Author: Carl Stalhood

Navigation

• NetScaler Gateway Universal Licenses
• Create NetScaler Gateway Virtual Server
• Verify SSL Settings
• Gateway UI Theme
• SSL Redirect
• DNS SRV Records for Email-based discovery
• Block Citrix VPN for iOS
• View ICA sessions
• Customize Logon Page
  • Save Customizations after reboot
  • Logon Page Labels
  • Domain Drop-down
  • Disclaimer
  • Other Customizations
  • Multiple Gateways

NetScaler Gateway Universal Licenses

For basic ICA Proxy connectivity to XenApp/XenDesktop, you don’t need to install any NetScaler Gateway Universal licenses on the NetScaler appliance. However, if you need SmartAccess features (e.g. EPA scans), or VPN, then you must install NetScaler Gateway Universal licenses. These licenses are included with the Platinum editions of XenApp/XenDesktop, Advanced or Enterprise Edition of XenMobile, and the Platinum version of NetScaler.

When you create a NetScaler Gateway Virtual Server, the ICA Only setting determines if you need NetScaler Gateway Universal licenses or not. If the Virtual Server is set to ICA Only then you don’t need licenses. But if ICA Only is set to false then you need a NetScaler Gateway Universal license for every user that connects to this NetScaler Gateway Virtual Server. Enabling ICA Only disables all non-ICA Proxy features, including: SmartAccess, SmartControl, and VPN.

If you don’t need any non-ICA Proxy features, then you don’t need any Gateway Universal licenses, and you can skip to the next section.

The Gateway Universal licenses are allocated to the case sensitive hostname of each appliance. If you have an HA pair, and if each node has a different hostname, allocate the Gateway Universal licenses to the first hostname, and then reallocate the same licenses to the other hostname.

To see the hostname, click the version info on the top right.

To change the hostname, click the gear icon on the top right.

To upload the allocated Gateway Universal licenses to the appliance, go to System > Licenses. A reboot is required.

After NetScaler Gateway Universal licenses are installed on the appliance, they won’t necessarily be available for usage until you make a configuration change as detailed below:

1. On the left, expand System, and click Licenses.
2. On the right, in the Maximum NetScaler Gateway Users Allowed field is the number of licensed users for NetScaler Gateway Virtual Servers that are not set to ICA Only.
   
3. On the left, under NetScaler Gateway, click Global Settings.
   
4. In the right column of the right pane, click Change authentication AAA settings.
   
5. Change the Maximum Number of Users to your licensed limit. This field has a default value of 5, and administrators frequently forget to change it thus only allowing 5 users to connect.
   
6. If desired, check the box for Enable Enhanced Authentication Feedback. Click OK.
   

   set aaa parameter -enableEnhancedAuthFeedback YES -maxAAAUsers 200

7. Then edit the NetScaler Gateway Virtual Server. On the top-right is the Max Users. Change it to the number of licensed NetScaler Gateway users.
   
8. In the Basic Settings section, click the pencil icon near the top right.
   
9. Click More.
   
10. In the Max Users field, either enter 0 (for unlimited/maximum) or enter a number that is equal or less than the number of licensed users. Click OK.
    

Create Gateway Virtual Server

1. Create a certificate for the NetScaler Gateway Virtual Server. The certificate must match the name users will use to access the Gateway. For email discovery in Citrix Receiver, the certificate must have subject alternative names (SAN) for discoverReceiver.email.suffix (use your email suffix domain name). If you have multiple email domains then you’ll need a SAN for each one.
   
   
2. On the left, right-click NetScaler Gateway and click Enable Feature.
   
3. On the left, expand NetScaler Gateway and click Virtual Servers.
   
4. On the right, click Add.
   
5. Name it gateway.corp.com or similar.
6. Enter a new VIP that will be exposed to the Internet.
7. Click More.
   
8. In the Max Users field enter 0.
9. In the Max Login Attempts field, enter your desired number. Then enter a timeout in the Failed Login Timeout field.
10. Check the box next to ICA Only, and click Continue. This option disables SmartAccess and VPN features but does not require any additional licenses.
    
