Single Sign on with AAF and RDP apps using Microsoft Remote Desktop ActiveX control

Daniel Fiederling 10 months ago

Hi community,

we have deployed AAF 6.4 on our client machines and servers (current AAF Windows Client) and have also enable SSO with

sso_aaf_required: true
sso_flex_enabled: false
sso_logon_enabled: true

Using mstsc to access servers with NLA enabled works with SSO.
Most of our admins are using Royal TS (by Royal Apps) which uses the same ActiveX control for RDP sessions as MS RDCM:

https://learn.microsoft.com/en-us/windows/win32/termserv/remote-desktop-activex-control-reference

I didn't find a solution how to make SSO work in this "3rd party apps".
Behavior is that on client-side the AAF credential provider asks for a credentials. After opening the session, the server also brings up the aaf credential provider during logon.

Can anyone help with this?
Can anyone tell me how the RDP server is made aware of a client-side AAF installation? Is this transferred by mstsc in some custom extensions or in a Kerberos ticket or the like?

bye
Daniel

Top Replies

0 Luciano Testa 10 months ago
Hello Daniel,

Where has the client been installed exactly?

Check this note from the Client documentation:

https://www.netiq.com/documentation/advanced-authentication-64/windows-client-installation-guide/data/config_sngl_sign_on_spprt_ctrx_n_rmt_dsktp.html

Configuring Single Sign-on Support for Citrix and Remote Desktop

You can configure the Windows Client to use the Single Sign-on (SSO) feature for establishing a connection to a Citrix and a Remote Desktop server. Therefore, when the users are authenticated to the Windows domain, they are not prompted for credentials to connect to the terminal servers such as Citrix StoreFront and Remote Desktop Connection. This prevents users from specifying the credentials again when they login to terminal servers (remote machine to which the user is connecting from the Terminal Client) such as Remote Desktop or Citrix StoreFront, after they have performed the authentication to Microsoft Windows. To achieve this, you must install the Advanced Authentication Windows Client on the terminal server.

NOTE:When SSO for Remote Desktop is enabled, the Interactive logon: Smart card removal behavior policy is ignored. You need to disable SSO to make this policy to work.

Enable the SSO Feature

Disabling SSO Irrespective of the Advanced Authentication Windows Client Installation of the Terminal Client

Enabling Single Sign-on for Groups of AD

And:

Enabling Single Sign-on for Groups of AD

Advanced Authentication Windows client allows you to enable single sign-on for establishing a connection to a Citrix and a Remote Desktop server for a specific group of users:

Open the configuration file C:\ProgramData\NetIQ\Windows Client\config.properties.

If the file does not exist, create a new file.

Specify sso_groups_enabled: groups in AD

For example, sso_groups_enabled: test group 1, test group 2

You can configure more than one group using comma or semicolon as a separator.

Save the configuration.

Restart the Windows operating system.

How exactly has your system been configured in regards to this documentation?

Thanks.

Regards,

Luciano Testa
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Daniel Fiederling 10 months ago in reply to Luciano Testa

Hi Luciano,

thanks for your reply.

We have installed AAF Windows Client (and Device Service) on both sides (RDP client aka Windows 10 machine and RDP server aka Windows Server 20xx OS).

As the behavior with mstsc is as expected (NLA forces local auth on client and SSO is working), I think this is an issue related to the 3rd party RDP apps (Microsoft Remote Desktop Connection Manager or Royal TS). Both are using a Microsoft default ActiveX component for implementing a RDP multi session client.

I don't think we have a config issue with the AAF components.

I was in contact with Royal TS developers but they said they rely on the Microsoft ActiveX and need more info about how the SSO mechanism is working.

bye
Daniel
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Luciano Testa 10 months ago in reply to Daniel Fiederling

Hi Daniel,

I am asking about this internally to see how we can help.

Please bear with me.

Thanks.

Regards,

Luciano Testa
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel
Verified Answer

+1 Luciano Testa 10 months ago

Hello Daniel,

All I could gather is that none of these clients seem to work. Even using others they don't work. This was never tested, the only supported RDP client seems to be mstsc.

At this stage my advice would be to open a new Idea in the Idea Exchange area of this forum so Product Management and Development can consider this for a future release.

If I discover anything else I will add it to this thread too.

Thanks.

Regards,

Luciano Testa
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 Daniel Fiederling 10 months ago in reply to Luciano Testa

Hi Luciano,

thank you very much. I created this idea: Support RDP Single Sign On (SSO) on other RDP clients than mstsc

If you get anything else that might help, your update here is very much appreaciated.

bye
Daniel
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel

Menu

Advanced Authentication Discussions

Single Sign on with AAF and RDP apps using Microsoft Remote Desktop ActiveX control

Top Replies

Configuring Single Sign-on Support for Citrix and Remote Desktop

Enabling Single Sign-on for Groups of AD

Verified Answer

Resources