RADIUS Authentication
miniOrange implements RADIUS protocol depending upon business scenarios using Side-By-Side, Include & Extend and Custom RADIUS.

RADIUS AUTHENTICATION

RADIUS (Remote Authentication dial In User Service) is a networking protocol that provides client authentication, authorization, and accounting for the network. RFC standards 2865 and 2866 describe the RADIUS accounting, respectively.

RADIUS protocol is implemented by a number of severs including Free RADIUS, Steel Belted RADIUS etc.

A strong authentication server is one that protects applications and other network resources like Virtual desktop Infrastructures and Cisco VPN's etc.

It supports various authentication methods like password based, one time password etc.

If any RADIUS server is installed (to protect the access to a network) side by side to a strong authentication server (to protect the access to network resources), then it would be advantageous to integrate these two servers so that the end user can access the resources he needs by signing on once(Single Sign-on or SSO).

How does RADIUS Authentication work?

miniOrange can configure our Authentication product in three possible ways with your RADIUS server.

Recommendation - Depending on our Business Case, Go with a staged approach where we do option 1 or 2 in the short term and explore Option 3. In the mid to long term, implement Option 3.


​2 Factor Authentication for VPN Login

Overview

If you are using a Virtual Private Network ( VPN ) to allow your users to connect over a public network, enhancing the security becomes a concern since users gain access to sensitive digital assets. miniOrange can be of great value here by providing 2-factor Authentication on top of VPN Authentication. This secures the access to protected resources instead of relying on only the VPN username / password.


What is RADIUS?

Remote Authentication Dial-In User Service (RADIUS) is a client/server protocol that provides client authentication and authorization. It enables remote access servers to communicate with a server to authenticate users and authorize their access to the requested system or service.


RADIUS Client

The RADIUS client is typically a NAS ( Network Access Server ) which is responsible for passing user information to designated RADIUS servers, and then based on the response which is returned, authenticates or rejects login to the user.


RADIUS Server

RADIUS servers are responsible for receiving user connection requests, authenticating the user, and then returning all configuration information necessary for the client to authenticate the user. A RADIUS server can act as a proxy client to other RADIUS servers or other kinds of authentication servers.


Authentication Protocols

The RADIUS server checks that the information is correct using authentication schemes such as PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP, EAP-TLS, EAP-TTLS and EAP-PEAP.


Security

Transactions between the client and RADIUS accounting server are authenticated through the use of a shared secret, which is never sent over the network.


Authentication Protocols and Password Compatibility


Clear-text NT hash(ntlm_auth) MD5 hash Salted MD5 hash SHA1 hash Salted SHA1 hash Unix Crypt
PAP
CHAP
Digest
MS-CHAP
PEAP
EAP-MSCHAPv2
Cisco LEAP
EAP-GTC
EAP-MD5
EAP-SIM
EAP-TLS

miniOrange 2FA for VPN Login

miniOrange accomplishes this by acting as a RADIUS server, that accepts the username/password of the user entered as a RADIUS request, validates the user against the user store as Active Directory ( AD ), prompts him for the 2-factor authentication and either grants/revokes access based on the input by the user.


Types of 2FA Authentications with RADIUS


The 2-factor authentication can be of two types depending on the VPN clients.


  • VPN Clients that support RADIUS Challenge.

    In this case, there are two requests. The initial one is with the user's username/password that is validated against the credentials stored in Active Directory. After the first request sends a success response, a challenge request is sent to validate the 2-factor authentication of the user( for eg, in the case of OTP Over Email, an One Time Passcode is sent to the user's email ). The user validates the second factor after which he is granted access to the application.




    Authentication methods that can be used:

    • All Authentication methods supported by miniOrange. Software Token, Push Notification, OTP over Email to name a few.

    RADIUS Clients that support this authentication type:

    • OpenVPN
    • Palo Alto
  • VPN Clients that do not support RADIUS Challenge.

    Further down, there are two types of authentication in this:


    1. The user enters the username + password and after validation, he is prompted for the 2-factor authentication code in the next screen.

    2. The user is prompted for the 2-factor authentication in the initial login screen along with his username and password.


    In both of the above cases, miniOrange accepts the request and validates the username/password first and then the 2-factor code entered by the user.




    Authentication methods that can be used:

    • Soft Token
    • OUT OF BAND EMAIL
    • OUT OF BAND SMS

    RADIUS Clients that support this authentication type:

    • AWS AD Connector
    • Palo Alto

Steps to configure 2FA for VPN Login

1. Steps to configure your RADIUS Client with miniOrange

Click here to see the detailed steps.


  • Step 1: Add the Radius Client in miniOrange

    1. Login to the admin dashboard.

    2. Navigate to Apps >> Manage Apps in the left navigation bar.



    3. Click on Configure Apps.



    4. Go to Radius applications tab and select Radius Server app. Click on Add App button.



    5. Enter the radius Client Name, Client IP and Shared Secret which you will need to configure in radius client as well.



    6. Click on Save button.

  • Step 2: Setup LDAP authentication

    1. Go to User Stores menu and click on Add User Store button.





    2. Configure your LDAP settings.



    3. Make sure to keep the below options enabled.



    4. Click on Save.

    5. After you save, click on Test Configuration to verify your LDAP settings



  • Step 3: Enable 2 factor authentication

    1. Go to Policies tab and click on App Authentication Policy.



    2. Go to Add Policy tab and add policy for application added in step 1.



  • Step 4: Configure RADIUS client

    You can configure your radius client with details below:

    Radius Server IP / Host : IP or domain name of server where you have installed miniOrange.

