2Factor Archives

Hi, Today I would like to configure Multifactor Authentication for Horizon8 through Keycloak.

What is MFA?

Multifactor authentication (MFA) is a multistep account login process that requires users to enter more information than just a password. For example, along with the password, users might be asked to enter a code sent to their email, answer a secret question, or scan a fingerprint.

Which MFA Protocol Supports Horizon?

You can enable a Connection Server instance for RSA SecurID authentication or RADIUS authentication by modifying Connection Server settings in Horizon Administrator.

Prerequisites

Install and configure the two-factor authentication software, such as the RSA SecurID software or the RADIUS software, on an authentication manager server.

1- For RSA SecurID authentication, export the sdconf.rec file for the Connection Server instance from RSA Authentication Manager. See the RSA Authentication Manager documentation.

2- For RADIUS authentication, follow the vendor’s configuration documentation. Make a note of the RADIUS server’s hostname or IP address, the port number on which it is listening for RADIUS authentication (usually 1812), the authentication type (PAP, CHAP, MS-CHAPv1, or MS-CHAPv2), and the shared secret. You will enter these values in Horizon Administrator. You can enter values for a primary and a secondary RADIUS authenticator.

Procedure

Log into Horizon Server, and select View Settings> Servers.
On the Connection Servers tab, select your connection server and click Edit.
On the Authentication tab, from the 2-factor authentication drop-down list in the Advanced Authentication section, select RADIUS.
To force RADIUS usernames to match usernames in Active Directory, select Enforce 2-factor and Windows username matching.
If you select this option, users must use the same RADIUS username for Active Directory authentication. If you do not select this option, the names can be different.
For RADIUS authentication, complete the rest of the fields:
1. Select Use the same username and password for RADIUS and Windows authentication if the initial RADIUS authentication uses Windows authentication that triggers an out-of-band transmission of a token code, and this token code is used as part of a RADIUS challenge.
  If you select this check box, users will not be prompted for Windows credentials after RADIUS authentication if the RADIUS authentication uses the Windows username and password. Users do not have to reenter the Windows username and password after RADIUS authentication.
2. From the Authenticator drop-down list, select Create New Authenticator and complete the page.

6. Click Add

Give a name for the Authenticator name field. This name is displayed when users want to log in. You can customize username and passcode labels.

Give your Keycloak Radius information

Hostname/Address: keycloak.khoshraftar.com\

Authentication Port: 1812

Accounting Port: 0

Set the Accounting port to 0 unless you want to enable RADIUS accounting. Set this port to a non-zero number only if your RADIUS server supports collecting accounting data. If the RADIUS server does not support accounting messages, and you set this port to a nonzero number, the messages will be sent and ignored and retried a number of times, resulting in a delay in the authentication.

Accounting data can be used in order to bill users based on usage time and data. Accounting data can also be used for statistical purposes and for general network monitoring.

Authentication Type: PAP-CHAP-MSCAHP1-MSCHAP2

Shared Secret: ***********

Must same with your radius shared secret

If you specify a realm prefix string, the string is placed at the beginning of the username when it is sent to the RADIUS server. For example, if the username entered in Horizon Client is Mohammad and the realm prefix Khoshraftar\ is specified, the username khoshraftar\Mohammad is sent to the RADIUS server. Similarly, if you use the realm suffix, or postfix, string @khoshraftar.com, the username mohammad@khoshraftar.com is sent to the RADIUS server.

Click Next

8. Click OK to save your changes.

You do not need to restart the Connection Server service. The necessary configuration files are distributed automatically, and the configuration settings take effect immediately.

What is Keycloak?

Keycloak is an open-source identity and access management solution.

How to install Keycloak?

You can download Keyclock from here. But for this project, I need to Radius, radius is not on Keycloak default. So, you can config a manual radius from this link.

But, I want to write a simple configuration about keycloak radius in my blog.

I download a java base keycloak application from here.
I installed an Ubuntu server and install an openjdk 11 on it.
Copy the keycloak files on the Ubuntu server.

 unzip keycloak-radius.zip -d keycloak-radius

```
cd keycloak-radius/
```
```
export KEYCLOAK_ADMIN=admin
```
```
export KEYCLOAK_ADMIN_PASSWORD=admin
```
```
bin/kc.sh start-dev
```
Open http://Server-IP-Address:8080

10. Username: admin

11. Password: admin

12. Under Manage–> Select Clients and Create client

13. Choice radius protocol from the drop-down menu and Fill in a Client ID

Note: This name must be the same as the authenticator name in the Horizon config in the previous section.

14. Click Next

15. Click Save

16. Click on the Users section and click Add Users

Note: If you want to log in with a password, leave the required user actions, Blank.

Click on Create and then click on the user that you created.

17. Click on the Set password button. Type your password and If you turn on Temporary you must change your password in the first login. I turn off it. And Save it.