VASCO DIGIPASS VPN Connections Integration Guide

INTEGRATION GUIDE
DIGIPASS Authentication for
Citrix Access Gateway
VPN Connections
[Title]
Disclaimer
Disclaimer of Warranties and Limitation of Liabilities
All information contained in this document is provided 'as is'; VASCO Data Security
assumes no responsibility for its accuracy and/or completeness.
In no event will VASCO Data Security be liable for damages arising directly or
indirectly from any use of the information contained in this document.
Copyright
Copyright © 2010 VASCO Data Security, Inc, VASCO Data Security International
GmbH. All rights reserved. VASCO®, Vacman® , IDENTIKEY®, aXsGUARD™™,
®
DIGIPASS® and
logo are registered or unregistered trademarks of VASCO
Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S.
and other countries. VASCO Data Security, Inc. and/or VASCO Data Security
International GmbH own or are licensed under all title, rights and interest in
VASCO Products, updates and upgrades thereof, including copyrights, patent
rights, trade secret rights
rights,, mask work rights, database rights and all other
intellectual and industrial property rights in the U.S. and other countries. Microsoft
and Windows are trademarks or registered trademarks of Microsoft Corporation.
Other names may be tradema
trademarks of their respective owners.
[Title]
Table of Contents
Reference guide..............................................................................................
................................
.............................. 5
1
Overview ................................................................................................
................................
................................... 6
2
Problem Description..................................................................................
................................
.................. 6
3
Solution ................................................................................................
................................
.................................... 6
4
Technical Concept .....................................................................................
................................
..................... 7
5
4.1
General overview ..................................................................................
................................
.................. 7
4.2
Citrix prerequisites ................................................................................
................................
................ 7
4.3
IDENTIKEY
TIKEY Server Prerequisites ..............................................................
.............................. 7
Citrix Acces Gateway ................................................................................
................................
................ 8
5.1
6
IDENTIKEY Server...................................................................................
................................
................... 11
6.1
7
CAG configuration .................................................................................
................................
................. 8
Configure IDENTIKEY Server ................................................................
..................................11
User configuration ..................................................................................
................................
.................. 15
7.1
ODBC installation .................................................................................
................................
.................15
7.1.1
User creation .................................................................................
................................
.................15
7.1.2
Import DIGIPASS ................................................................
...........................................17
7.1.3
DIGIPASS Assignment ................................................................
....................................20
7.2
Active Directory installation ................................................................
...................................23
7.2.1
User creation .................................................................................
................................
.................23
7.2.2
Import DIGIPASS ................................................................
...........................................25
7.2.3
DIGIPASS assignment................................................................
.....................................27
8
Test CAG Login ........................................................................................
................................
........................ 30
9
IDENTIKEY Server features ................................................................
..................................... 33
9.1
Installation ..........................................................................................
................................
..........................33
9.1.1
Support for Windows 2003, 2008, IIS6 and IIS7 ................................
................................33
9.1.2
Support for ODBC databases and Active Directory ..............................
..............................33
[Title]
9.2
9.2.1
Dynamic User Registration (DUR) .....................................................
.....................33
9.2.2
Autolearn Passwords................................................................
.......................................33
9.2.3
Stored Password Proxy ................................................................
...................................33
9.2.4
Authentication Methods ................................................................
...................................33
9.2.5
Policies .........................................................................................
................................
.........................34
9.2.6
DIGIPASS Selff Assign ................................................................
.....................................34
9.2.7
DIGIPASS Auto Assign ................................................................
....................................34
9.2.8
Grace Period ..................................................................................
................................
..................34
9.2.9
Virtual DIGIPASS ................................................................
...........................................34
9.3
10
Deployment .........................................................................................
................................
.........................33
Administration .....................................................................................
................................
.....................35
9.3.1
Active Directory Users and Computers Extensions ..............................
..............................35
9.3.2
Administration Web Interface...........................................................
...........................36
9.3.3
User Self Management Web Site ......................................................
......................37
9.3.4
Delegated administration ................................................................
................................37
9.3.5
Granular access rights ................................................................
....................................38
About VASCO Data Security ................................................................
