Forum Discussion

Altostratus

4 years ago

Citrix access using SAML

Is it possible to perfom SSO into CItrix when AZURE SAML to authenitcate to the F5. All the docs, guides or bits and pieces I have found that reference passwordless envolves using smartcard. I...

BIG-IP Access Policy Manager (APM)

Altostratus

4 years ago

Thanks for the info. To clarify, I do not wish to continue using username and pass. We are testing AzureAD as our IDP and the F5 as the SP (which is working) but we are having issues authenticating to our Citrix storefront. You cannot pass the password from AzureAD as a SAML attribute ( and I would never want to hand around a pw in a SAML attribute anyways)

I would think that I would have to do a Kerb or another SAML which I have tried but I cannot seem to get this to work. Looking for someone who has this working in their environment.

Nikoolayy1

MVP

4 years ago

Have tried to also add the Citrix storefront to the Azure AD?

https://support.citrix.com/article/CTX220638

Also without F5 APM having username or password I agree that F5 Kerberos SSO could be the only way with ssl client check so that F5 APM can extract the username from the client SSL certificate as this is needed for UPN:

https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-single-sign-on-concepts-configuration/kerberos-single-sign-on-method.html

https://support.f5.com/csp/article/K59350434

https://support.f5.com/csp/article/K08200035

Edit:

If Azure AD has a way to send the username/email as attribute this will make the client ssl cert not needed.

Also take a look of this article if it helps:

https://community.f5.com/t5/technical-articles/smart-card-authentication-to-citrix-storefront-using-f5-access/ta-p/286377

https://discussions.citrix.com/topic/404480-is-kerberos-supported-with-sf-312-with-xa-715-ltsr-and-cac-card/