11. In the Certificates section, click where it says No Server Certificate.
    
12. Click the arrow next to Click to select.
    
13. Select a previously created certificate that matches the NetScaler Gateway DNS name, and click OK.
    
14. Click Bind.
    
15. Click OK.
    
16. In the Authentication section, click the plus icon in the top right.
    
17. Select LDAP, select Primary and click Continue.
    
18. Click the arrow next to Click to select.
    
19. Select a previously created LDAP policy and click OK.
    
20. Click Bind.
    
21. Or for two-factor authentication, you will need to bind two policies to Primary and two polices to Secondary:
    • Primary = LDAP for Browsers (User-Agent does not contain CitrixReceiver)
    • Primary = RADIUS for Receiver Self-Service (User-Agent contains CitrixReceiver)
    • Secondary = RADIUS for Browsers (User-Agent does not contain CitrixReceiver)
    • Secondary = LDAP for Receiver Self-Service (User-Agent contains CitrixReceiver)
      
22. Click Continue.
    
23. In the Policies section, click the plus icon near the top right.
    
24. Select Session, select Request and click Continue.
    
25. Click the arrow next to Click to select.
    
26. Select one of the Receiver session policies and click OK.
    
27. There’s no need to change the priority number. Click Bind.
    
28. Repeat these steps to bind the second policy. In the Policies section, click the plus icon near the top right.
    
29. Select Session, select Request and click Continue.
    
30. Click Add Binding.
    
31. Click the arrow next to Click to select.
    
32. Select the other Receiver session policy and click OK.
    
33. There’s no need to change the priority number. Click Bind.
    
34. The two policies are mutually exclusive so there’s no need to adjust priority. Click Close.
    
35. On the right, in the Advanced section, click Profiles.
    
36. In the TCP Profile drop-down, select nstcp_default_XA_XD_profile. This improves NetScaler Gateway performance. Click OK.
    
37. On the right, in the Advanced section, click Published Applications.
    
38. Click where it says No STA Server.
    
39. Add a Controller in the https://<Controller_FQDN> or http://<Controller_FQDN> format, depending on if SSL is enabled on the XenApp Controller or not. This must be FQDN or IP address; short names don’t work.
40. For the Address Type, select IPV4. Click Bind.
    
41. To bind another Secure Ticket Authority server, on the left, in the Published Applications section, click where it says 1 STA Server.
    
42. Click Add Binding. Enter the URL for the second controller.
    
43. The State is probably down. Click Close.
    
44. In the Published Applications section, click STA Server.
    
45. Now they should be up and there should be an Auth ID. Click OK.
    

    add vpn vserver gateway.corp.com SSL 10.2.2.200 443 -icaOnly ON -tcpProfileName nstcp_default_XA_XD_profile
    
    bind vpn vserver gateway.corp.com -policy "Receiver Self-Service" -priority 100
    
    bind vpn vserver gateway.corp.com -policy "Receiver for Web" -priority 110
    
    bind vpn vserver gateway.corp.com -policy Corp-Gateway -priority 100
    
    bind vpn vserver gateway.corp.com -staServer "http://xdc01.corp.local"
    bind vpn vserver gateway.corp.com -staServer "http://xdc02.corp.local"

46. Perform other normal SSL configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security.

    bind ssl vserver MyvServer -certkeyName MyCert
    
    set ssl vserver MyvServer -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED
    
    unbind ssl vserver MyvServer -cipherName ALL
    
    bind ssl vserver MyvServer -cipherName Modern
    
    bind ssl vserver MyvServer -eccCurveName ALL
    
    bind vpn vserver MyvServer -policy insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE

47. Scroll down and click Done.
    

Verify SSL Settings

After you’ve created the Gateway Virtual Server, run the following tests:

1. Citrix CTX200890 – Error: “1110” When Launching Desktop and “SSL Error” While Launching an Application Through NetScaler Gateway: You can use OpenSSL to verify the certificate. Run the command: openssl s_client -connect gateway.corp.com:443. Replace the FQDN with your FQDN. OpenSSL is installed on the NetScaler or you can download and install it on any machine.
2. Go to https://www.ssllabs.com/ssltest/ and check the security settings of the website. Citrix Blogs – Scoring an A+ at SSLlabs.com with Citrix NetScaler – 2016 update
   

Gateway UI Theme

1. Ensure NetScaler is able to resolve the FQDN of the StoreFront server. You can add an Address record to the NetScaler or ensure that NetScaler can resolve DNS. http://support.citrix.com/article/CTX135023
   
   
2. On the left, under NetScaler Gateway, click Global Settings.
   
3. In the right pane, in the left column, click Change Global Settings.
   
4. Change the selection for UI Theme to Green Bubble, and click OK.
   

   set vpn parameter -UITHEME GREENBUBBLE

5. If you want the NetScaler Gateway Logon Page to look like StoreFront 3.0 then see StoreFront Tweaks > Theme for NetScaler 10.5.

SSL Redirect

Use one of the following procedures to configure a redirect from http to https. Responder method is preferred.

• Responder method
• Down vServer method

Public DNS SRV Records

For email-based discovery, add a SRV record to each public email suffix DNS zone. Here are sample instructions for a Windows DNS server:

1. On the Server Manager, click Tools > DNS Manager
2. In the left pane of DNS Manager, select your DNS domain in the forward or reverse lookup zones. Right-click the domain and select Other New Records.
   
3. In the Resource Record Type dialog box, select Service Location (SRV) and then click Create Record.
   
4. In the New Resource Record dialog box, click in the Service box and enter the host value _citrixreceiver.
5. Click in the Protocol box and enter the value _tcp.
6. In the Port number box, enter 443.
7. In the Host offering this service box, specify the fully qualified domain name (FQDN) for your NetScaler Gateway vServer in the form servername.domain (e.g. gateway.company.com)
   

Block Citrix VPN for iOS

Citrix CTX201129 Configuration for Controlled Access to Different VPN Plugin Through NetScaler Gateway for XenMobile Deployments: do one or both of the following:

• Create an AppExpert > Responder > Policy with Action = DROP and Expression = HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver/NSGiOSplugin"). Either bind the Responder Policy Globally or bind it to the Gateway vServers.
  
• In your Gateway Session Policies, on the Client Experience tab, do not set the Plugin type to Windows/Mac OS X. If any of them are set to Windows/MAC OS X, then VPN for iOS is allowed.
  

View ICA Sessions

To view active ICA sessions, click the NetScaler Gateway node on the left, and then click ICA Connections on the right.

show vpn icaconnection

Customize Logon Page

The logon page presented by NetScaler Gateway can be easily customized by modifying the .html, .css, .js, and .jpg files located under /netscaler/ns_gui/vpn.

After customizing the logon page, if you are licensed for Integrated Caching, then you’ll probably need to invalidate the loginstaticobjects Integrated Caching Content Group.

When you reboot the appliance, all customizations will be lost unless you automatically reapply the customizations after a reboot. There are two methods of doing this:

• Place the modified files under /var and add cp commands to /nsconfig/rc.netscaler so the files are copied after a reboot.
• Create a customtheme.tar.gz file and set the Gateway theme to Custom.

rc.netscaler Method

Let’s say you customized the en.xml and login.js files. To reapply those customizations after a reboot, copy the two modified files to /var. Then edit the file /nsconfig/rc.netscaler and add the following two commands:

cp /var/en.xml /netscaler/ns_gui/vpn/resources/en.xml
cp /var/login.js /netscaler/ns_gui/vpn/login.js

Custom Theme Method

From http://forums.citrix.com/thread.jspa?threadID=332888:

1. Change setting to Green Bubble (if you want to use it), make customizations.
2. SSH to the device, type shell.
3. Create ns_gui_custom folder by typing: mkdir /var/ns_gui_custom
4. Change directory to /netscaler by typing: cd /netscaler
5. Archive the ns_gui folder: tar -cvzf /var/ns_gui_custom/customtheme.tar.gz ns_gui/*
6. Change theme to ‘custom’. You can do this from NetScaler Gateway > Global Settings > Change Global Settings or from a Session Policy/profile. It’s located on the bottom of the Client Experience tab.
   