.................................. 39
[Title]
Reference guide
ID
Title
Author
Publisher
Date
ISBN
[Title]
1 Overview
The purpose of this document is to demonstrate how to configure IDENTIKEY Server
(IK) to work with Citrix Access Gateway (CAG).
The Access Gateway appliance is deployed in an organization’s DMZ, and secures all
traffic with standards-based
based SSL. Remote users connect via an easy-to-use,
easy
use, Web
Webdownloaded and updated client, enjoying a rich desk-like
desk
experience.
2 Problem Description
The basic working of the CAG is based on authentication to an existing media (LDAP,
Radius, local authentication …). To use the IK with the CAG, some Web Filter and
RADIUS settings need to be changed or added manually.
3 Solution
After configuring the IK and the CAG in the right way, you eliminate the weakest link
in any security infrastructure – the use of static passwords – that are easily stolen
guessed, reused or shared.
Domain Controller
VPN
User
RADIUS
Citrix
Access Gateway
IDENTIKEY Server
Figure 1: Solution
[Title]
4 Technical Concept
4.1
General overview
The main goal of the CAG is to do authentication in a secure way to make a secure
VPN connection. The CAG will, most of the times, do the authentication to another
service. It is important to know where this is. We will install the IK in between this
process.
4.2
Citrix prerequisites
Please make sure you have a working setup of the CAG. It is very important this is
working correctly before you start implementing the authentication to the IK.
4.3
IDENTIKEY Server Prerequisites
In this guide we assume you already have
hav IDENTIKEY Server 3.2 (IK) installed and
working. If this is not the case, make sure you get IK working before installing any
other features.
[Title]
5 Citrix Acces Gateway
5.1
CAG configuration
To change the settings on the CAG you need the administration tool that iis provided
by Citrix. Connect to the CAG using the root credentials. Default this is username root
with password rootadmin.
Figure 2 Citrix administration logon screen
If your CAG is currently working well, you only have to change one thing to get your
configuration working with the IK.
Go to the Authentication tab and open the default window. Maybe it’s good to review
the current settings and remember them for later use
use. Click the Action menu and
choose Remove “Default” Realm.
Realm
Figure 3 CAG authentication configuration (1)
[Title]
Now, the screen should be empty if you only had one authentication realm set up.
Otherwise there may be other windows left.
To add a new authentication realm, fill in the Realm Name with Default (mind the
capital) and choose RADIUS Authentication as type and click the Add button.
Figure 4 CAG authentication configuration (2)
You will get a new screen to add the Radius Server options. Here you must specify the
server(s) on which the IDENTIKEY Server is installed. Properties you need are server
IP address, server port and server secret (shared secret).
Figure 5 CAG authentication configuration (3)
[Title]
When you click the submit button you well get a confirmation message showing you
the change of settings was successful. The new settings are currently working.
Figure 6 CAG authentication configuration
co
(4)
[Title]
6 IDENTIKEY Server
6.1
Configure IDENTIKEY Server
Setting up the IK only requires you to set up a policy to go to the right Back
Back-End
(LDAP/Windows) and to add an extra Radius Client pointing to the CAG.
To add a new policy, right-click
click Policies and choose New Policy.
Figure 7 IK configuration (1)
There are a few policies available by default. You can also create new policies to suit
your needs. Those can be independent policies or inherit their settings from default or
other policies.
Fill in a policy name and choose the option most suitable in your situation. If you
want the policy to inherit setting from another policy, choose the inherit option. If you
want to copy an existing policy, choose the copy option and if you want to make a new
one, choose the create option.
[Title]
Figure 8 IK configuration (2)
In the policy options configure it to use the right Back-End
Back nd server. This could be the
local database, but also active directory or another radius server.
This is probably the same that was in your Default CAG authentication options before
you changed it. Or you use windows or you go further to another radius server.
[Title]
Figure 9 IK configuration
iguration (3)
Figure 10 IK configuration (4)
[Title]
Now create a new Client by clicking Register At the Client-Tab.
Figure 10 IK configuration (5)
As Client type choose RADIUS Client.
Client The location is the IP address of the CAG
CAG. In
the policy field you should find your newly created policy. Fill in the shared secret
you entered also in the CAG Authentication options (Server secret).
Click Create.
