Ensuring hi-fidelity delivery of applications to a mobile user base is a major challenge. User expectations for performance and ease of use are set by consumer-centric services. However, we must maintain enterprise security and compliance standards. Proper integration of network services and identity management can simplify user experience while ensuring rapid application response time and preserving security. Identity management is fundamental. Not only must it be strong, to ensure usability it must be as transparent as possible. This session will describe the integration of Citrix NetScaler SDX and CA Single Sign-On together provide for highly performing, highly secure and highly available delivery of mobile applications to a global user base. For more information on CA Security solutions, please visit: http://bit.ly/10WHYDm

1. ca Securecenter
Simplifying User Access with
NetScaler SDX and CA Single Sign-on
Morgan Gerhart
SCT09S #CAWorld
Senior Director, Products
Citrix
®

2. 2
Abstract
Morgan
Gerhart
Citrix
Sr. Director, Products
Ensuring hi-fidelity delivery of applications to a mobile user base is a major challenge. User expectations for performance and ease of use are set by consumer-centric services. However, we must maintain enterprise security and compliance standards. Proper integration of network services and identity management can simplify user experience while ensuring rapid application response time and preserving security. Identity management is fundamental. Not only must it be strong, to ensure usability it must be as transparent as possible. This session will describe the integration of Citrix NetScalerSDX and CA Single Sign-On together provide for highly performing, highly secure and highly available delivery of mobile applications to a global user base.

3. 3
Agenda
THE SOFTWARE DEFINED WORKSPACE
CLOUD NETWORKING INFRASTRUCTURE FOR MOBILE WORKSPACES
APPLICATION-CENTRIC PLATFORM FOR CLOUD NETWORKING
CASINGLE SIGN-ON AND CITRIXINTEGRATION
1
2
3
4

4. © 2014 Citrix. Confidential.
4
Data
Desktops
Collaboration
Personal
Apps
Mobile Virtual Secure
Workspace

5. © 2014 Citrix. Confidential.
5Services AnywhereWork Anywhere
1010SSL101SSL
App Store
Networking & Cloud Infrastructure
Windows Desktops
Windows & Mobile Apps
Data Sync & Sharing
Collaboration & Support

6. © 2014 Citrix. Confidential.
7Infrastructure & ServicesMobile Workspace
1010SSL101SSL
App Store
Networking & Cloud Infrastructure
Windows Desktops
Windows & Mobile Apps
Data Sync & Sharing
Collaboration & Support
Data
Desktops
Collaboration
Apps
Personal

7. 9
Cloud Infrastructure
Performance
Offload
Security
Availability
Citrix NetScalerOverview
Making Applications Run 5x Better
•World-class load balancing
•Global server load balancing
•Caching
•Compression
•Optimization
•TCP Connection Management
•SSL processing
•Gateway
•Application firewall

8. 10
MobileStreamTM
Mobile protocol acceleration for best performance over lossy and high latency links
Intelligent dual network mode to seamlessly leverage wireless and cellular connectivity
Optimized content streaming for faster download and rendering
Per app and user access management for end-to-end secure delivery
Built-in protocol and app visibility for compliance
Extensible policies for mobile threat and malware protection
Multi-layer application optimizations with granular security and control

9. 11
© 2014 CA. ALL RIGHTS RESERVED.
That app needs servers
and storage
and a network
and load balancing
and a firewall
and IPAM
and AAA
…
“We’re rolling out an app…”

10. “And I’m rolling out…”

11. 13
a LOT of different applications.

12. 14
DesktopAdmin
NetworkComms
Collaboration
Collaboration
Commerce
Commerce
Finance
Finance
Manufacturing
Sales/ Service
Administration
Commerce
Manufacturing
LoB
Specialists
LoB
Specialists
LoB
Specialists
LoB
Specialists
Commerce
Sales/ Service
Sales/ Service
Applications have different owners.

