Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1554
  • Last Modified:

Citrix Secure Gateway - Use Radius for auth and support password change

We are using Citrix Secure Gateway with WI 5.4.  We have configured 2-factor authentication using MS IAS Radius; however, if the user's password is set to "change at next logon", then the Radius authentication fails.  

The objective (desire) is for CSG to support PW chagne at logon...since we are using radius, it should work, if it used CHAP..however, I know that it is using PAP.

So - my question is:  How do we configure CSG to use Radius CHAP authentication instead of PAP?
0
kevin_buchanan
Asked:
kevin_buchanan
1 Solution
 
kevin_buchananAuthor Commented:
Per:  The Readme for Citrix Access Gateway document for Citrix Access Gateway v4.2:  

The Access Gateway supports implementations of RADIUS that are configured to use the Password Authentication Protocol (PAP) for user authentication. Other authentication protocols such as the Challenge-Handshake Authentication Protocol (CHAP) are not supported.

I am still looking for WI 5.4 documentation that states if CHAPv2 is or isn't supported, but I'm not hopeful.  Why Citrix wouldn't support Radius CHAPv2 is just absurd!!
0
 
basrajCommented:
Reference:

https://knowledgecenter.citrix.com/article/CTX107808

Using RADIUS Authentication Protocols

The Access Gateway supports implementations of RADIUS that are configured to use the Password Authentication Protocol (PAP) for user authentication. Other authentication protocols such as the Challenge-Handshake Authentication Protocol (CHAP) are not supported.

If your deployment of Access Gateway is configured to use RADIUS authentication and your RADIUS server is configured to use PAP, you can strengthen user authentication by assigning a strong shared secret to the RADIUS server. Strong RADIUS shared secrets consist of random sequences of upper and lowercase letters, numbers, and punctuation and are at least 22 keyboard characters long. If possible, use a random character generation program to determine RADIUS shared secrets.

To further protect RADIUS traffic, assign a different shared secret to each Access Gateway appliance. When you define clients on the RADIUS server, you can also assign a separate shared secret to each client. If you do this, you must configure separately each Access Gateway realm that uses RADIUS authentication. If you synchronize configurations among several Access Gateway appliances in a cluster, all the appliances are configured with the same secret.
0
 
TolomirAdministratorCommented:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now