Appendix - Set up the Universal Orchestrator to Use Client Certificate Authentication via a Reverse Proxy: Citrix ADC

1. On the Virtual Servers page, under Advanced Settings expand Policies.
2. In the Policies section, click the plus to add a new policy.
3. On the Choose Type page, select Choose PolicyRewrite and Choose TypeRequest and click Continue.
4. On the Choose Type page, click Add Binding.
5. On the Policy Binding page, click the Select Policy field and on the Rewrite Policies page select the radio button for the rewrite policy you created to capture the client authentication certificate (e.g. NS-GetCert). Click Select to save the selection.
6. On the Policy Binding page, set a Priority of 110.
7. Set Goto Expression to Next.
8. Set Invoke LabelType to None.
9. Click Bind to save the binding.

1. On the Choose Type page for Rewrite Request, click Add Binding.
2. On the Policy Binding page, click the Select Policy field and on the Rewrite Policies page select the radio button for the rewrite policy you created to send the service account credentials to the Keyfactor Command server (e.g. NS-SendCreds). Click Select to save the selection.
3. On the Policy Binding page, set a Priority of 120.
4. Set Goto Expression to Next.
5. Set Invoke LabelType to None.
6. Click Bind to save the binding.
7. Click Close to return to the virtual server settings page.

On your Keyfactor Command server, install the following additional module:

• IIS Client Certificate Mapping Authentication (rather than Client Certificate Mapping Authentication)

  Tip:  It's fine to install both IIS Client Certificate Mapping Authentication and Client Certificate Mapping Authentication, but the former is what's needed for this solution.

If you have more than one Keyfactor Command server with separated roles, this only needs to be installed on the server accepting traffic to the /KeyfactorAgents web application.

The PowerShell command to install the appropriate module is :

Make the following changes in the IIS Management console on the Keyfactor Command server:

1. In the IIS Management console, highlight the server name on the left and open Authentication. Make sure Anonymous Authentication is the only enabled method.

   

   Figure 560: Configure only Anonymous Authentication at the Server Level in IIS

2. In the IIS Management console, drill down into sites and into the Default Web Site (or other web site if your Keyfactor Command instance has been installed in an alternate web site). Under the Default Web Site, locate the KeyfactorAgents application and open Authentication for this. Disable all the authentication methods shown here.

   

   Figure 561: Disable Authentication Methods at the Application Level in IIS

   Tip:  If your KeyfactorAgents endpoint is running on a standalone server with no other Keyfactor roles, you should also disable all authentication methods at the Default Web Site level as in step two. If your server holds other Keyfactor roles, leave this in the default configuration with Anonymous being the only authentication method enabled as in step one.

3. In the IIS Management console, open SSL Settings for the KeyfactorAgents application. Check the Require SSL box and select either Require or Accept for Client certificates.

   Important:  Only selected Require if your are only using orchestrators that support client certificate authentication and plan to configure all of them for certificate authentication.

   

   Figure 562: Configure SSL Settings in IIS for Client Certificate Authentication

   Tip:  If your KeyfactorAgents endpoint is running on a standalone server with no other Keyfactor roles, you may also configure your server to Require or Accept for Client certificates at the Default Web Site level. It is good security practice to check the Require SSL box. If your KeyfactorAgents endpoint is running on a server with other Keyfactor roles, you do not need to accept client certificates at this level and should not require them at this level.

Make the following changes in the IIS Management console on the Keyfactor Command server:

1. In the IIS Management console, drill down to the Default Web Site (or other web site if your Keyfactor Command instance has been installed in an alternate web site). In the Default Web Site, open the Configuration Editor tool.

2. In the Configuration Editor tool at the Default Web Site level, browse to:

   system.webServer/security/authentication/iisClientCertificateMappingAuthentication
   Important:  Don't be tempted to configure this setting only at the application level (KeyfactorAgents) rather than at the Default Web Site level. It will only work if configured at the Default Web Site level and then enabled at the application level.

3. In the configurations for IIS Client Certificate Mapping Authentication, set the defaultLogonDomain to your forest An Active Directory forest (AD forest) is the top most logical container in an Active Directory configuration that contains domains, and objects such as users and computers. root. Set the manyToOneCertificateMappingsEnabled option to True and the oneToOneCertificateMappingEnabled option to False. Click the dots to the right of the manyToOneMappings setting to open details for this setting.

   

   Figure 563: Configure IIS Client Certificate Mapping Authentication for the Default Web Site

4. In the Collection The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be availble in other places in the Management Portal (e.g. expiration alerts and certain reports). Editor for the manytoOneMappings, click Add and enter appropriate values for the properties. The service account entered here will be used as the identity in Keyfactor Command of all orchestrators that authenticate via client certificate.

   

   Figure 564: Configure Authorization Credentials for Keyfactor Orchestrators

5. In the IIS Management console,drill down into sites and into the Default Web Site (or other web site if your Keyfactor Command instance has been installed in an alternate web site). Under the Default Web Site, locate the KeyfactorAgents application and open the Configuration Editor tool for it.

6. In the Configuration Editor tool at the KeyfactorAgents application level, browse to:

   system.webServer/security/authentication/iisClientCertificateMappingAuthentication

   Enable the mapping authentication option at this level. The configuration should have replicated down from the Default Web Site level.

When the orchestrator is configured to use a client certificate to authenticate to a proxy and then the proxy is configured to use a separate client certificate to authenticate to the Keyfactor Command server, authentication to the Keyfactor Command application should be done using the original certificate from the orchestrator, not the certificate inserted in the process at the proxy level. This is done by including the original certificate from the orchestrator in the request header to Keyfactor Command. To assure that Keyfactor Command gives priority to this certificate and not the certificate the proxy uses to authenticate, set the Keyfactor Command authentication application setting Always Use Certificate from Header to True.