first factor, click the green plus icon to the right of the “ManageOrOTP” policy. If the “ManageOrOTP” policy is true, then this new factor will be evaluated.
  1. Name it and Click Create.
  1. In the second factor click on the Add Schema button.
  1. Click Add to create a login schema.
  1. Click LoginSchema which will expand the schema (.xml) files.
  2. Select SingleAuthManageOTP.xml file.
  3. Click Select button at the right.
  1. Now click the Create button at next screen and then OK button.
  2. In the 2nd Factor, click Add Policy.
  1. Click Add under the Select Policy.
  2. Name this policy, select LDAP under the Action Type.
  3. In the Action drop-down, select the LDAP Action/Server you created earlier that performs normal authentication.
  4. In the Expression box, enter true, and click Create.
  1. In the next screen, click Add to bind this LDAP Policy to the factor.

Create third factor that registers an OTP device with Active Directory

  1. In the second factor, click the green plus icon to create another factor. This new factor is only evaluated if the LDAP Policy is successful.
  1. Name the Factor and Click Create.
  1. In the 3rd Factor click Add Policy
  1. Name the Policy and Select Action Type as LDAP.
  2. Select the LDAP action we created for the Device Registration.
  3. Set the expression as true and click Create.
  1. Click Add in next screen.

The Factors for manageotp are complete. Now we will create the factors for authenticating using OTP.

Create a second factor for LDAP Authentication

  1. Now click the plus button near to SelectOTAuth.
  1. Name it and Click Create.
  1. In the second factor, click Add Schema
  1. Click Add under the Choose Schema page.
  2. Name it and click on the Pencil icon.
  1. Click the LoginSchema >> DualAuth.xml. And click Select..
  1. In the schema page click More and set 1 for Password Credential Index.
  1. Click Create then OK.

Note: You have to use DualAuthandPush.xml if you are using Push.

  1. Click Add Policy under the 2nd Factor Authentication Policy.
  1. Choose the same Policy you used for the Manage OTP in previous step.
  1. Click Add to bind the policy.

Create third factor to perform OTP authentication

  1. Click on the Plus button near to the 2nd factor LDAP Auth.
  1. Just name it and click Create.
  1. This third factor does not need a Login Schema. So just click on Add Policy.
  1. Name the policy and select LDAP in Action Type.
  2. Choose the OTP specific LDAP Auth policy we created. (the one with search filter)
  1. Click Create and then Add.
  2. You may notice that the 3rd factor is swapped like below.
  1. Click Done.

Bind nFactor Flow to AAA Virtual Server

  1. In the nFactor Flows menu select the Flow we created and Click Bind to Authentication Server
  1. Under Authentication Server bind the AAA server we created earlier.
  1. Leave the rest and just click Create.

Create Authentication Profile

  1. Add New or Edit your existing Virtual server.
  2. From the right, click + Authentication Profile.
  1. From the Authentication Profile window, click Add.
  1. Name your Authentication Profile and click Select to choose the Virtual Server.
  1. Now Select the Authentication Server we created earlier and click Select.
  1. Click OK.
  2. Make sure the profile you created appears under Authentication Profile and Click OK.
  1. Click Done, we are set with ManageOTP schema.
Note: you can apply this profile to multiple virtual servers as you prefer.

Test your Manage OTP environment

To test the new schema, Go to your NetScaler virtual server URL as usual where you can see a new field called Passcode.

 EX: https://yourdomain.com/logon/LogonPoint/tmindex.html

To test the Register device (ManageOTP) page type the URL like below,

EX: https://app-swissccag-141.demodooms.com/manageOTP

Now you will get only username/password and by authenticating it will lead you to Register Device page which appears like below.

That’s all. This article applies to NetSclaer 13.x version as well.

Looking to customize your Citrix NetScaler or StoreFront? Let’s Discuss >>

Scroll to Top