Hello there!

Need Help? We are right here!

miniOrange Email Support
success

Thanks for your inquiry.

If you dont hear from us within 24 hours, please feel free to send a follow up email to info@xecurify.com

Multi-factor Authentication (MFA/2FA) for Microsoft Remote Desktop (RD) Gateway to improve security


Remote Desktop Gateway (RD Gateway) Multi Factor authentication (MFA/2FA) configuration adds additional two-factor authentication security to your Remote Desktop, RDWeb, RemoteApp Access logons. It also blocks connections to your RDP (Remote desktop protocol) servers if users have not passed Multi-factor / two-factor authentication where connection requests are proxied through a Remote Desktop Gateway (RD Gateway). Because RD (Remote Desktop) Gateway gives public network users access to critical resources located within companies, it only makes sense to add layers of access security to RD Gateway access via multi-factor authentication (MFA/2FA).


Using the miniOrange RD (Remote Desktop) gateway MFA solution, you can configure 15+ MFA methods like Push Notification through miniOrange authenticator, and out of band methods like SMS and Email link. Checkout more about Multi-Factor Authentication (MFA) here. Once you have configured the miniOrange MFA solution for the RD gateway. You will have to enter your computer name/username or address and the username along with the password. Based on your 2FA method, you will receive a notification or SMS/Email link. Once you click on the link, you will be logged in. You can also secure your Windows and Linux machines using our Windows MFA Solution. Checkout the additional resources (at the bottom of this page) for more details.


Following are the types for Remote Desktop Services

A user can try to connect to RDS (Remote Desktop Services) via 2 ways :

  1. RDC - Remote Desktop Client:
    If the RemoteApp is launched through a Remote Desktop client application, the users validate their two-factor authentication (2FA) while they enter the username and password to get access to the resources. (as this method doesn't support access-challenge response, only out of band authentication methods aresupported ).
    Check the guide to setup Remote desktop protocol MFA (RDP MFA/2FA)
  2. RD WebAccess - RD login page via browser:
    If the desktop or RemoteApp is launched through a RD Web Login page, the initial user authentication is done from the machine's AD, after which miniOrange challenges the user for two factor authentication(2FA) via a RADIUS challenge request. After the users correctly authenticate themselves, they get connected to their resources.
    Check the guide to setup Remote desktop Web MFA (RD Web MFA/2FA)

Remote Desktop Gateway Multi factor authentication (RD Gateway MFA/2FA) - Authentication Flow:


Remote Desktop (RD) Gateway Two-factor authentication (2FA/MFA)

  1. User Attempts to access a Remote Machine using the Remote Desktop Client with Username and Password.
  2. The Username and Password are verified against the Active Directory. (First Factor Authentication)
  3. Radius Request is sent from the RD Gateway to the Network Policy Server (NPS).
  4. Based on the policies defined in the NPS, the Radius request is forwarded to the Radius Server (miniOrange Server) for validation.
  5. miniOrange receives the Radius requests and sends an Two/Multi Factor authentication (Out of Band) request to the user device.
  6. User validates the Out of Band Request (Email, SMS, Push-Notification MFA / 2FA method). On Success, miniOrange sends back a success response to NPS Server.
  7. NPS Server redirects it to RD Gateway.
  8. The user is granted access to the Remote Machine.

miniOrange Credential Providers can be installed on Microsoft Windows client and server operating systems to add Multi/two factor Authentication to Remote Desktop. In this way you can get access to our MFA/2FA solution for RD Gateway.

miniOrange supports following Authentication Methods for Multi Factor Authentication (MFA/2FA):

Authentication TypeMethodSupported
miniOrange Authenticator Soft Token
miniOrange Push Notification
SMSSMS with Link
EmailEmail with Link

Get Free Installation Help - Book a Slot


miniOrange offers free help through a consultation call with our System Engineers to Install or Setup Two-Factor Authentication for RD Gateway solution in your environment with 30 days trial.

For this, you need to just send us an email at idpsupport@xecurify.com to book a slot and we'll help you setting it up in no time.



Prerequisites

Follow the Step-by-Step Guide given below to configure Two factor authentication (2FA/MFA) for RD Gateway

1. Configure RD Gateway

  • Open the RD Gateway Manager from your Start Menu.
  • Right click on your RD server in the left sidebar and click on Properties.
  • Remote Desktop (RD) Gateway Two-factor authentication (2FA/MFA) rdg properties

  • Select the RD CAP Store tab.
  • Select the Central server running NPS radio button and enter the IP address of miniOrange Radius Server and press Add button.
  • Enter the DNS: radius.xecurify.com in the Host and configure the Shared secret and remember this shared secret as it will be required further in the setup.
  • Remote Desktop (RD) Gateway Two-factor authentication (2FA/MFA) properties central

