This article describes how to integrate Cloud Access Service (CAS) with Citrix NetScaler using RADIUS.

Configure CAS

Perform these steps to configure CAS.

Procedure

1. Sign in to the RSA Cloud Administration Console.
2. Navigate to Authentication Clients > RADIUS.
   
3. Click Add Radius Client and Profiles.
4. On the RADIUS Client page, enter the following:
   1. Name: Enter a descriptive name for the RADIUS client.
   2. IP Address: Enter the IP address of the RADIUS client (NetScaler IP Address - NSIP).
   3. Shared Secret: Create and enter a secure shared secret. This secret will be used for secure communication between the RADIUS client and the RADIUS server.
      
5. Click Save and Next Step, and then click Save and Finish to complete the configuration.
6. Click Publish Changes to apply your changes to the RADIUS server and wait for the process to complete.
   After publishing, your application is now enabled for SSO. 

Notes

• The RSA Cloud Authentication RADIUS server is configured to listen on UDP port 1812. 
• The shared secret must be an alphanumeric string between 1 and 31 characters in length and is case-sensitive.

Configure Citrix NetScaler

Perform these steps to configure Citrix NetScaler.

Procedure

1. Log in to the NetScaler ADC VPX with nsroot account.
2. In the left pane, navigate to Security > AAA - Application Traffic > Policies > Authentication > Basic Policies > RADIUS.
3. On the Servers tab, click Add, enter values for the following parameters, and click Create.
   • Name: Name of the RADIUS server.
   • Choose Server IP to enter the IP address of the RADIUS server.
   • IP Address: Enter the IP address of the RSA Identity Router.
   • Secret Key: Enter the secret key for RADIUS communication. This should match the same key entered in the RSA configuration section.
   • Transport: UDP
   • Time-out: Increase the timeout value to 30 seconds.
   • Test RADIUS Reachability: Click the button to ensure successful communication between the RADIUS server and the client over UDP before committing and creating the RADIUS server. 
     
4. Create a corresponding RADIUS policy.
   1. Navigate to Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > Policy and click Add.
   2. On the Create Authentication Policy page, provide the following details:
      1. Name: Specify a name for the RADIUS policy.
      2. Action Type: Select RADIUS as the authentication action type.
      3. Action: Select the RADIUS server profile created to bind the RADIUS policy with.
      4. Expression: Displays the name of the rule or expression that the RADIUS policy uses to determine if the user must authenticate with the RADIUS server. In the textbox, set the value true for the policy to take effect and the corresponding RADIUS action to be run.
         
5. Bind the RADIUS policy to the authentication virtual server.
   1. Navigate to Security > AAA - Application Traffic > Virtual Servers.
   2. In the Virtual Server settings, associate the RADIUS policy created above with the authentication virtual server.
      
6. Associate the authentication server with the appropriate traffic management virtual server.
   1. Navigate to Traffic Management > Load Balancing (or Content Switching) > Virtual Servers, select the virtual server, and associate the authentication virtual server with it.
      

The configuration is complete.