Citrix Endpoint Management

Authentication with an on-premises NetScaler Gateway through Citrix Cloud

February 26, 2024

Contributed by:

K C

Citrix Endpoint Management supports authentication with an on-premises NetScaler Gateway through Citrix Cloud. This authentication method is available only to users enrolling in MDM through the Citrix Secure Hub.

Devices enrolling in MAM can’t authenticate using on-premises NetScaler Gateway credentials through Citrix Cloud. To use Citrix Secure Hub with MDM+MAM, configure Citrix Endpoint Management to use NetScaler Gateway for MAM enrollment. For more information, see NetScaler Gateway and Citrix Endpoint Management.

Citrix Endpoint Management supports authentication with an on-premises NetScaler Gateway through Citrix Cloud for the following platforms:

iOS devices
Android Enterprise devices, for BYOD and fully managed modes

Note:

Citrix Endpoint Management doesn’t support authentication with an on-premises NetScaler Gateway through Citrix Cloud for enrollment invitations. If you send users an enrollment invitation that has an enrollment URL, users authenticate through LDAP instead of an on-premises NetScaler Gateway as an identity provider.

It is recommended that you enable certificate-based authentication for a full single sign-on experience. If you use LDAP authentication on the NetScaler Gateway for MAM registration, then the end users experience a dual authentication prompt during enrollment. For more information, see Client certificate or certificate plus domain authentication.

Prerequisites

NetScaler Gateway. Citrix recommends that you enable certificate-based authentication for a full single sign-on experience. If you use LDAP authentication on the NetScaler Gateway for MAM registration, end-users experience a dual authentication prompt during enrollment. For more information, see Client certificate or certificate plus domain authentication.
Citrix Cloud account with Citrix Cloud Connector installed for directory service synchronization.
Citrix Secure Hub 20.5.0 and later.

Configure Citrix Cloud to use NetScaler Gateway as your identity provider

To set up NetScaler Gateway authentication in Citrix Cloud, see Connect an on-premises NetScaler Gateway as an identity provider to Citrix Cloud.

Configure the Citrix identity provider as the IdP type for Citrix Endpoint Management

This configuration applies only to users enrolling through Citrix Secure Hub. After you configure NetScaler Gateway in Citrix Cloud, configure Citrix Endpoint Management as follows.

In the Citrix Endpoint Management console, go to Settings > Identity Provider (IDP) and then click Add.
On the Identity Provider (IDP) page, configure the following:
- IDP Name: Type a unique name to identify the IdP connection that you’re creating.
- IDP Type: Choose Citrix Identity Provider.
- Authentication Domain: Choose NetScaler Gateway. This domain corresponds to your Identity provider domain on the Citrix Cloud Workspace Configuration > Authentication page.
Click Next. On the IDP Claims Usage page, configure the following:
- User Identifier type: By default, this field is set to userPrincipalName.
- User Identifier string: This field is automatically filled.
Click Next, review the Summary page, and then click Save.

You can now enroll user devices through Citrix Secure Hub using an on-premises NetScaler Gateway as an identity provider.

Citrix Secure Hub authentication flow

Citrix Endpoint Management uses the following flow to authenticate users with an on-premises NetScaler Gateway as an IdP on devices enrolled through Citrix Secure Hub:

A user starts Citrix Secure Hub.
Citrix Secure Hub passes the authentication request to Citrix identity, which passes the request to an on-premises NetScaler Gateway.
The user types their user name and password.
An on-premises NetScaler Gateway validates the user and sends a code to Citrix identity.
Citrix identity sends the code to Citrix Secure Hub, which sends the code to the Citrix Endpoint Management server.
Citrix Endpoint Management gets an ID token by using the code and secret and then validates the user information that’s in the ID token. Citrix Endpoint Management returns a session ID.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Authentication with an on-premises NetScaler Gateway through Citrix Cloud

February 26, 2024

Contributed by:

K C

February 26, 2024

Contributed by:

K C

Authentication with an on-premises NetScaler Gateway through Citrix Cloud

Prerequisites

Configure Citrix Cloud to use NetScaler Gateway as your identity provider

Configure the Citrix identity provider as the IdP type for Citrix Endpoint Management

Citrix Secure Hub authentication flow

In this article