7. Save the config.
8. Reboot appliance to make sure the customizations are reapplied.
9. Repeat this on the second appliance.

Note: if you enabled the Custom theme, since the customtheme.tar.gz file contains the admin GUI, you will have difficulty logging into the admin GUI whenever you upgrade the appliance firmware. You cannot use your customtheme.tar.gz file with newer firmware versions. When upgrading firmware, do the following:

1. Change the theme to Default or Green Bubble and save the config.
2. Upgrade the firmware.
3. If the admin GUI is not working, change the theme to Default or Green Bubble again.
4. Manually reapply your customizations.
5. Re-create the customtheme.tar.gz file. Don’t use the file that was created on the previous firmware version.

Logon Page Labels

When two factor authentication is configured on NetScaler Gateway, the user is prompted for User name, Password 1, and Password 2.

The Password 1 and Password 2 field labels can be changed to something more descriptive, such as Active Directory or RSA:

To change the labels, edit a couple files:

• Edit the file /netscaler/ns_gui/vpn/resources/en.xml. Search for “Password”. The Password2 field has a colon but the Password field does not.
  
• Also edit the file /netscaler/ns_gui/vpn/login.js. Scroll down to the ns_showpwd_default() and ns_showpwd_greenbubble() functions. Find the line if ( pwc == 2 ) { document.write(' 1'); } and comment it out by adding two // to the beginning of the line. You will find this line in both functions. This prevents NetScaler Gateway from adding a “1” to “Password 1”.
  
• Use one of the above procedures to reapply the customization after a reboot.

Domain Drop-down

Citrix CTX118657 How to Add Drop-down Menu with Domain Names on Logon Page for Access Gateway Enterprise Edition has instructions for creating a drop-down list with domain names. The Create the drop-down menu section has instructions for the Default Caxton theme, but not Green Bubbles. Here is a one way of making it work in the Green Bubbles theme:

<div class="field buttons"><div class="left"><label for="domain" class ="label plain"><span id="domain">Domain:<span></div>
<div class="right"><select name="domainvalue" size="1" style="width: 100px;"> <option value="DOMAIN1">DOMAIN1</option> <option value="DOMAIN2">DOMAIN2</option> </select></div></div>

Everything else in the article still pertains to the Green Bubbles theme.

Logon Security Message (Disclaimer)

/netscaler/ns_gui/vpn/resources/en.xml can be edited to display a logon message. Look for Please log on and replace it with your desired text. After changing the file, make sure you follow one of the above procedures to reapply the customization after a reboot.

http://euc.consulting/blog/customizing-citrix-access-gateway/ has additional instructions for creating a disclaimer. These instructions are for the default Caxton theme. Here is one method of adjusting them for the Green Bubble theme:

1. Edit the file /netscaler/ns_gui/vpn/index.html.
2. Find line 94 which has <input type="submit" id="Log_On"
3. Inside the <input> element, add the attributes name="LogonButton" disabled="true"
   
4. Immediately below that line, add the following lines. They go before the </form> tag.

   <!– Disclaimer customization –>
   <div class="field CredentialTypeusername">
   <div class="left"><input type="checkbox" name="chk1_button" onClick="enableLogonButton(this);"/>
   <span class="label plain">Check this box to accept the use policy </span></div>
   <!– End of Disclaimer customization–>

5. Save and close the index.html file.
6. Edit the file /netscaler/ns_gui/vpn/login.js
7. At the bottom of the file, add in the following function:

   function enableLogonButton(obj)
   {
       var loginForm = document.vpnForm;
       if(obj.checked){
           loginForm.elements["LogonButton"].disabled=false;
       }
       else{
           loginForm.elements["LogonButton"].disabled=true;
       }
   }

8. Save and close the login.js file.
9. Use one of the above procedures to reapply these customizations after a reboot.
10. When you connect to the logon page, you should see a checkbox. The Log On button will only be enabled if the checkbox is checked.
    

