in Citrix ADC Version 12 Microsoft Azure MFA Cloud Ser v · 7/1/2019 · 25/07/2019 Microsoft Azure MFA Cloud Service in Citrix ADC Version 12 – Deyda.net ... Conrmation of the

25/07/2019 Microsoft Azure MFA Cloud Service in Citrix ADC Version 12 – Deyda.net

deyda.net/index.php/en/2019/03/20/microsoft-azure-mfa-cloud-service-in-citrix-adc-version-12-2/ 1/13

Microsoft Azure MFA Cloud Servicein Citrix ADC Version 12

To complete my previous article, I also directly implemented and tested Microsoft

Azure MFA Cloud Service in my test lab. In this post I go straight to the ToDo’s for

implementation. For more information on MFA and the di�erences between Local

and Cloud, please read my previous post.

It is important that all my information has the status of March 2019 and since it is

the cloud, it will soon be obsolete again.

Table of Contents

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use. To �nd out more, including how to control cookies, see here: Cookie Policy

https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/IMG_9950-1.png

http://deyda.net/index.php/datenschutzerklaerung/



Microsoft Azure MFA Server in Citrix ADC Version 12Table of Contents Multi-Factor AuthenticationMicrosoft Azure MFAMulti-factor authenticationfor Office 365 / Microsoft 365 BusinessMulti-Factor Authentication for Azure ADadministratorsAzure Multi-Factor AuthenticationMicrosoft Azure MFA Local or Cloud?Sequenceof a Microsoft Azure MFA AuthenticationSet up MFA server as a secondfactorRequirementsAzure PortalMFA-ServerCitrix ADC Update: As of July 1, 2019, Microsoft willno longer offer MFA Server … Continue reading

0 Deyda.net

Sequence of a Microsoft Azure MFA CloudAuthentication

1. The user calls the Uni�ed Gateway page via URL (e.g., https://citrix.deyda.net)

& enters his credentials (username & password)

2. The credentials are forwarded to the local NPS (Network Policy Server) via the

Citrix ADC (RADIUS Request)

3. The Network Policy Server passes the credentials to the Active Directory

Controller (AD Proxy)


http://deyda.net/index.php/en/2019/03/08/microsoft-azure-mfa-server-in-citrix-adc-version-12-2/



http://deyda.net/index.php/en/2019/03/08/microsoft-azure-mfa-server-in-citrix-adc-version-12-2/#respond

http://deyda.net/




4. After successful veri�cation, a con�rmation is sent to the NPS

5. The NPS is requesting the second factor through the NPS Extension for Azure

MFA in the Multi-Factor Authentication Service (Azure MFA Service)

6. Via push noti�cation, the second factor is transmitted to the mobile phone via

the preferred method (MFA app, call or SMS)

7. Con�rmation of the second factor on the mobile device by the user

8. The Azure MFA service passes the con�rmation of the second factor via the

NPS extension to the local NPS

9. The local Network Policy Server passes the acknowledgment to the Citrix ADC

(RADIUS Response)

10. The user is authenticated and gets access to the resources

Set up MFA cloud service as a second factor

In my guide, I assume a two-factor authentication in the Uni�ed Gateway. The

Citrix ADC (formerly NetScaler) version 12 uses the Cloud MFA service for this

purpose.

Requirements

I assume the following things and do not go into detail about them:

Citrix ADC with successful base con�guration

Internal and external DNS entries for Uni�ed Gateway vServer (e.g.,

citrix.deyda.net)

Certi�cates for the DNS entry

Con�gured Uni�ed Gateway vServer

Existing Azure subscription with base con�guration

Enabled Azure Active Directory Premium License

Installed Authenticator App on Test User Mobile Phone


https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/MFA-Service-Auth.png




Microsoft/O�ce 365 Admin Center

First, we sign up with an administrative account in O�ce 365 Portal

(https://portal.o�ce.com) and click on Admin to get into the Admin Center.

In the Admin Center Navigation Panel, click Users> Active Users

In the following view, click on the user to be con�gured

Click Manage Multi-Level Authentication in the user’s pop-up menu


https://i0.wp.com/deyda.net/wp-content/uploads/2019/03/IMG_9956.png

https://i0.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-18-14_16_19-Window.png





In the new window, select and open the user to be con�gured again

Then use Quick Steps to Activate the user for MFA

In the following window click on multi-factor auth activate

Network Policy Server

Now, switch to the internal server that will later serve as Network Policy Server to

install and con�gure the required role and programs.

To do this, start the Server-Manager and click on Add roles and features

In the following window click through to the selection of the server roles, there

select the role Network Policy and Access Services and click on Next


https://i0.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-18-14_17_31-Window-1.png




https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-19-12_59_27-W2K16-Power-Desktop-Viewer.png





In the following window click on Add Features and start the installation via

Install

Now download the NPS Extension for Azure MFA and install / con�gure the local

environment.

