Enabling MFA Posture Check

1

Hi all, I’m new to OpenZiti so be kind :wink:

I have successfully setup and tested connectivity to an MS RDS Host.

I used the ZAC to create the service and policies. There are 4 policies that were created:

RDP-Server-bind-policy

RDP-Server-dial-policy

RDP-bind-policy

RDP-dial-policy

I have enabled MFA on the Ziti Desktop Edge Client and that works when I enable the service- I get prompted for MFA and am able to enter the MFA code.

I’m now trying to setup and test MFA using Posture Check but cannot get it to work.

I create a Posture check using MFA under Identities.

If I assign my MFA posture check to RDP-bind-policy I never get the RDP Host login prompt nor do I get the MFA prompt.

If I assign my MFA posture check to the other 3 policies above I can connect to the RDP Host without MFA.

Any thoughts? Thanks in advance.

2

Could this be related to another post I found that described a potential bug with MFA?

3

Hi @czopper, welcome to the community and to OpenZiti! Sorry for a slight delay in responding... We're always kind here! :slight_smile:

Oh, I wonder if we have ever tested this for bind. That's an interesting use and one I've never tested myself. I almost exclusively use posture checks and MFA on dial policies. Never bind...

I assume that is intentional right? I'll have to test this myself...

4

Hi thanks for the reply. I have tried Dial but nothing happens and my RDP connection works. When I enabled Posture Check on Bind that is when nothing happens and my RDP connection eventually times out.

5

FYI I'll get to this but it might take me a bit. If I (or someone) don't reply before say next tuesday, please bump this thread? :slight_smile: cheers

7

Thanks. No rush, when you can, thanks.

8

Saturday bump, thanks

9

We were able to find and fix the problem in development branches and it's working its way through a deployment. Should be getting fixed "pretty soon". :slight_smile: I'll post back here when I push out the latest zssh code and works for zssh and any changes that are necessary (which I don't think any would be but I don't exactly remember at the moment)

10

Awesome and thanks for the find!

11

Oh no... My bad, I see now I posted my reply here but that was the wrong thread :confused: I'll have to have a look at this again. Sorry to get your hopes up.

12

No worries. Hope to here back soon

13

FYI I've filed this bug to track MFA on Bind services never prompt · Issue #886 · openziti/desktop-edge-win · GitHub

14

Hi any progress on this issue?

15

Hello and thanks for the bump. Unfortunately we haven’t gotten started on this issue yet!