13. 15
Cloud Infrastructure
Performance
Offload
Security
Availability
All apps need a variety of Layer 4-7 services.
Making applications run 5x better
•World-class load balancing
•Global server load balancing
•Caching
•Compression
•Optimization
•TCP connection management
•SSL processing
•Gateway
•Application firewall

14. 16
Each application has its own needs.
Throughput
Functionality
Policies
Service levels

15. 17
Each application has its own lifecycle.
Maintenance windows
Infrastructure change frequency
Application change frequency
Desire for new network services

16. 18
Introducing NetScaler SDX
Instances, not partitions
Complete CPU isolation
Complete memory isolation
Version independence
High availability independence
Lifecycle independence

17. 19
PCI DSS Validation
“When properly deployed… NetScaler SDX will meet the following PCI DSS version 2.0 requirements, including deployments with in-scope and out-of-scope VPX instances running on the same SDX appliance.”

18. 20
Open Architecture
Now open for 3rdparty services

19. 21
CA Single Sign-On Instance View from SDX Appliance

20. 22
CA Access Gateway for Citrix NetScaler SDX
Virtual Appliance built on RedHatEnterprise Linux (RHEL) in Citrix-supported XVA format and deployed on NetScaler SDX platform
All standard features of CA Access Gateway
Requires a configured CA SSO Policy server
Dynamically provisioned and managed from Citrix NetScaler SDX administrative interface
Creates a VM with installed CA Access Gateway instance
Monitor performance
Start, stop, reboot, upgrade, upgrade SDX tools etc.
CA SSO integration use cases with Citrix NetScaler10.5.x
SAML-based SSO authentication
Radius-based authentication from Citrix NetScaler
Full range of CA SSO authentication and granular authorization
Web service interface-based authentication or authorization
CA Access Gateway for Citrix NetScaler SDX

21. 23
NetScalerSDX
Single Sign-on
Policy Server
Auth/Az/FED
Backend application (Protected Resource)
Web browser
CA Access Gateway Proxy
NetScaler inserts SMSessioncookie in the request to backend application for authorization by CA SSO agent
AD/LDAP/DB
CA Single Sign-on Authenticates and Authorizes user against corporate user store and collects user attributes
CA SSO generates authentication response to NetScaler along with SMSessioncookie
NetScaler with AAA-TM
User requests resource behind NetScaler
NetScalerextracts and caches SMSession
1
3
4
5
6
CA SSOweb agent
NetScaler issues authentication request to CA SSO using Web CallOutAPIs
2
Web API Based SSO and Authorization with NetScaler and CA Single Sign-on

22. 24
SAML Based SSO and Authorization with NetScaler and CA Single Sign-on
NetScalerSDX
CA Single Sign-on
Policy Server
Auth/Az/FED
Backend application (Protected Resource)
Web browser
CA Access Gatewayproxy
NetScaler inserts SMSessioncookie in the request to backend application for authorization by CA SSO agent
AD/LDAP/DB
CA SSO authenticates and Authorizes user against corporate user store and collects user attributes
CA SSO issues SAML assertion with an SMSessioncookie as an attribute
NetScaler with AAA-TM
User requests resource behind NetScaler
NetScaler redirects user to CA SSO acting as SAML IdP
NetScalervalidates assertion, extracts and caches SMSession
1
2
3
4
5
6
CA SSOweb agent

23. 25
Summary
Platform Consolidation
Easy instantiation of multiple CA Access Gateway machines
Reduced management overhead on CA Access Gateway infrastructure
Manageability
CA Access Gateway provisioning automated via SDX management UI
Additional manageability options available: Repair, Backup/Restore, Upgrade
Faster time-to-value
Quick CA Access Gateway provisioning with standard configurations

24. 26
For More Information
To learn more about Security, please visit:
http://bit.ly/10WHYDm
Insert appropriate screenshot and textoverlayfrom following“More Info Graphics” slide here; ensure it links to correct page
Security

25. 27
© 2014 CA. ALL RIGHTS RESERVED.
For Informational Purposes Only
This presentation provided at CA World 2014 is intended for information purposes only and does not form any type of warranty. Content provided in this presentation has not been reviewed for accuracy and is based on information provided by CA Partners and Customers.
Terms of this Presentation