  • Click the Apply button and the click on OK button.
  • Open the Network Policy Server manager.
  • Expand RADIUS Clients and Servers in the left sidebar
  • Select Remote RADIUS Server
  • Right click on TS GATEWAY SERVER GROUP and click on Properties
  • Remote Desktop (RD) Gateway Two-factor authentication (2FA/MFA) nps remote radius

  • Select your RADIUS server and press Edit.
  • Select the Load Balancing tab and set the timeout settings to 120 seconds
  • Remote Desktop (RD) Gateway Two-factor authentication (2FA/MFA) load balance

  • Click on the Apply button and then click OK button to close the dialog
  • Expand Policies in the left sidebar and click on Connection Request Policies
  • Right click on TS GATEWAY AUTHORIZATION POLICY and click on Properties
  • Click on Settings tab and select Authentication and ensure that it’s set to Forward requests to the remote RADIUS server
  • Remote Desktop (RD) Gateway Two-factor authentication (2FA/MFA) nps-crp forward

  • Click on Policies –> Network Policies.
  • Remote Desktop (RD) Gateway Two-factor authentication (2FA/MFA) nps network policies

  • Double click on your RDG CAP policy
  • Click on the Conditions tab
  • Remote Desktop (RD) Gateway Multi-factor authentication (MFA/2FA) nps network policies conditions

  • Select the Called Station ID attribute and press the Edit… button
  • Set the value to UserAuthType:(PW|CA)
  • Remote Desktop (RD) Gateway Multi-factor authentication (MFA/2FA)

  • Click on the OK button and click on the Apply button

2. Add RADIUS Client in miniOrange

  • Login to miniOrange dashboard from the Admin Console.
  • Go to Apps. Click on Add Application button.
  • Remote Desktop (RD) Gateway Multi-factor authentication (MFA/2FA) Add application

  • Choose RADIUS as Application type and click on Create App button.
  • Remote Desktop (RD) Gateway Multi-factor authentication (MFA/2FA) Choose RAdius Application to configure

  • Configure details below to add Radius Client.
  • Client Name: Any name for your reference.
    Client IP: IP address of VPN server which will send Radius authentication request.
    Shared Secret: Security key.
    For Eg. "sharedsecret"
    (Keep this with you, you will need to configure same on VPN Server).
    Include Password & OTP in same Request Keep this option Disabled
    Send Groups in Response Enable this to send user groups as Vendor-Specific Group Attributes.

    Remote Desktop (RD) Gateway Multi-factor authentication (MFA/2FA) App Configured

  • Configure the following Policy details for the Radius App.
  • Group Name: Group for which the policy will apply.
    Policy Name: Any Identifier that specifies policy name.
    Login Method Select OTP/Push/Mobile Token (Password-Less Login).
    Remote Desktop (RD) Gateway Multi-factor authentication (MFA/2FA) App Policy Configured

  • Click on Save.

Step 3: Configure Second Factor for End-Users

3.1:Configure Branding from miniOrange Admin Dashboard.

  • From your miniOrange Dashboard in the left navigation bar, select Customization, click on Login and Registration Branding.

  • Remote Desktop (RD) Gateway Multi-factor authentication (MFA/2FA) Select Login and Registration Branding

  • Configure the Organization Name accordingly. For Eg:mysso
  • You can customize the End-User Login Page according to your choice.
  • Once configure, scroll down and click on Save
  • Your End-User login link should be updated under Login Page URL
  • Navigate to 2-Factor Authetication, select 2FA Options for End-User
  • Multi/Two factor authentication for RD Gateway End-User

    Note: We only support Out of Band methods for MFA over RD Gateway.
    Eg. SMS Link, Email Link etc.


  • Under SELECT 2FA METHODS ALLOWED TO BE SHOWN TO ENDUSERS, select only the Link notification Methods
  • Click on Save

3.2: Configure 2FA for Users of RD Gateway.

  • Endusers can login to the End-User Portal using the Login Page URL
  • Once the End-User is logged in, Click on Configure 2FA from the left pane.
  • Here the End-User is provided the option to select the Out of Band Notification Method of his choice.
  • Multi/Two factor authentication for RD Gateway select End-User 2FA method

  • Here we have configured SMS Link as a 2FA method for an example.

4. Test your RD Gateway 2FA Setup

  • Open Remote Desktop settings. Go to the Advanced tab and click on Settings. Choose the radio button which says, Use these RD Gateway Settings
  • Multi/Two factor authentication for RD Gateway Test

  • Enter your Computer Name/Address and the User Name.
  • Multi/Two factor authentication for RD Gateway Enter username

  • Enter the Password for RD Gateway.
  • Multi/Two factor authentication for RD Gateway Password

  • You will receive a Notification or message. If you Accept it, then you will be logged in successfully to your Windows RD Gateway .

External References



Want To Schedule A Demo?

Request a Demo
  


Our Other Identity & Access Management Products