You go to the following link and download the NPS Extension for Azure MFA

After the download you start the installer and click on Install

Now you open a PowerShell session as administrator

Navigate to the path C:\Program Files\Microsoft\AzureMfa\Con�g and start

the following command

.\AzureMfaNpsExtnConfigSetup.ps1

Then you have to sign in with your administrative O�ce365 / Azure account

For the next step we need the directory ID of the Azure AD. Please keep the

PowerShell window open.

Log in to portal.azure.com and navigate to Azure Active Directory> Properties

Copies the displayed ID under Directory-ID

The Directory-ID copies it into the open PowerShell window and con�rms this

with Enter

The script does the following things:

Creation of a self-signed certi�cate




https://i0.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-19-14_46_15-Download-NPS-Extension-for-Azure-MFA-from-Official-Microsoft-Download-Center.png

https://www.microsoft.com/en-us/download/details.aspx?id=54688

https://i0.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-19-14_47_02-Greenshot.png

https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-19-14_47_15-Greenshot.png

https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-19-15_19_36-Beitrag-bearbeiten-%E2%80%B9-Deyda.net-%E2%80%94-WordPress.png

https://i2.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-19-15_26_37-Eigenschaften-Microsoft-Azure.png

https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-19-15_28_23-Administrator_-c__windows_system32_windowspowershell_v1.0_powershell.exe_.png




Allocation of the public key of the certi�cate to the service principal in Azure

AD

Store the certi�cate in the certi�cate store of the local machine

Grant access to the certi�cate’s private key to Network User

Restart NPS services

Now the local Network Policy Server can be con�gured.

Starts the Network Policy Server Console (e.g. via Server Manager > Tools >

Network Policy Server)

Right-click on RADIUS Clients and select New

Here you con�gure the communication with the Citrix ADC as follows:

Enable this RADIUS client (Selected)

Friendly name (e.g. CitrixADC-NSIP)

Address (NSIP of the Citrix ADC, e.g. 10.0.0.7)

Shared secret (Freely selectable, but must be saved, e.g. 191211)

Con�rm shared secret (Again, the previously selected, e.g. 191211)

Con�rm entry with OK

Now right-click Remote RADIUS Server and click New

In the following window, enter a name for your ADC group (Group name) and

click Add

Here you con�gure the communication with the local AD as follows

Server (FQDN or IP of the local ADC)

Click on the tab Authentication/Accounting

Authentication port (1812)

Shared secret (Above selected Shared secret, e.g. 191211)

Con�rm shared secret (as above, e.g. 191211)

Now click on the tab Load Balancing










Number of seconds without response before request is considered dropped

(Important to set this up, so that the user has enough time to con�rm the

second factor (MFA app, call or SMS), e.g. 60)

Number of seconds between requests when server is identi�ed as

unavailable (Important as above, e.g. 60)

Con�rm the entry with OK

Now right-click Policies > Connection Request Policies and select New

In the following window you de�ne the communication to the Citrix ADC

Policy name (e.g. MFA Server Citrix ADC NSIP No Forward)

Policy enabled (Selected)

Click on the tab Conditions on Add

Client IPv4 Address (NSIP, e.g. 10.0.0.7)

Now click on the tab Settings and there on the menu item Authentication

Methods

Override network policy authentication settings (Selected)

Microsoft Encrypted Authentication version 2 (Selected)

Next select the menu item Authentication

Authentication requests on this server (Selected)


Right click on Policies > Connection Request Policies again and select New

In the following window you de�ne

Policy name (e.g. MFA Server Citrix ADC Request Forward)


Click the tab Conditions and on Add

NAS Identi�er (Freely selectable, but must be saved, e.g. MFA)











Now click on the tab Settings and there on the menu item Authentication

Methods

Override network policy authentication settings (Selected)


Now right-click Policies > Network Policies and select New

Policy name (e.g. NetScaler MFA)


Grant access (Selected)

Click Add on the Conditions tab

NAS Identi�er (Freely selectable, but must be saved and the same as above,

e.g. MFA)

Now click on the tab Constraints and there on the menu item Authentication

Methods



Authentication App

We now log in to O�ce365 (https://portal.o�ce.com) with our test user to

con�gure the Authentication App on the mobile device.

If the test user does not yet have a con�gured second factor, the following

message appears. The con�guration can be started with Next.

In the next window, select the type of the Second Factor (e.g, Mobile App)












To simplify the con�guration, you select to receive noti�cations for

veri�cation and click Next

In the following window, a QR code is displayed, with which the Authentication

App can be con�gured

Open the Authenticator app on your device

Click on the + symbol to add another account

Select Business or School Account in the Accounts window

With the following menu item Scan QR code you can scan the existing QR Code

Now the test user is displayed in the account list

In the browser you can con�rm the con�guration of the MFA service with Next

and Finish

Citrix ADC

Now the Citrix ADC can be set up for multi-factor authentication. To do this, a

RADIUS server is created and bound to the existing Uni�ed Gateway vServer.

