This document describes the configurations required for SAML 2.0 integration between the Octopus Authenticator and Citrix Workspace.
The environment used for the integration described in this document is based on the following software versions:
Octopus Authentication Server version 4.8.4
Citrix Workspace via Citrix cloud
Before beginning the integration process, make sure that you have access to a unique enterprise certificate. The certificate can usually be downloaded from the Enterprise Root Certificate Authority server of your organization.
The integration process involves the following sequential phases:
Creating the Citrix SAML Service: Add and configure the required SAML service in the Octopus Management Console
Configuring Citrix Workspace: Configure SAML authentication settings in your Citrix Workspace environment
Running the Solution: Test the authentication flow
The following procedure explains how to create the required SAML service in the Octopus Management Console. The service settings will be used later in the Citrix Workspace configuration.
To add and configure the Citrix SAML service:
From the Octopus Management Console, open the Services menu. At the upper left corner of the page, click Add Service.
In the Generic SAML tile, click Add.
Then, in the dialog that opens, click Create.
Configure the following settings in the General Info tab:
Setting
Description
Service Name
Enter a display name to identify the Service Provider (e.g., Citrix Cloud).
Issuer
Enter the issuer of the service (e.g., Citrix).
Description
Enter a brief note about the service.
Display icon
This icon will be displayed on the Login page for the service. To change the default icon, click and upload the image of your choice. (Supported image size is 488x488 pixels.)
Login Page URL
<https://<Enterprise Base URL>/generic-saml/<No.>/login> The Enterprise Base URL can be modified in System Settings > General Settings.
Then, click Save.
Open the Parameters tab, and configure the following settings:
Setting
Value / Notes
Octopus Authenticator Login
The identifier required for the Octopus Authentication Server.
Name ID
The parameter required for Citrix StoreFront login.
Method
POST
ASC URL
Audience
At the bottom of the Parameters tab, click Add Parameter and create the parameters listed in the table below.
If the required value does not appear in the Parameter Value dropdown list, select Free Text and then enter the value in the field that appears to the right (as shown in the following example).
Parameter Name
Parameter Value
displayName
Display Name
givenName
GivenName
familyName
Sn
cip_sid
ObjectSid
cip_upn
UserPrincipalName
cip_email
Email
cip_oid
ObjectGUID
At the bottom of the Parameters tab, click Save.
Open the Sign on tab, and update the default message in the Custom Message field. (This is the message displayed to the user upon successful login.)
Then, under X.509 Certificate, click Download to download the certificate.
At the bottom of the Sign on tab, click Save.
Open the Directories tab and select the checkboxes of the directories you want to integrate with the service. Then, click Save.
Open the Users tab and click Add.
A popup opens, with a list of directories displayed on the left.
Expand the directories list and select the checkboxes of the groups and users that you want to add to the service. Then, click Save to close the popup.
The groups and users you selected are listed in the Users tab.
At the bottom of the Users tab, click Save. Then, from the toolbar at the top of the page, click PUBLISH and publish your changes.
The procedure below explains how to set up SAML authentication in Citrix Workspace with Secret Double Octopus integration. Before you start, make sure you have access to the SAML2.0 Endpoint (HTTP) URL and the SAML Logout URL of the Octopus SAML service. You can copy the values from the Sign on tab by clicking the Copy icons.
In addition, verify that you have downloaded the X.509 certificate.
 |
To configure SAML authentication in Citrix Workspace:
From the navigation menu of Citrix Workspace, select Identity and Access Management.
On the page that opens, in the SAML 2.0 row, click Connect.
The SAML Configuration dialog opens.
Configure the following settings:
Setting
Value / Notes
Entity ID
Enter a name for the SAML service you created (e.g., SDO).
SSO Service URL
Paste the SAML2.0 Endpoint (HTTP) URL of the Octopus service.
Logout URL
Paste the SAML Logout URL of the Octopus service.
Then, under X.509 Certificate, import the service certificate.
To save your changes, click OK.
From the navigation menu of Citrix Workspace, select Workspace Configuration.
On the page that opens, open the Authentication tab and select the SAML 2.0 radio button.
This section describes the user experience of logging into Citrix Workspace via the Octopus Authenticator. The authentication process is as follows:
From a browser, the user opens the FQDN of the Citrix Cloudspace. The user is then redirected to the Secret Double Octopus authentication page.
The user enters a username and clicks Login.
A verification code is generated and displayed on the webpage.
A notification with this number then appears on the user's Octopus Mobile App, asking for authentication approval.
The user taps Approve.
After successful authentication, the user is logged into Citrix Workspace.
