Implementing a bespoke solution with Citrix, Red Hat SSO and Keycloak
To complete this project successfully, Qim info hired a DevOps expert specialising in identity management and secure access, who will spend 15 days a year managing, maintaining and developing the system.
Deploying a security system tailored to meet business challenges
The intervention is based on five key areas that are perfectly matched to the needs expressed by the company:
- Access filtering: implementation of granular access control to the target application via Citrix Gateway, using Red Hat SSO configured in SAML as the identity provider (IdP).
- Access rights propagation: defining of access rules based on Active Directory groups, with synchronisation via Red Hat SSO to ensure that authorisations are automatically assigned.
- Multi-factor authentication (MFA): mandatory activation of MFA for external service providers to secure the most sensitive kinds of access, while maintaining a smooth, hassle-free experience for internal staff.
- Deployment of the solution: production rollout on target environments, with custom connectors developed using Keycloak, an open-source solution dedicated to identity management and the use of federated identities for access.
- Skills transfer and support: support for internal teams through targeted training sessions, supplemented by level 3 support, with a focus on handling complex incidents and advanced maintenance of SSO components.
Understanding the authentication process with Citrix, Red Hat SSO and Keycloak
The system is based on a fluid and well-structured authentication chain, designed to adapt the level of security to suit the profile of each user. Here are the key stages in the process:
1. Citrix portal
The user, whether they are an internal employee or an external service provider, begins by accessing a secure Citrix portal. This portal constitutes the first checkpoint on the route towards the target application.
2. Users are redirected towards Red Hat SSO
Citrix automatically redirects the user to Red Hat SSO, configured as an Identity Provider (IdP) in SAML mode. This service provides centralised authentication that complies with security standards.
3. Active Directory
Red Hat SSO queries the Active Directory (AD) to validate the user’s identity and retrieve attributes such as whether they belong to a particular group, their role, and whether their status is internal or external.
4. The level of authentication is adjusted
One of two routes is then triggered, depending on which profile is detected:
- Internal employees access the application using standard authentication.
- External service providers must authenticate themselves using a second factor, such as a one-time code or a mobile application.
5. Managing rights with Keycloak
Access authorisations are cross-checked against rules defined in Keycloak. These are automatically synchronised with Active Directory groups to ensure that rights are allocated consistently.
6. Final access to the application
If all the checks are successfully completed, the user accesses the business application in a secure environment, without any interruptions or friction, in compliance with internal security policies.