Other Customizations

If you want the NetScaler Gateway Logon Page to look like StoreFront 3.0 then see StoreFront Tweaks > Theme for NetScaler 10.5.

Jason Samuel – How to force users to use the Citrix Receiver app on mobile devices using NetScaler: You can tell your users to install Citrix Receiver on their mobile devices, yet they still continue to open Receiver for Web in a mobile browser to launch their apps and desktops because that’s what they do on their PCs at work. It’s tough to get them to understand there are 2 ways to access their apps while on a PC, using the Citrix Receiver OR Receiver for Web in their browser. But on a mobile device, they should use Citrix Receiver only for the best possible touch friendly experience.

First, we need to detect if a user is using a mobile device or not. Then we need to detect if they are hitting the NetScaler Gateway page using a mobile browser or the Citrix Receiver app. If they are using the app, let the traffic go through normal. But if using a mobile browser, redirect them to a notification page letting them know they need to use the Citrix Receiver app and make it easy for them to install and use it. Implementation instructions at the blog post.

Multiple Gateway Virtual Servers

Citrix Knowledgebase article – How to Create a Specific Customized Logon Page for Each VPN vServer Hosted on the Access Gateway Enterprise Edition and Redirect Users Based on Each Fully Qualified Domain Name

From Citrix Discussions: The KB article referenced above uses the NetScaler’s Responder feature.
If you are not licensed for the Responder (or just don’t want to bother with it), here is another option…

After creating a separate, customized login page for each vServer, I simply add a bit of JavaScript in index.html to call the correct login page, based on the URL of each vServer:

var currentURL = location.host.toLowerCase();
if (currentURL == “url1.domain.com”) top.location = “url1.html”;
else if (currentURL == “url2.domain.com”) top.location = “url2.html”;
…. etc…

Citrix Blog Post – Two factor authentication with specific customized NetScaler Gateway logon pages:

• Cookie for second password field is not set properly for custom logon pages. Use rewrite policy to fix it.
• Cache policy won’t allow two-factor cookie to work. Edit cache policy to not cache the custom logon pages.

Next step

Configure StoreFront to use NetScaler Gateway

Navigation

• LDAP Load Balancing
• Verify Domain Controller Certificates
• LDAP Authentication Server
• LDAP Policy Expression
• Authentication Feedback and Global Licenses
• Multiple Active Directory Domains

LDAP Load Balancing

Before you create an LDAP authentication policy, load balance the Domain Controllers. If you don’t load balance your Domain Controllers, then when users enter an incorrect password, the user account will be prematurely locked out.

If you have multiple domains, create different Load Balancing Virtual Servers for each domain. These multiple Load Balancing Virtual Servers can share the same VIP if their port numbers are different. Or you can use a different VIP for each domain.

Verify LDAPS

Use the tool ldp.exe to verify that the Domain Controllers have valid certificates installed, and the service account is able to bind to the LDAP tree.

1. ldp.exe is included with the Remote Server Administration Tools (AD DS Snap-Ins and Command-Line Tools)
   
2. Run ldp.exe
   
   
3. Open the Connection menu, and click Connect.
   
4. Check the box next to SSL. Change the port to 636. Then enter the FQDN of a Domain Controller, and click OK.
   
5. If it connected successfully, you can then attempt a bind. If the connection was unsuccessful, then there’s probably an issue with the certificate installed on the Domain Controller.
6. Open the Connection menu and click Bind.
   
7. Change the Bind type to Simple bind. Then enter the service account credentials. You can use DOMAIN\Username, or you can use Username@Domain.com. Click OK.
   
