Horizon Cloud on Azure – 2 Factor Auth – RADIUS [Part-10]

Introduction

To more secure the user logins we can enable two-factor(2FA) authentication to your POD.
In this article, we will discuss how to use Microsoft NPS acting as our RADIUS Server and we use windows authentication only as of the first authentication
Most of the production use cases will use a third-party radius server which provides a response/challenge to be entered for the first authentication.
Assuming we have already had a Windows server deployed in Azure and all required networking (vNET peering, NSG rules and etc) configured

Prerequisites

• Windows Server Operating System
• NPS Role
• Gateway DMZ IP’s

Install NPS Role

1. Launch Server Manager
2. Click on Manage and Select Roles & Features
   
3. Click on Next and select Role-based or feature-based installation
   
4. Click Next (With default values)
5. In Roles Section, Select Network Policy and Access Services and click on Add Features, and click Next
   
6. Click Next (With default values)
7. Select Next on Network Policy and Access Services Section
   
8. Click on Install and wait till finish
9. Once the NPS role installed, we can see it the Server Manager
   

Configure NPS as a Radius

1. Select NPAS and right-click on the server’s name and select Network Policy Server
   
2. You will see the below screen
   
3. Note down the DMZ IP’s of UAG ( vNET –> overview –> search as “dmz”
   
4. In RADIUS Clients provide the DMZ IP’s (Provide all 4 of them, so that after tenant upgrade it won’t affect logins)
   
5. Click on Policies and select Network Policies
   
6. Right-click on Network Policies and Select New
7. Provide a Policy Name, other leave as defaults then clicks Next
8. Select User Groups, Provide the User group who log in through appblast portal
9. In next screen, Select Access Granted
10. Select the required Configure Authentication Methods and click on Finish
    In my setup created policy as like below
    
    
    
    Note: Please use a RADIUS server which gives challenge , here am trying to show how to configure and this use Windows authentication only

Configure RADIUS on Horizon

1. Log in to the Horizon admin console
2. From Settings –> Click on Capacity
3. Select the POD Name –> Click on EDIT
4. Move to Gateway Settings
5. Move the toggle next to Enable 2 Factor Authentication
   
6. Enter details (RADIUS Server IP, Shared secret)
   –> Authentication Port – 1812
   –> Accounting Port – 0 (keep it as 0 if Accounting is not configured else RADIUS login will wait 60+ seconds and at times it fails)
   
   
   Please do the above config on a maintenance window else there is a high chance of users existing sessions will get disconnect