3

We have several applications that leverage AD

  • SAML (via Ping Federate)
  • LDAP authentication from 3rd party applications
  • Windows workstation / Exchange auth (Kerberos)
  • IIS and web components (su4user, impersonation, etc)

I have never deployed 2 factor auth in an AD environment and remember reading that RADIUS was leveraged in a way to accommodate many if not all of the scenarios above, with minimal impact to the end users.

Can anyone explain the infrastructure that is needed for a private corporation to deploy 2FA to their AD Forest, and allow 3rd parties (such as Salesforce, Dropbox, Office 365) to leverage that authentication?

Improve this question

1 Answer 1

Reset to default
1

A partial answer that may get you on the right path is to set up NPS as your radius server and get as many of your applications using radius. This is simple to do for VPNs. Your 3rd party apps will have to support radius as well as ldap. LDAP will not proxy the credentials to a 3rd party server like radius. IIS support radius auth. Not sure if Ping supports radius. Do not use radius over the internet, except in an encrypted tunnel.

Workstation login is very hard to via radius as the GINA just doesn't support it.

We have a doc on adding two-factor to NPS: https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-nps and we have a pdf on the architecture of it here: https://www.wikidsystems.com/learn-more/white-papers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .