> For the complete documentation index, see [llms.txt](https://docs.mirketsecurity.com/mirket-help-center/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mirketsecurity.com/mirket-help-center/mirket-help-center/mirket-on-premise-platform/3rd-party-integrations/citrix-integration.md).

# Citrix Integration

## General Overview

This guide explains the configuration of multi-factor authentication (MFA) for Citrix Gateway utilizing Mirket as the identity provider. Prior configuration and deployment of Citrix Gateway are required before setting up MFA with Mirket.

Citrix Gateway offers various MFA configuration modes. In this integration, we'll configure Citrix Gateway to authenticate local Mirket users using the PAP authenticate protocol.

**Note**: Use the MS-CHAPv2 authentication protocol when configuring Citrix Gateway to authenticate with users pulled from Active Directory. Also, make sure that NPS is installed, as the MS-CHAPv2 protocol does not support OTP.

To enable RADIUS authentication with Citrix Gateway, you'll need to install and set up the Mirket. The Mirket acts as a RADIUS server and should be installed within a network that has both Internet connectivity and access to your RADIUS clients.

This integration was tested with version NS13.1: Build 12.11.nc of Citrix ADC, where Citrix Gateway is a component of Citrix ADC.

## Preparation Steps

Before proceeding with these procedures, ensure the following:

* You've completed the installation and configuration of the Mirket (go to <mark style="color:blue;">Mirket Installation Steps</mark>).
* End-users can access the Citrix Gateway.

## Configuring Citrix Gateway

### RADIUS Authentication Policy and Server Creation

* Access the Citrix Gateway administrator web console.
* Select the **Configuration** tab and go to **Citrix Gateway > Policies > Authentication > RADIUS**.&#x20;

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FSZzPnMkf2Z8vWF7qmjgY%2Fcitrixradius.png?alt=media&amp;token=cc32e604-e2b5-4027-a9b7-f550ed8b7a63" alt=""><figcaption></figcaption></figure>

* Click on **Add** and enter a policy name in the **Name** field.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2Fq8FHgiKrQ6X6nDnsgQXl%2Fcitrixaddradius.png?alt=media&amp;token=ed447425-9bd3-4416-9f7d-eb909ff775d9" alt=""><figcaption></figcaption></figure>

* Click on the **Add** option next to the **Server** field.
* Enter a server name in the **Name** field. Then choose the **Server IP** option.
* Input the IP address of the Mirket (RADIUS server) in the **IP Address** field.
* Input the port number for communication with the Mirket (RADIUS server) in the **Port** field. The default gateway port is **1812**.
* Assign a shared secret key to identify your RADIUS client in the **Secret Key** and **Confirm Secret Key** fields. Make sure to use the same shared secret key while configuring your RADIUS client resource in Mirket.
* Input **30** in the **Time-out** field. Then click on **Create**.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FMPgtR1aDK5fJ50mxjwLR%2Fcitrixaddradius2.png?alt=media&amp;token=449854ea-0205-4d44-a799-17b0bde738df" alt=""><figcaption></figcaption></figure>

* Choose the "**ns\_true**" option from the **Saved Policy Expressions** dropdown list.&#x20;

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FdKfkHsh0GHtYCgMffJdD%2Fcitrixaddradius3.png?alt=media&amp;token=b53c5f20-f8ab-46c2-9abc-614ac314c1f1" alt=""><figcaption></figcaption></figure>

* Then click on the **Create** option to complete the process.
* If a warning about classic authentication policies pops up, click on **OK**.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2Fn2xLPuDL9eD5ntZV1hd6%2Fcitrixwarning.png?alt=media&amp;token=d95baa8a-526a-40fe-b6eb-5cd5899df398" alt=""><figcaption></figcaption></figure>

### Connect RADIUS to the Virtual Server

* Select the **Configuration** tab and go to **Citrix Gateway > Virtual Servers**. Then select your virtual server. You can refer to the Citrix documentation for creating a virtual server.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FzJbmcHemzXsWphrFEUqf%2Fcitrixvirtualserver.png?alt=media&amp;token=555e9942-5bd7-4820-a059-340c3b106091" alt=""><figcaption></figcaption></figure>

* Click on **Edit**. Then click the "**+**" icon next to the **Basic Authentication** field.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FjI3u0nkrf3HWfjsTaHrJ%2Fcitrixbasicauthentication.png?alt=media&amp;token=fa2273d9-780f-407e-8513-86f3ee523369" alt=""><figcaption></figcaption></figure>

* Choose the "**RADIUS**" option from the **Choose Policy** dropdown list.
* Choose the "**Primary**" option from the **Choose Type** dropdown list. Then click on **Continue**.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2Fqhq93h3yN7mDgdrJVyNb%2Fcitrixpolicyselection.png?alt=media&amp;token=63dbb15e-8f0a-46d4-aa23-7b7fb0872565" alt=""><figcaption></figcaption></figure>

* Click on the "**>**" icon next to the **Select Policy** field under the **Policy Binding** section.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FFSlU30fDzHvblJgDzQ32%2Fcitrixpolicyselection2.png?alt=media&amp;token=c8095f3e-2379-40ab-81b3-418f4e6d2299" alt=""><figcaption></figcaption></figure>

* Select the RADIUS policy that was previously created. Then click on the "**Select**" option.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FxH41kD8Oe9P69ImMFQf3%2Fcitrixradiuspolicy.png?alt=media&amp;token=b14809bc-d6ba-47a0-ac3e-c686d1b3c464" alt=""><figcaption></figcaption></figure>

* Then, click on **Bind**.

