Solved

Citrix Secure Gateway - Use Radius for auth and support password change

Posted on 2011-02-28
4
1,505 Views
Last Modified: 2012-06-21
We are using Citrix Secure Gateway with WI 5.4.  We have configured 2-factor authentication using MS IAS Radius; however, if the user's password is set to "change at next logon", then the Radius authentication fails.  

The objective (desire) is for CSG to support PW chagne at logon...since we are using radius, it should work, if it used CHAP..however, I know that it is using PAP.

So - my question is:  How do we configure CSG to use Radius CHAP authentication instead of PAP?
0
Comment
Question by:kevin_buchanan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 1

Author Comment

by:kevin_buchanan
ID: 34999625
Per:  The Readme for Citrix Access Gateway document for Citrix Access Gateway v4.2:  

The Access Gateway supports implementations of RADIUS that are configured to use the Password Authentication Protocol (PAP) for user authentication. Other authentication protocols such as the Challenge-Handshake Authentication Protocol (CHAP) are not supported.

I am still looking for WI 5.4 documentation that states if CHAPv2 is or isn't supported, but I'm not hopeful.  Why Citrix wouldn't support Radius CHAPv2 is just absurd!!
0
 
LVL 19

Accepted Solution

by:
basraj earned 500 total points
ID: 35178457
Reference:

https://knowledgecenter.citrix.com/article/CTX107808

Using RADIUS Authentication Protocols

The Access Gateway supports implementations of RADIUS that are configured to use the Password Authentication Protocol (PAP) for user authentication. Other authentication protocols such as the Challenge-Handshake Authentication Protocol (CHAP) are not supported.

If your deployment of Access Gateway is configured to use RADIUS authentication and your RADIUS server is configured to use PAP, you can strengthen user authentication by assigning a strong shared secret to the RADIUS server. Strong RADIUS shared secrets consist of random sequences of upper and lowercase letters, numbers, and punctuation and are at least 22 keyboard characters long. If possible, use a random character generation program to determine RADIUS shared secrets.

To further protect RADIUS traffic, assign a different shared secret to each Access Gateway appliance. When you define clients on the RADIUS server, you can also assign a separate shared secret to each client. If you do this, you must configure separately each Access Gateway realm that uses RADIUS authentication. If you synchronize configurations among several Access Gateway appliances in a cluster, all the appliances are configured with the same secret.
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 36902057
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
Here's a look at newsworthy articles and community happenings during the last month.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question