Now the CAG and the IK are set up. We will now see if the configuration is working.
[Title]
7 User configuration
The user creation steps you will find in this chapter are only necessary when you
didn’t activate the option Dynamic User Registration (DUR) and/or Password
Autolearn in your policy settings. The assignment of a DIGIPASS can
an happen
manually as explained in the steps below.
7.1
7.1.1
ODBC installation
User creation
User creation, while using an ODBC back-end,
back
will happen in the IDENTIKEY Server
Web Administration. Right-click
click the Users folder and select Create User ...
....
Figure 11:: ODBC User Creation (1)
[Title]
Fill in the username and password fields. Optionally choose the right domain and
Organizational Unit and click the Create button.
Figure 123:: ODBC User Creation (2)
The user willl now show up in the Users list of you IDENTIKEY Server Web
Administration.. At this point it will be exactly the same as when Dynamic User
Recognition (DUR) was enabled.
Figure 134:: ODBC User Creation (3)
[Title]
7.1.2
Import DIGIPASS
Click the DIGIPASS-Tab and select Import... .
Figure 145: Import DIGIPASS (1)
Browse for your *.DPX file, fill in the Transport Key,
Key click Upload and look at your
available applications . You can either import all applications or only the ones you
selected.
[Title]
Figure 157: Import DIGIPASS (3)
Figure 168: Import DIGIPASS (4)
[Title]
Click Next to select the domain for the DIGIPASS import.
Figure 179: Import DIGIPASS (5)
When the DIGIPASS is imported successfully you will see the DIGIPASS in the list.
list
Figure 20: Import DIGIPASS (6)
[Title]
7.1.3
DIGIPASS Assignment
There are two possible ways to assign a DIGIPASS to a user. You can search for a
DIGIPASS and assign it to a user or you can search for a user and assign it to a
DIGIPASS.. You can see the difference in the following two figures.
Select a user and click Assign DIGIPASS and follow the next steps or…
Figure 2118: DIGIPASS assignment (1)
… in the TAB DIGIPASS, select a serial number for a DIGIPASS and follow the next
steps.
Figure 192: DIGIPASS assignment (2)
[Title]
If you type in the User ID and press the Search button, you will get a list of all the
available users in the same domain as the DIGIPASS.. The usernames are partly
searchable too.
Notice: If no users show up, make sure the domains of the DIGIPASS and the user
match.
Figure 203: DIGIPASS assignment (3)
When assigning a DIGIPASS to a user the same procedure will be applicable. You can
either select the desired option to search for a DIGIPASS or search through serial
number. Leaving all options blank will show all possibilities in the same domain.
When the DIGIPASS gets successfully added to your user you will get a confirmation
message.
[Title]
Figure 214: DIGIPASS assignment (4)
[Title]
7.2
7.2.1
Active Directory installation
User creation
User creation, while using an Active Dir
Directory back-end,
end, will happen in the Active
Directory Users and Computers MMC.
MMC Right-click a user and select Properties
Properties.
This can happen automatically when the Dynamic User Registration (DUR) option in
the policy settings is active.
Figure 225:: Active Directory User Creation (1)
[Title]
In the DIGIPASS User Account tab you will see a field to manually add a password.
This can also be automatically filled by enabling the Password Autolearn option in the
policy settings.
Figure 236:: Active Directory User Creation (2)
After clicking the Apply button you will see the Update History fields being filled with
the current date and time. When these fields are filled it means the DIGIPASS account
exists and can be used.
Figure 247:: Active Directory User Creation (3)
[Title]
7.2.2
Import DIGIPASS
To make sure you can see the DIGIPASS folders in the MMC, go to View and select
the Advanced Features.. This way you will see the DIGIPASS folders.
Figure 258: Import DIGIPASS (1)
Right-click the DIGIPASS-Pool
Pool folder and select Import DIGIPASS … .
Figure 269: Import DIGIPASS (2)
[Title]
Browse for your *.DPX file, fill in the Transport Key, click next and look at your
available applications. You can either import all applications or only the ones you
selected.
Figure 27: Import DIGIPASS (3)
Figure 28: Import DIGIPASS (4)
[Title]
When the DIGIPASS is imported successfully you will receive a confirmation message.
