Two-factor authentication adds an extra layer of security and prevents access to your users’ session even if someone knows their password. A combination of two different factors is used to achieve a greater level of security:

1) something they know, a password.
2) something they have, a device – such as a smartphone – with an authentication app installed.

You can use one of the following authenticator apps to proceed. These apps are available across a wide range of platforms:
– Authy
– Google Authenticator
– Microsoft Authenticator

Each time a user sign in to its remote session it will need its password and a verification code available from its mobile phone. Once configured, the authenticator app will display a verification code to allow him or her to log in any time. It works even if its device is offline.

Two-factor authentication is available for the RDPlus Web portal and Client Generator only. This authentication mode does not support login through Remote Desktop client. Since 2FA authentication only works with the Web portal with HTML5 and RemoteApp connections. RDP connections are denied for 2FA enabled users.

Activating the Two-factor Authentication Add-On (Activation Key)

The Two-Factor Authentication feature can be found on the Add-On tab of the AdminTool:

It is available as a 30-day trial for 10 users. To activate your license, open the license tile of the add-on, then click on Activate your License and enter your Activation Key.

Select the product you wish to activate and then you will be prompted with a pop-up confirming that your license has been activated!

Activating the Two-factor Authentication Add-On (Legacy)

The Two-Factor Authentication feature can be found on the Add-On tab of the AdminTool:

It is available as a 30-day trial for 10 users. To activate your license, copy the serial number you can find on this tile:

Then, connect to our online store and purchase a license.

You will get your license.lic file, then, click on the “Activate your license” tile:

Enable Two-factor Authentication

Perform the following steps to enable two-factor authentication for your RDPlus server or deployment. If your RDPlus deployment is configured to use multiple servers, perform this task on the RDPlus server exposed as the single point of entry for users or having the reverse proxy role.

1) Open the two-factor authentication administration application. The two-factor authentication status and the license status are displayed:

By default, 2FA is enabled for the RDPlus gateway and stand-alone application servers.

You can enable it for RDPlus application servers only, by entering the authentication server URL:

Or disable it:

Add Users and Groups

Once two-factor authentication is enabled, you can configure users for two-factor authentication.

1) From the two-factor authentication administration application, click on the Manage Users menu.

Manage Users and Groups

2) Then, click on Add to select users and/or groups of users. The Select Users or Groups box opens.

3) Add as many users and groups as required and then click OK. The users and groups are added to the list and enabled for two-factor authentication.

Remove Users and Groups

1) To disable two-factor authentication for a user or a group, from the two-factor authentication administration application, click on the Manage Users menu.

2) Select the user or the group and then click on Remove. A confirmation message is displayed.

3) Click Yes. The user or the group is removed from its list and won’t connect using two-factor authentication anymore.

Reset QR codes

In the event of the loss of the authenticating device for a user, or if the user needs to display the secret QR code again, you must reset the user authentication settings.

1) From the two-factor authentication administration application, click on the Reset Users menu.

2) Select one or multiple users and then click on Reset. A confirmation message is displayed.

3) Click Yes. The selected users will be presented a new QR code at the next login and will have to scan it in their device’s authentication app.

Enroll User for Two-factor Authentication

Once a user has been enabled for using two-factor authentication, an activation message will be displayed at his next successful logon from the RDPlus Web portal.

In order to complete the required steps, the user must install an authenticator app on a portable device, such as his smartphone.

You can use one of the following authenticator apps to proceed. These apps are available across a wide range of platforms:
– Authy
– Google Authenticator
– Microsoft Authenticator

Please use each app documentation for more details on how to proceed to add your RDPlus account.

Login using Two-factor Authentication

Once a user has configured his RDPlus account in his authenticator app, he or she will be able to connect using its password and the code provided by its authenticator app.

Settings

Two-factor Authentication-Settings

The Settings tab allows you to whitelist users, in order for them to connect using an RDP client, without the need to enter a two-authentication code.

Click on the “Add” button to add a user and remove a user by selecting it and clicking on the “Remove” button.

Two-factor Authentication-Settings

The Advanced tab allows you to configure Two-Factor Authentication in-depth settings.

Two-factor Authentication-Advanced-Settings

Discrepancy

You can modify the Discrepancy value, which allows you to set the validation time of a verification code.
A discrepancy of 3 means that the same verification code remains valid 90 seconds backward and forward its original 30 seconds validity period. Default is 480, which means 480 x 30 seconds= 4 hours.

Two-factor Authentication-Advanced-Settings

Issuer

A string indicating the name of the two-factor authentication service. The issuer is displayed on the client mobile app and identifies the service associated with the generated verification code. By default, it is composed of the server’s name with RDPlus.

Two-factor Authentication-Advanced-Settings

Validity After First Session

Period during which a user can open a session without having to revalidate a previous two-factor authentication code. This setting allows users to open applications from the Web application portal successively. Default is 480 minutes.

Two-factor Authentication-Advanced-Settings

Validity Before First Session

Period during which a user can open a session after validating a two-factor authentication code from the Web portal, in secondes. Default is 3600 seconds.

Two-factor Authentication-Advanced-Settings

Digits

The number of digits to display to the user. Please note that this setting may not be supported by authentication apps. This number must be greater than or equal to 4 and lower or equal to 12. Default is 6.

Two-factor Authentication-Advanced-Settings

SMS Verification Code Message

Message sent to users requesting a verification code if they are configured to receive it via SMS. This message must contain the %CODE% placeholder which will be replaced by the actual verification code. Default is: Your %ISSUER% verification code is: %CODE%

Two-factor Authentication-Advanced-Settings