Skip to main content

RDP Windows Logon

The RDP Windows Logon module allows you to implement two-factor authentication with Axidian Access when connecting over the RDP (Remote Desktop Protocol) protocol or in the Remote App application.

The second factor can be one of the following:

Prerequisites​

To use the RDP Windows Logon module:

  1. Enable NLA (Network Level Authentication) for the user.
  2. When using the HTTPS protocol connection, install a client certificate on each Core Server.
  3. Install and configure RDP Windows Logon.
  4. Configure the authentication provider selection on the user side.
  5. If required, specify the optional settings.

Install and configure RDP Windows Logon​

  1. Run the installation file located at Axidian Access <version number>/Axidian RDP Windows Logon/<version number> and follow the steps of the installation wizard.

  2. Open Windows Registry Editor.

  3. In the HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID section, create the RemoteAuth section.

  4. In the RemoteAuth section, create the ProviderId string parameter and set the value corresponding to the provider used.

    Possible ProviderId values
    • SMS OTP {EBB6F3FA-A400-45F4-853A-D517D89AC2A3}
    • Email OTP {093F612B-727E-44E7-9C95-095F07CBB94B}
    • Passcode {F696F05D-5466-42b4-BF52-21BEE1CB9529}
    • Software OTP {0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}
    • Secured TOTP {F15FD7EC-19EA-4384-846E-A2D0BE149FA2}
    • Hardware OTP {AD3FBA95-AE99-4773-93A3-6530A29C7556}
    • Hardware TOTP {CEB3FEAF-86ED-4A5A-BD3F-6A7B6E60CA05}
    • Axidian Key (only in the push notification mode with login confirmation) {DEEF0CB8-AD2F-4B89-964A-B6C7ECA80C68}

  1. In the HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID\SrvLocator2 section, modify the following parameters:

    • In the ServerUrlBase parameter, specify the URL of your Core Server in the format http(s)://full_dns_server_name/am/core.

      Important

      In the application settings, the URL must not contain a slash (/) at the end of the address.

    • In the IsIgnoreCertErrors parameter, specify the value 0 or 1. This parameter stands for verifying the Core Server certificate; with the value 1, certificate errors are ignored.

Configure the authentication provider selection for the user​

  1. In the Windows registry, in the HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID\RemoteAuth section, create a DWORD parameter named IsAuthSelectionEnabled.

  2. Set the value of the IsAuthSelectionEnabled parameter to 1.

    If the parameter is not specified or its value is 0, the authentication provider selection is not offered. In this case, all available authentication methods are displayed.

    If IsAuthSelectionEnabled=1 and a provider is specified in ProviderId, the specified provider is selected when the user connects. The user can also select any other supported provider.

Optional settings​

Example of the module operation​

  1. Connect to the machine with RDP Windows Logon installed.

  2. Specify the user and the domain password and click OK.

  3. Enter the one-time password.

    Note

    If the user has no available authentication methods, the message No available authentication methods. Access denied. appears and the Remote Desktop session is terminated.