Figure 29: Import DIGIPASS (5)
7.2.3
DIGIPASS assignment
There are two possible ways to assign a user to a DIGIPASS.. You can search for a
DIGIPASS and assign it to a user or you can search for a user
user and assign it to a
DIGIPASS.. You can see the difference in the following two figures.
[Title]
Right-click a User and select Assign DIGIPASS... or ...
Figure 303: DIGIPASS Assignment (1)
… right-click a DIGIPASS and select Assign DIGIPASS … .
Figure 314: DIGIPASS Assignment (2)
If you leave the User ID blank and press the Find button, you will get a list of all the
available users in the same domain as the DIGIPASS.. The usernames are partly
searchable too.
[Title]
Figure 325: DIGIPASS Assignment (4)
When assigning a DIGIPASS to a user the same procedure will be applicable. You can
either select the desired option to search for a DIGIPASS or through serial number.
Figure 336: DIGIPASS Assignment (5)
[Title]
8 Test CAG Login
Point your web browser to the secure website of the CAG.
In our example this is 10.10.55.5 or cag.dom1.js.
https://10.10.55.5/
https://cag.dom1.js/
Here you will get a logon screen, fill in a known username and OTP and hit OK.
Figure 347 test setup (1)
[Title]
You will be brought to the default page set up in the CAG. In our example this is the
default portal page.
Figure 358 test setup (2)
So now we have a VPN connection secured with the DIGIPASS strong authentication.
[Title]
Figure 369 test setup (3)
[Title]
9 IDENTIKEY Server features
9.1
Installation
The IDENTIKEY Server (IK)) installation is very easy and straightforward. IK runs on
Windows platforms, supports a variety of databases and uses an online registration.
Different authentication methods allow a seamless integration into existing
environments.
9.1.1
Support for Windows 2003,
200 2008, IIS6 and IIS7
7
IK can be installed on Windows 2003
200 and Windows 2008.. Web modules exist for IIS
IIS6
and IIS7 to protect Citrix Web Interface, Citrix Secure Gateway, Citrix Secure Access
Manager (Form-based
based authentication), Citrix Access Gateway and Microsoft Outlook
Web Access 2003 and 2007 (Basic Authentication and Form-Based
Form Based Authentication).
9.1.2
Support for ODBC databases and Active Directory
Any ODBC compliant database can be used instead of the default PostgreSQL database
(MS SQL Server, Oracle). Since Version 3.1 of IDENTIKEY Server, your DIGIPASS
infrastructure is now also full integrated into the AD management tools. This option
requires an AD schema update.
9.2
Deployment
Several IDENTIKEY Server features exist to facilitate deployment. Combining these
features provides different
nt deployment scenarios from manual to fully automatic.
9.2.1
Dynamic User Registration (DUR)
This feature allows IK to check a username and password not in the database with a
back-end
end RADIUS server or a Windows domain controller and, if username and
password are valid, to create the username in the IK database.
9.2.2
Autolearn Passwords
Saves administrators time and effort by allowing them to change a user’s password in
one location only. If a user tries to log in with a password that does not match the
password stored in the IK database, IK can verify it with the back-end
end RADIUS server
or the Windows domain controller and, if correct, store it for future use.
9.2.3
Stored Password Proxy
Allows IK to save a user’s RADIUS server password or Windows domain controller
password
ord in the database (static password). User’s can then log in with only username
and dynamic one-time
time password (OTP). If this feature is disabled, users must log in
with username and static password immediately followed by the OTP.
9.2.4
Authentication Methods
Different authentication methods can be set on server level and on user level: local
authentication (IK only), Back
Back-End
End authentication (Windows or RADIUS). On top of
that a combination of local and back-end
back end can be configured. The additional parameters
‘always’,
ays’, ‘if needed’ and ‘never’ offers you additional customization of the back
back-end
authentication process.
The configuration of authentication methods is done within the policy (policies).
[Title]
9.2.5
Policies
Policies specify various settings that affect the User authentication
authentication process. Each
authentication request is handled according to a Policy that is identified by the
applicable Component record. Components can be radius clients, authentication
servers or Citrix web interfaces.