8. Look on the right pane to verify a successful bind. If not, fix the credentials and try again.
   
9. Once you have successfully binded, you can view the directory tree by opening the View menu, and click Tree.
   
10. Click the drop-down to view the directory partitions.
    
11. Repeat these steps to verify each Domain Controller and any load balanced LDAPS.

LDAP Server

To create the LDAP Authentication Server, and LDAP Authentication Policy, do the following:

1. On the left, expand NetScaler Gateway > Policies > Authentication, and click LDAP.
   
2. On the right, switch to the Servers tab, and click Add near the top.
   
3. Enter LDAP-Corp as the name. If you have multiple domains, you’ll need a separate LDAP Server per domain, so make sure you include the domain name.
4. Change the selection to Server IP. Enter the VIP of the NetScaler load balancing vServer for LDAP.
5. Change the Security Type to SSL.
6. Enter 636 as the Port. Scroll down.
7. Note: there is a checkbox for Validate LDAP Server Certificate. If you want to do this, see Citrix Discussions for instructions for loading the root certificate to /nsconfig/truststore.
   
8. In the Connection Settings section, in the Base DN field, enter your Active Directory DNS domain name in LDAP format.
9. In the Administrator Bind DN field, enter the credentials of the LDAP bind account in userPrincipalName format. Domain\username also works.
10. Check the box next to BindDN Password and enter the password. Scroll down.
    
11. In the Other Settings section, use the drop-down next to Server Logon Name Attribute, Group Attribute, and Sub Attribute Name to select the default fields for Active Directory.
12. On the right, check the box next to Allow Password Change.
13. If you want to restrict access to only members of a specific group, in the Search Filter field, enter memberOf=<GroupDN>. See the example below:
    memberOf=CN=CitrixRemote,OU=Citrix,DC=corp,DC=local
    You can add :1.2.840.113556.1.4.1941: to the query so it searches through nested groups. Without this users will need to be direct members of the filtered group.
    memberOf:1.2.840.113556.1.4.1941:=CN=CitrixRemote,OU=Citrix,DC=corp,DC=local

    Citrix CTX132802 How to Use the ldapsearch Utility on the NetScaler Gateway Enterprise Edition Appliance to Validate a Search Filter
    1. An easy way to get the full distinguished name of the group is through Active Directory Administrative Center. Double-click the group object, and switch to the Extensions page. On the right, switch to the Attribute Editor tab.
    2. Scroll down to distinguishedName, double-click it, and then copy it to the clipboard.
       
       
    3. Back on the NetScaler, in the Search Filter field, type in memberOf=, and then paste the Distinguished Name right after the equals sign. Don’t worry about spaces.
       
14. Scroll down and click Nested Group Extraction to expand it. If desired, change the selection to Enabled.
15. Set the Group Name Identifier to samAccountName.
16. Set the Group Search Attribute to memberOf.
17. Set the Group Search Sub-Attribute to CN.
18. For the Group Search Filter field, see CTX123795 Example of LDAP Nested Group Search Filter Syntax.
19. Click Create.
    

LDAP Policy Expression

1. On the left, expand NetScaler Gateway > Policies > Authentication, and click LDAP.
   
2. On the right, switch to the Policies tab, and click Add.
   
3. Name the policy LDAP-Corp. If you have multiple domains, then you’ll need a separate LDAP Policy for each domain, so make sure you include the domain name.
4. Select the previously created LDAP-Corp server.
5. On the bottom, click the Saved Policy Expressions drop-down, and select the ns_true expression.
6. Click Create.
   

    add authentication ldapPolicy LDAP-Corp ns_true LDAP-Corp

Gateway Authentication Feedback and Licenses

1. On the left, under NetScaler Gateway, click Global Settings.
   
2. On the right, in the right column, click Change authentication AAA settings.
   
3. If you are using Gateway features that require Gateway Universal licenses, then change the Maximum Number of Users to the number of Gateway Universal licenses you have installed on this appliance. This field has a default value of 5, and administrators frequently forget to change it, thus only allowing 5 users to connect.
4. If desired, check the box for Enable Enhanced Authentication Feedback. This feature provides a message to users if authentication fails. The message users receive include password errors, account disabled or locked, or the user is not found, to name a few. Click OK.
   