In the Citrix ADC Navigation Panel, click System > Authentication > RADIUS

Click on the Servers tab and create a new Authentication Server via Add

Name (e.g. Local-NPS)

IP Address (IP of the NPS)

Port (1812)

Secret Key (Shared Secret de�ned on the NPS, e.g. 191211)

Con�rm Secret Key (Shared Secret)




https://i2.wp.com/deyda.net/wp-content/uploads/2019/03/IMG_9889-e1551997904112.png




https://i0.wp.com/deyda.net/wp-content/uploads/2019/03/1487280283_image37-1.png




Click Test Connection to check the data entered and the connection to the

Network Policy Server

Click on More to con�gure the further options

Time-out (Set this to 120 seconds for Phone Call or SMS)

NAS ID (Con�gured value from NPS, e.g. MFA)

Password Encoding (mschapv2)

Accounting (OFF)

Authentication Server Retry (3)

Authentication (Selected)

Save the con�guration with Create

Click on the Policy tab and click Add to create a new RADIUS policy

Name (e.g. radius_mfa_cloud_pol)

Server (previously created RADIUS server, e.g. Local-NPS)

Expression (ns_true)

Click Create to save the con�guration

Now select the previously con�gured Uni�ed Gateway vServer

Under Basic Authentication click on the + symbol

Under Choose Type con�gures the following

Choose Policy (RADIUS)

Choose Type (Primary)

Con�rm the entry with Continue

In the following window under Select Policy, select the previously created

RADIUS Policy (radius_mfa_cloud_pol)

Con�rms the entry with Bind


https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-18-21_32_10-Citrix-ADC-VPX-Configuration.png










2 thoughts on “Microsoft Azure MFA Cloud Service inCitrix ADC Version 12”

Sascha Friedl

July 8, 2019 at 16:05

Hi,

at �rst: Thanks for this creat articel. It helps aus very much to have the Service up

and running very soon. Do you have any best practices for have to NPS Server

(Failover) with Netscaler HA (active/passive)

After saving the change, you can log in to the gateway and receive a message on

the mobile device (mobile app, call or SMS) after entering the credentials.

Troubleshooting

To give the users access to his MFA settings afterwards, pass on the following

address:

https://aka.ms/mfasetup

Here the user can edit his existing settings (phone number, Authenticator App,

etc.) or delete the connection to con�gured Authenticator Apps.

Manuel Winkel March 20, 2019 ADC, Azure, Citrix, Microsoft, Of�ce365 Authenticator,Azure AD, Citrix, Citrix ADC, Citrix Gateway, MFA, Microsoft, Microsoft Azure MFA, Multi-Factor-Authentication, NetScaler, NetScaler Gateway, Of�ce365, Uni�ed Gateway

/ / /


https://i2.wp.com/deyda.net/wp-content/uploads/2019/03/2019-03-18-22_15_20-Citrix-Gateway.png

https://i1.wp.com/deyda.net/wp-content/uploads/2019/03/IMG_9950-2.png

blob:http://deyda.net/3e780f58-d4c5-4bf4-89d6-4b23f9d8264f

http://deyda.net/index.php/en/author/manuel/

http://deyda.net/index.php/en/2019/03/20/microsoft-azure-mfa-cloud-service-in-citrix-adc-version-12-2/

http://deyda.net/index.php/en/category/citrix-en/adc-en/

http://deyda.net/index.php/en/category/microsoft-en/azure-en/

http://deyda.net/index.php/en/category/citrix-en/

http://deyda.net/index.php/en/category/microsoft-en/

http://deyda.net/index.php/en/category/microsoft-en/office365-en/

http://deyda.net/index.php/en/tag/authenticator-en/

http://deyda.net/index.php/en/tag/azure-ad-en/

http://deyda.net/index.php/en/tag/citrix-en/

http://deyda.net/index.php/en/tag/citrix-adc-en/

http://deyda.net/index.php/en/tag/citrix-gateway-en/

http://deyda.net/index.php/en/tag/mfa-en/

http://deyda.net/index.php/en/tag/microsoft-en/

http://deyda.net/index.php/en/tag/microsoft-azure-mfa-en/

http://deyda.net/index.php/en/tag/multi-factor-authentication-en/

http://deyda.net/index.php/en/tag/netscaler-en/

http://deyda.net/index.php/en/tag/netscaler-gateway-en/

http://deyda.net/index.php/en/tag/office365-en/

http://deyda.net/index.php/en/tag/unified-gateway-en/




Manuel Winkel

July 8, 2019 at 16:11

Simply deploy multiple instances of NPS in the environment with the same

con�guration (by exporting the con�guration from the master and import to

the others) and deploying a load balancer to front the multiple NPS instances.

Deyda.net Data Protection Declaration Proudly powered by WordPress

/ /


http://deyda.net/

http://deyda.net/index.php/en/

http://deyda.net/index.php/en/privacy-statement/

https://wordpress.org/


Documents

in Citrix ADC Version 12 Microsoft Azure MFA Cloud Ser v · 7/1/2019 · 25/07/2019 Microsoft Azure MFA Cloud Service in Citrix ADC Version 12 – Deyda.net ... Conrmation of the