    Server Port : 1812

    Shared Secret : Configured in Step 1.

2. Steps to configure the miniOrange RADIUS Server with your RADIUS Client


The configuration at the RADIUS client's side depends on the VPN Client. OpenVPN has been demonstrated as an example here.

Click here to see the detailed steps.

    1. Login to the OpenVPN admin dashboard.



    2. Navigate to Authentication >> General in the left navigation bar. Select RADIUS and save the settings.



    3. Navigate to Authentication >> RADIUS in the left navigation bar. Select PAP as the RADIUS authentication method.
    In the RADIUS Settings below, enter the Radius Server IP / Host as the IP or domain name of server where you have installed miniOrange, Server Port as 1812 and Shared Secret configured in the previous step.



    4. Click on Save Settings.

Demonstration of miniOrange 2FA for VPN Login


This is how the actual VPN login with 2FA works.

    1. Connect to OpenVPN by entering the hostname of the server.



    2. Enter your AD username & password and click on Connect.



    3. Now, you are prompted for the 2-factor authentication code. Enter the code and click on Continue.



    4. After successful validation, you are connected.




Popular RADIUS Clients miniOrange integrates with:

  • Palo Alto

    The users enter their AD credentials to log in to Palo Alto, the Radius Client, and after the username/password validation, an One Time Passcode is sent to the user's mobile number. The user enters the One Time passcode received, which is validated by miniOrange to gain/deny access to the user.

  • OpenVPN

    The users enter their AD credentials and the 2FA code ( Software Token ) to log in to OpenVPN, the Radius Client, and after the username/password validation, are prompted for the 2-factor authentication. Post validation of 2nd factor, users are logged in to OpenVPN.

  • AWS AD Connector
  • FortiNet

    The users enter their AD credentials to log in to FortiNet, and after the username/password validation, an push notification is sent to the user's mobile, that he needs to accept to get logged in to AWS.


​2 Factor Authentication ​for Remote Desktop Service

Overview

​When users connect to a Remote Desktop Service, 2-factor authentication is essential to enforce high security protection of your business resources. Installing miniOrange 2-Factor Authentication for Windows Logon adds two-factor authentication to Windows login attempts over RDP.


miniOrange 2FA for Remote Desktop Service

​The user initiates the login to Remote Desktop Service either through a Remote Desktop Client or via the RD Web login page from his browser, after which the RADIUS request is sent from the miniOrange RD Web component installed on the target machine to the miniOrange RADIUS server, which authenticates the user via Local AD, and after successful authentication, 2-factor authentication of the user is invoked. After the user validates himself, he is granted access to the Remote Desktop Service.


Types

A user can try to connect to RDS (Remote Desktop Services) via 2 ways :

  1. RDC - Remote Desktop Client:
    If the RemoteApp is launched through a Remote Desktop client application, the users validate their 2-factor authentication while they enter the username and password to get access to the resources. ( as this method doesn't support access-challenge response, only out of band authentication methods are supported ).
  2. RD WebAccess - RD login page via browser: If the desktop or RemoteApp is launched through a RD Web Login page, the initial user authentication is done from the machine's AD, after which miniOrange challenges the user for 2-factor authentication via a RADIUS challenge request. After the users correctly authenticate themselves, they get connected to their resources.

2FA for RDS via RD Web

How it works


  1. In this case, the user goes to RD Web login page from his browser to connect to the Remote Desktop Service.He enters his username and password, and on submission, the RADIUS request from RD Web component installed on target machine is sent to the miniOrange RADIUS server which authenticates the user via local AD in the target machine.
  2. Once authenticated, it sends a RADIUS challenge to RD Web, and the RD Web shows OTP screen on browser now. Once the user enters the One Time Passcode, the miniorange IdP verifies it and grants/denies access to the RDS.
  3. With this, after the user is connected to the Remote Desktop Service, the user can also gain access to published remote app icons on his browser screen, since the session has already been created for the user.




Authentication methods Supported


  1. One Time Passcode Over Email
  2. One Time Passcode Over SMS
  3. Google / miniOrange / Authy Authenticator Soft Token

Demonstration of user flow


1. User goes to the RD Web login page from his browser, and enters his username/password and clicks on Submit.



2.



2FA for RDS via Remote Desktop Client

How it works


  1. In this case, the user goes to RD Web login page from his browser to connect to the Remote Desktop Service.He enters his username and password, and on submission, the RADIUS request from RD Web component installed on target machine is sent to the miniOrange RADIUS server which authenticates the user via local AD in the target machine.
  2. Once authenticated, it sends a RADIUS challenge to RD Web, and the RD Web shows OTP screen on browser now. Once the user enters the One Time Passcode, the miniorange IdP verifies it and grants/denies access to the RDS.
  3. With this, after the user is connected to the Remote Desktop Service, the user can also gain access to published remote app icons on his browser screen, since the session has already been created for the user.




Authentication methods Supported


  1. Out of Band Email
  2. Out of Band SMS
  3. Push Notification

Please contact us at info@miniorange.com to get a quick answer on RADIUS AUTHENTICATION