   set aaa parameter -enableEnhancedAuthFeedback YES -maxAAAUsers 200

Next Step

For two-factor, configure RADIUS Authentication

Otherwise, Configure NetScaler Gateway Session Policies

Multiple Domains

To support multiple Active Directory domains on a NetScaler Gateway, you create multiple LDAP authentication policies, one for each Active Directory domain, and bind all of the LDAP policies to the NetScaler Gateway Virtual Server. When the user logs into NetScaler Gateway, only the username and password are entered. The NetScaler will then loop through each of the LDAP policies in priority order until it finds one that contains the entered username/password.

What if the same username is present in multiple domains? As NetScaler loops through the LDAP policies, as soon as it finds one with the specified username, it will try to authenticate with that particular LDAP policy. If the password doesn’t match the user account for the attempted domain then a failed logon attempt will be logged in that domain and NetScaler will try the next domain.

Unfortunately, the only way to enter a realm/domain name during user authentication is to require users to login using userPrincipalNames. To use userPrincipalName, set the LDAP Policy/Server with the Server Logon Name Attribute set to userPrincipalName.

You can even do a combination of policies: some with samAccountName and some with userPrincipalName. The samAccountName policies would be searched in priority order, and the userPrincipalName policies can be used to override the search order. Bind the userPrincipalName policies higher (lower priority number) than the samAccountName policies.

After authentication is complete, a Session Policy will be applied that has the StoreFront URL. The NetScaler Gateway will attempt to log into StoreFront using SSO so the user doesn’t have to login again. When logging into NetScaler Gateway, only two fields are required: username and password. However, when logging in to StoreFront, a third field is required: domain name. So how does NetScaler specify the domain name while logging in to StoreFront?

There are two methods of specifying the domain:

• AAA Group – Configure multiple session policies with unique Single Sign-on Domains.  Inside the Session Policy is a field called Single Sign-on Domain for specifying the NetBIOS domain name. If there is only one Active Directory domain, then you can use the same Session Policy for all users. However, if there are multiple domains, then you would need multiple Session Policies, one for each Active Directory domain. But as the NetScaler loops through the LDAP policies during authentication, once a successful LDAP policy is found, you need a method of linking an LDAP policy with a Session Policy that has the corresponding SSO Domain. This is typically done using AAA groups. This method is not detailed here but the general steps are: In the LDAP policy/server, specify a Default Authentication Group. Create a AAA Group that matches it. Then bind the corresponding Session Policy to that AAA group.
• userPrincipalName – Alternatively, configure the LDAP policy/server to extract the user’s UPN and then authenticate to StoreFront using UPN. This is the easiest method but some domains don’t have userPrincipalNames configured correctly.

The userPrincipalName method is detailed below:

1. In each of your NetScaler LDAP policies/servers, in the Other Settings section, in the SSO Name Attribute field, enter userPrincipalName. Make sure there are no spaces after this attribute name. NetScaler will use this pull this attribute from AD, and use it to Single Sign-on the user to StoreFront.
   
2. In StoreFront Console, right-click  the Store, and click Manage Authentication Methods.
   
3. On the right, click the gear icon, and then click Configure Trusted Domains.
   
4. In the Trusted domains box, select Any domain.
5. Or add your domains in DNS format. The advantage of entering domain names is that you can select a default domain if internal users forget to enter a domain name during login. The DNS format is required for UPN logins (e.g. SSO from NetScaler Gateway).
   
6. On the NetScaler Virtual Server, bind LDAP authentication polices in priority order. It will search them in order until it finds a match.
   
7. In your Session Policies/Profiles, in the Published Applications tab, make sure Single Sign-on Domain is not configured. Since NetScaler is using the userPrincipalName, there’s no need to specify a domain. If Single Sign-on Domain is configured, then Single Sign-on authentication will fail.