## Configure Mirket

To enable Mirket to receive authentication requests from Citrix Gateway, follow these steps:

* Define Citrix Gateway as a RADIUS client resource within Mirket.
* Create an authentication policy for the Citrix Gateway RADIUS client resource or include it in an existing authentication policy.
* Attach the Citrix Gateway resource to the Mirket Radius.

### Add a Citrix as Resource in Mirket

To set up multi-factor authentication, make sure you have added at least one RADIUS client in Mirket. To learn how to add a RADIUS client, refer to the link below.

* [How to add a RADIUS client in Mirket](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/3rd-party-integrations/add-a-radius-client-in-mirket.md)

### User and Group configuration on Mirket&#x20;

To set up multifactor authentication, make sure you have at least one **user** or **group** in Mirket.

If it is preferred to use a local user, you can first create a local group and then create a local user and make the user a member of the group. Alternatively, you can create a local user without creating a local group.

* [Create a Local Group to add users manually.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/groups.md)
* [Add local Mirket users manually.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/users/local-users.md)

If it is preferred to use LDAP users, the priority External Source is created by pulling users from Active Directory or OpenLDAP in Mirket.

* [Create an External Source to include LDAP users.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/external-sources/active-directory.md)
* [Sync users from an external user database.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/users/ldap-users.md)

### Add a Radius Rules to Mirket

Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP etc.).

First, you should follow these steps:

* Go to **Configuration > Radius Rules**.
* Click on the **Add Rule** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FjBK348L1wwFifiewwnDq%2FradiusRuleAdd1.png?alt=media&amp;token=5f7937d1-4904-43f6-ab66-d5cae79ea771" alt="" width="563"><figcaption></figcaption></figure>

* On the displayed screen, enter a name for the rule in the **Name** field.
* Enter the rule description in the **Description** field.
* Enter the source IP addresses to which the rule will apply in the **Source Adress** field.
* Click on the **Next** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FcEzuQjwvb54ts9KftwGZ%2FradiusRuleAdd2.png?alt=media&amp;token=ccd4f382-af7e-4af8-b428-d91e00803626" alt="" width="563"><figcaption></figcaption></figure>

* Specify whether the rule will be applied to a user or a group.
* After specifying, click on the **Next** button.

<div><figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FfjgvKcxYBVqIcCD7DO4I%2FradiusRuleAdd31.png?alt=media&amp;token=eb5ed32c-6ed4-4e82-88d2-ca79856c0bd0" alt=""><figcaption></figcaption></figure> <figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FzrIuN4vMBAPo4AD8Ckpx%2FradiusRuleAdd32.png?alt=media&amp;token=0bd8296a-8859-448d-8ce7-504571aef05f" alt=""><figcaption></figcaption></figure></div>

* Select the users or groups to which the rule will apply. Transfer your selections to the **Selected Users/Groups** table by clicking the arrow icon next to the **Available Users/Groups** table.
* Click on the **Next** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FKAqhZPRxq5ZPEyRlJMKy%2FradiusRuleAdd4.png?alt=media&amp;token=75e7f8ac-8b9b-4ad6-8f17-99a98d20f371" alt="" width="563"><figcaption></figcaption></figure>

* Select the time period when the rule will run.
  * **All**: The rule will run every day.
  * **Recurring**: The rule will run on the specified days and times.
  * **One Time**: The rule will run within the date range you specify.
* After selecting, click on the **Next** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2Fw15CayFVYK4JkreQogOH%2FradiusRuleAdd5.png?alt=media&amp;token=ad72a55f-4ae0-4ff5-a068-3c21fd59a448" alt="" width="563"><figcaption></figcaption></figure>

* Specify whether the user or group will be granted access based on the rule in the **Action** field.
* Select the authentication provider to which the rule will apply from the **Auth Method** dropdown list.
* Click on **Save** to confirm the settings.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FMxZcjlh9zBXm4cd1JplV%2FradiusRuleList.png?alt=media&amp;token=827be7dc-6940-4e0a-be06-cdb154268be5" alt=""><figcaption></figcaption></figure>

### Test the Integration

To validate the integration between Mirket MFA and your Citrix Gateway, perform authentication using a mobile token on your mobile device. For RADIUS resources, available authentication methods include Approve/Deny authentication.

In this example, we illustrate the use of the Approve/Deny authentication method.

* Go to the login page of the virtual server in a web browser.
* Enter your Mirket username and password.&#x20;
* Click on **Log On**. Then, select the '**Approve**' option(found in the Mirket mobile app) immediately and make sure it doesn't time out.

#### Related Topics

[Radius Clients](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/rules/radius-rules/radius-clients.md)

[Radius Rules](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/rules/radius-rules.md)

[Local Group Configuration](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/local-group-configuration.md)

[Local Users Configuration](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/local-users-configuration.md)

[LDAP Group Configuration](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/ldap-group-configuration.md)

[LDAP Users](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/ldap-users.md)