Configure Duo as a SAML provider for workspace authentication
This article describes the required steps for configuring a Duo SAML application and SAML connection between Citrix Cloud and your SAML provider. Some of these steps describe actions that you perform in the Duo SAML provider’s administration console.
Prerequisites
Before you complete the tasks in this article, ensure that you’ve met the following prerequisites:
- A Duo cloud tenant.
- A Duo authentication proxy inside your AD forest.
- An Active Directory LDAPS connection which syncs your AD users to Duo.
Configure Active Directory Synching to your Duo tenant
Follow the Duo documentation on connecting your on-premises AD to Duo and importing users for SAML.
Create an Active Directory LDAPS Connection
-
Select Applications > SSO Settings > Add Source > Active Directory > Add Active Directory .
-
Enter a Display Name for the LDAPS connection to your AD forest.
-
Enter the FQDN of your domain controller.
-
Configure the Base DN of your AD domain.
-
Select Integrated as the Authentication Type.
-
Select LDAPS as the Transport Type.
-
Tick SSL Verify Hostname.
-
Enter both the Domain Controller certificate and then the Private Enterprise certificate authority CA certificate that was used to sign your Domain certificate.
-
Enter the PEM formatted certificates according to the follow example
-----BEGIN CERTIFICATE----- `<base64 Domain Controller Certificate>` -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- `<base64 Certificate Authority Certificate used to sign the Domain Controller Certificate above>` -----END CERTIFICATE----- <!--NeedCopy--> -
Test your LDAPS connection.
Configure your Duo authentication proxy config file for SAML
-
Check your Duo Auth Proxy configuration is healthy and showing as Connected to Duo.
-
Log into your Duo authentication proxy and add a SAML [sso] section to its config file using the Remote Identity (rikey) provided from the Duo admin console. The Duo Authentication Proxy uses a shared secret to communicate with the Duo cloud service. This secret is generated during the initial installation or configuration of the Authentication Proxy.
Configure a Duo SAML Application for use with Workspaces
-
Select Applications > Protect an Application. Click Add Application.
-
Locate the entry for Generic SAML Service Provider Duo app template. Citrix recommends the Generic SAML Service Provider Duo template as it is the most flexible and will allow you to configure different combinations of SAML attributes and different SAML flows according to your needs.
Important:
The use of the Duo Citrix Workspace SAML template is not recommended as it is inflexible and only supports SAML using AD identities. The Duo Citrix Workspace SAML template will also not allow the addition of optional attributes like cip_domain and cip_forest which are needed for some advanced mergers and acquisitions SAML configurations. It also does not allow the configuration of the Citrix Cloud logout endpoint.
-
Specify a Display Name for your SAML application such as Citrix Cloud Prod.
-
Specify the user access such as Enable for all users.
-
Select None (manual Input) within Metadata Discovery and enter the following Citrix Cloud SAML endpoints.
-
Enter the EntityID according to the Citrix Cloud region your CC tenant is in.
URL Region https://saml.cloud.comCommercial EU, US, and APS https://saml.citrixcloud.jpJP https://saml.cloud.usGOV -
Configure the Single sign-on URL (ACS URL) according to the Citrix Cloud region your CC tenant is in.
URL Region https://saml.cloud.com/saml/acsCommercial EU, US, and APS https://saml.citrixcloud.jp/saml/acsJP https://saml.cloud.us/saml/acsGOV -
Configure the Single Logout URL according to the Citrix Cloud region your CC tenant is in.
URL Region https://saml.cloud.com/saml/logout/callbackCommercial EU, US, and APS https://saml.citrixcloud.jp/samllogout/callbackJP https://saml.cloud.us/saml/samllogout/callbackGOV -
Service Provider Login URL is not required and can be left empty.
-
Default Relay State is not required and can be left empty.
-
Configure the Name ID Format as Unspecified.
-
Configure the Name ID Attribute as userPrincipalName (case sensitive).
-
Configure Signature algorithm as SHA256.
-
Configure Signing options as Sign response.
-
Configure Assertion encryption as disabled.
-
Configure Map Attributes with Duo bridging attributes on the left and Citrix Cloud SAML claim names on the right.
Important:
Duo bridge attributes (left) and SAML attribute claim names (right) are case sensitive. It is the claim names on the right that must match what is configured within the Citrix Cloud SAML connection.
Configure the Citrix Cloud SAML connection
-
All Citrix logon flows need to be Service Provider initiated using either a Workspace URL or a Citrix Cloud GO URL.
-
Use the default recommended values for the SAML connection within Identity and Access Management > Authentication > Add an identity provider > SAML.
-
Obtain the Duo SAML application SAML endpoints to enter into the Citrix Cloud SAML connection from your Duo portal by visiting the Duo Active Directory Sync documentation.
In this field in Citrix Cloud Enter this value Entity ID https://sso-<id>.sso.duosecurity.com/saml2/sp/<samlappID>/metadataSign Authentication Request Yes SSO Service URL https://sso-<id>.sso.duosecurity.com/saml2/sp/<samlappID>/ssoSSO Binding Mechanism HTTP Post SAML Response Sign Either Response Or Assertion Authentication Context Unspecified, Exact Logout URL https://sso-<id>.sso.duosecurity.com/saml2/sp/<samlappID>/sloSign Logout Request Yes SLO Binding Mechanism HTTP Post
Duo SAML Logout Behaviour
Duo SAML does not currently support SAML SLO at the time this article was written but it is possible to configure Duo to terminate the IDP session when a user explicitly logs out of Workspace and/or Citrix Cloud. It is recommended you read the SAML Logout Considerations section saml logout considerations in the main SAML article before choosing to configure your Duo SAML application’s logout settings.
Important:
Taken from Duo documentation Duo SSO Logout Behavior and Session Management Details.
Users that decide to log out and hit the SLO URL for Duo SSO will be logged out of Duo SSO and have their MFA remembered devices session deleted before redirecting them to the logout page.
To configure explicit logout of the Duo IDP session when the end user logs out of Workspace and/or Citrix Cloud follow the recommended steps below.
-
Configure the Citrix Cloud SAML logout endpoint within your Duo SAML app.
-
Configure the Duo SLO endpoint within the Citrix Cloud SAML connection.
Important:
If you have not used the Generic SAML Provider Duo app template you will be unable to complete this step as the option to enter the Citrix Cloud logout endpoint will not be available.
-
When logging out of Workspace with both sides of the SAML connection configured for logout as per steps 1 and 2 the following UI will be shown by Duo indicating the IDP session has been terminated.
-
Optional: To improve your Workspace end user’s logout experience it is possible to configure the Duo LDAPS connection with a single Logout Redirect URL which will redirect your end users back to the Citrix Workspace logon page. This is done inside the your AD forest LDAPS connection.
Important:
The logout redirect URL field shown above will only allow the configuration of a single Workspace URL. The use of multiple different Workspace URLs within the Citrix Cloud tenant cannot be configured within a single Active Directory Forest connection in Duo.