9.2.6
DIGIPASS Self Assign
Allows users to assign DIGIPASS to themselves by providing the serial number of the
DIGIPASS,, the static password and the OTP.
9.2.7
DIGIPASS Auto Assign
Allows automatic assignment of the first available DIGIPASS to a user on user
creation.
9.2.8
Grace Period
Supplies
ies a user with a certain amount of time (7 days by default) between assignment
of a DIGIPASS and the user being required to log in using the OTP. The Grace Period
will expire automatically on first successful use of the DIGIPASS.
9.2.9
Virtual DIGIPASS
Virtual DIGIPASS uses a text message to deliver a One Time Password to a User’s
mobile phone. The User then logs in to the system using this One Time Password.
Primary Virtual DIGIPASS
DIGIPASS. It is
A Primary Virtual DIGIPASS is handled similarly to a standard physical DIGIPASS
imported into the IDENTIKEY Server database, assigned to a User, and treated by the
IDENTIKEY Server database as any other kind of DIGIPASS.
Backup Virtual DIGIPASS
The Backup Virtual DIGIPASS feature simply allows a User to request an OTP
OT to be
sent to their mobile phone. It is not treated as a discrete object by IDENTIKEY Server,
Server
and is not assigned to Users, only enabled or disabled. It can be enabled for Users
with another type of DIGIPASS already assigned, and used when the User does not
have their DIGIPASS available.
[Title]
9.3
9.3.1
Administration
Active Directory Users and Computers Extensions
Since IDENTIKEY Server version 3.0, Managing the users and DIGIPASS can be done
within the Active Directory Users and Computers section. Selecting the properties of a
user, offers complete User-DIGIPASS
DIGIPASS management.
Figure 40: IK Features (1)
[Title]
9.3.2
Administration Web Interface
A highly intuitive Administration Web interface
i
exists to administer the product. An
Audit Console is available to give an instant view on all actions being performed on the
IK.. Both can be installed on the IK server itself or on a separate PC.
Figure 41: IK Features (2)
[Title]
9.3.3
User Self Management Web Site
A web site running on IIS has been developed to allow users to register themselves to
the IK with their username and back-end
back end (RADIUS or Windows) password, to do a
DIGIPASS self assign, to update their back-end
ba
password stored in the IK database, to
do a change PIN (Go-3/Go-8
8 DIGIPASS), to do a DIGIPASS test.
Figure 42 IK Features (3)
9.3.4
Delegated administration
Administration can be delegated by appointing different administrators per
organizational unit (OU). These administrators can only see the DIGIPASS
DIGIPASSes and users
that were added to his OU.
[Title]
9.3.5
Granular access rights
It is possible in IDENTIKEY Server
Serv to setup different permission per user. This can be
in function of a domain or an organizational unit. Administrators belonging to the
Master Domain may be assigned administration privileges for all domains in the
database, or just their own domain. Administrators
Administrators belonging to any other Domain will
have the assigned administration privileges for that Domain only.
It’s possible to set different operator access levels.
E.g. A user can be created that only has the rights to unlock a DIGIPASS.
Figure 43: IK Features (4)
[Title]
10 About VASCO Data Security
VASCO designs, develops, markets and supports patented Strong User Authentication products
for e-Business and e-Commerce.
VASCO’s
’s User Authentication software is carried by the end user on its DIGIPASS products which
are small “calculator” hardware devices, or in a software format on mobile phones, other portable
devices, and PC’s.
At the server side, VASCO’s VACMAN products guarantee that only the designated DIGIPASS user
gets access to the application.
VASCO’s
’s target markets are the applications and their several hundred million users that utilize
fixed password as security.
based system generates a “one-time”
“one time” password that changes with every use, and
VASCO’s time-based
is virtually impossible to hack
ck or break.
VASCO designs, develops, markets and supports patented user authentication products for the
financial world, remote access, e-business
business and e-commerce.
e
VASCO’s
’s user authentication
software is delivered via its DIGIPASS hardware and software security
curity products. With over 25
million DIGIPASS products sold and delivered, VASCO has established itself as a world
world-leader for
strong User Authentication with over 500 international financial institutions and almost 3000
blue-chip
chip corporations and governme
governments located in more than 100 countries
">