Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have several applications that leverage AD

  • SAML (via Ping Federate)
  • LDAP authentication from 3rd party applications
  • Windows workstation / Exchange auth (Kerberos)
  • IIS and web components (su4user, impersonation, etc)

I have never deployed 2 factor auth in an AD environment and remember reading that RADIUS was leveraged in a way to accommodate many if not all of the scenarios above, with minimal impact to the end users.

Can anyone explain the infrastructure that is needed for a private corporation to deploy 2FA to their AD Forest, and allow 3rd parties (such as Salesforce, Dropbox, Office 365) to leverage that authentication?

share|improve this question

A partial answer that may get you on the right path is to set up NPS as your radius server and get as many of your applications using radius. This is simple to do for VPNs. Your 3rd party apps will have to support radius as well as ldap. LDAP will not proxy the credentials to a 3rd party server like radius. IIS support radius auth. Not sure if Ping supports radius. Do not use radius over the internet, except in an encrypted tunnel.

Workstation login is very hard to via radius as the GINA just doesn't support it.

We have a doc on adding two-factor to NPS: and we have a pdf on the architecture of it here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.