{"id":348,"date":"2026-01-13T10:30:00","date_gmt":"2026-01-13T08:30:00","guid":{"rendered":"https:\/\/blog.comping.fi\/?p=348"},"modified":"2026-01-05T15:09:14","modified_gmt":"2026-01-05T13:09:14","slug":"netscaler-as-idp-sp-why","status":"publish","type":"post","link":"https:\/\/blog.comping.fi\/?p=348","title":{"rendered":"NetScaler as IdP\/SP &#8211; why?"},"content":{"rendered":"\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Everyone has their master IdP (Entra ID, OKTA, Google Identity&#8230;) already in place anyways, so what&#8217;s all the fuzz about?<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">It might be a bit more useful to walk-through a couple of examples to shed some light on the <em>why<\/em>. This post will explain three use-cases:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Web server using OIDC\/OAuth2<\/li>\n\n\n\n<li>SSO to web server with static credentials<\/li>\n\n\n\n<li>SSO to web server with Kerberos\/KDC<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">One thing in common for all of the use-cases explained here is security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Web server using OIDC\/OAuth2<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-7387b849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:66.66%\">\n<p class=\"wp-block-paragraph\" id=\"block-be2fde8c-52db-4cdd-928b-eec6ec33e4ec\"><strong>Setup<\/strong> &#8211; A web server is using modern authentication, in this case OIDC\/OAuth2.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"block-f796ab40-e153-462a-83af-1b5f5b47719c\"><strong>Problem<\/strong> &#8211; Due to security concerns the IT team has aligned that out-bound traffic to internet is not allowed from the web servers. This is to avoid an exploited web server from opening a connection to malicious actor.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\"><div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"496\" src=\"https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/offline-1024x496.png\" alt=\"\" class=\"wp-image-357\" srcset=\"https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/offline-1024x496.png 1024w, https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/offline-300x145.png 300w, https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/offline.png 1154w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div><\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Explain<\/strong> &#8211; As per design, the OIDC\/OAuth2 validates the WCF tokens on the IdP token endpoint (json\/well-known contains the <code><mark style=\"background-color:#abb8c3\" class=\"has-inline-color\">token_endpoint<\/mark><\/code> attribute), thus the web server needs to be able to connect the IdP. For example, the MS Entra Organizations well-known document contains a link to its token endpoint <a href=\"https:\/\/login.microsoftonline.com\/organizations\/oauth2\/v2.0\/token\">https:\/\/login.microsoftonline.com\/organizations\/oauth2\/v2.0\/token<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solution<\/strong> &#8211; By configuring NetScaler as the OAuth IdP for the web server we can limit the traffic to the server environment and then configure the NetScaler as OAuth SP or even SAML SP for the public IdP (handled in detail in our earlier post <a href=\"https:\/\/blog.comping.fi\/?p=233\">&#8220;Chained federated authentication, NetScaler as SP and IdP&#8221;<\/a>)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">SSO to web server with static credentials<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-7387b849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\">\n<figure class=\"wp-block-image size-full is-style-rounded\"><img loading=\"lazy\" decoding=\"async\" width=\"417\" height=\"626\" src=\"https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/cctv.jpg\" alt=\"\" class=\"wp-image-359\" srcset=\"https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/cctv.jpg 417w, https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/cctv-200x300.jpg 200w\" sizes=\"auto, (max-width: 417px) 100vw, 417px\" \/><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:66.66%\">\n<p class=\"wp-block-paragraph\"><strong>Setup<\/strong> &#8211; A factory site has a dozen independent webcams installed with static credentials that need to be accessible by a third-party security guards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Problem<\/strong> &#8211; Sharing the static credentials for all security guards is a bad idea; the personnel change constantly and it&#8217;s just not possible to change the credentials and share them every time the team changes. Due to this the IT team has dictated the guards should access the security cameras with their respective user accounts and use multi-factor authentication to access the environment. On top of this, the access for each camera needs to be authorized via an AD group (or IdP provided group) and an audit trail is required.