Netscaler - Passtrough SAML Auth

Question

We have the following Situation.

Public reachable SSO Portal based on Microsoft ADFS (sso.company.com) Public reachable Citrix Netscaler (netscaler.company.com) Private WebServer (web.company.com) - Not reachable from the internet.

We managed to authenticate against the Netscaler portal with ADFS. Also we can authenticate against the WebServer inside our Network with ADFS.

Our problem is now to configure Netscaler in a way that we also can use the SSO Login to web.company.com from outside via Netscaler.

I hope that's somewhat clear.

Answer 1

I assume you are using SAML and not OAUTH (shouldn't make a difference):

Is SSO for web.company.com SAML based?

1. if not then the NS can't help you since SAML does not hold a password by default.
2. if it is using SAML then just configure the new endpoint in your IDP and everything will be transparent

Answer 2

The anove answer is incorrect. Netscaler can indeed do this and i have done it several times.

You need to use Kerberos Constrained Delegation on backend and SAML/OIDC on Front End. With Kerberos Constrained Delegation you are allowed to impersionate another user without having the password.