<\/p>\n<\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"block-492fb154-ea77-45b9-b95a-4cb72972b117\"><strong>Solution<\/strong> &#8211; By configuring NetScaler as OAuth SP or SAML SP for the chosen IdP, we can cover the multi-factor authentication requirement (discussed in post &#8220;<a href=\"https:\/\/blog.comping.fi\/?p=227\">Federated authentication, NetScaler as SP<\/a>&#8220;) and by leveraging the nFactor capabilities (LDAP extract), we can also cover the authorization and audit requirements (read more about the auditing in post &#8220;<a href=\"https:\/\/blog.comping.fi\/?p=112\">Security basics, part 4 \u2013 When?<\/a>&#8220;).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"block-bc112b5f-10ca-4215-a317-93c6c497abd1\">Especially when the authorization and audit are needed, it&#8217;s vital to configure the NetScaler also as a reverse proxy for the service. This adds an extra layer of security by hardening the environment protocol-wise (<a href=\"https:\/\/blog.comping.fi\/?p=21\">related blog post<\/a>), segmentation (<a href=\"https:\/\/blog.comping.fi\/?p=91\">related blog post<\/a>) and certificate management (more of this later!).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"block-fdfd2be8-2519-4ae2-b6d0-ff09c49aa8b3\">Once the user is Authenticated, Authorized and Audited (AAA), we can store the static credentials in  NetScaler and post these in the webcam authentication to cover the last mile.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">SSO to web server with Kerberos\/KDC<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-7387b849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:66.66%\">\n<p class=\"wp-block-paragraph\"><strong>Setup<\/strong> &#8211; A legacy web application is running on a web server and uses Windows authentication. The application is accessed from the internal networks using AD joined clients.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Problem<\/strong> &#8211; The application needs to be accessible from non-domain-joined clients using modern authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solution<\/strong> &#8211; As in the examples above, configure NetScaler as either OAuth or SAML SP for the chosen IdP to cover the authentication requirements. Also, use it for reverse proxying the connection to the web server. For SSO, complete the required service account configuration and SPN registrations in the AD and export the keytab for NetScaler and configure SSO using KDC.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\">\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"507\" height=\"479\" src=\"https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/kerberos.png\" alt=\"\" class=\"wp-image-361\" srcset=\"https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/kerberos.png 507w, https:\/\/blog.comping.fi\/wp-content\/uploads\/2025\/12\/kerberos-300x283.png 300w\" sizes=\"auto, (max-width: 507px) 100vw, 507px\" \/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">When the delegation is configured, the NetScaler AAA capabilities can be used impersonate either the logged in user (finding the attributes using LDAP extract) or impersonating a common user \/ shared account in special cases (i.e. external contractors that only have user account in the IdP, but no longer in the on-premises AD).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Followup<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re facing some of the problems above and need a solution, feel free to reach out to us. You can drop me an email at <a href=\"mailto:kari.ruissalo@comping.fi\">kari.ruissalo@comping.fi<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ps. We also provide NetScalers as <a href=\"https:\/\/comping.fi\/index.php?lang=en&amp;id=service-continuous\">managed service<\/a> (including licenses), so don&#8217;t let that stop you.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Everyone has their master IdP (Entra ID, OKTA, Google Identity&#8230;) already in place anyways, so what&#8217;s all the fuzz about? It might be a bit more useful to walk-through a couple of examples to shed some light on the why. This post will explain three use-cases: One thing in common for all of the use-cases <a href=\"https:\/\/blog.comping.fi\/?p=348\" class=\"more-link\">&#8230;<span class=\"screen-reader-text\">  NetScaler as IdP\/SP &#8211; why?<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,6,4],"tags":[7,15,21,14,20,19,11],"class_list":["post-348","post","type-post","status-publish","format-standard","hentry","category-identity","category-netscaler","category-security","tag-netscaler","tag-oidc","tag-oidc-idp","tag-saml","tag-saml-idp","tag-saml-sp","tag-sso"],"_links":{"self":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts\/348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=348"}],"version-history":[{"count":18,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts\/348\/revisions"}],"predecessor-version":[{"id":371,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts\/348\/revisions\/371"}],"wp:attachment":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}