I'm trying to publish a Windows 2012r2 RDweb and RD gateway server in such a way that in order to use the rd gateway you need to provide your normal AD credentials followed by a prompt for a one-time-password that gets sent to the user by SMS
according to this article:
https://code.msdn.microsoft.com/Remote-Desktop-Gateway-517d6273/view/Reviews
this should be possible using a Pluggable Authentication Module on the gateway server - does anyone know of a product that uses these APIs? or some other method to achieve it?
Note that I can put it behind a (sadly deprecated) TMG server (or a citrix netscaler) and do the sms auth there by radius on the https://server/rdweb interface, but as it is handed off to the mstsc.exe client which tries to tunnel through https://server/rdweb
interface, it needs to re-auth, so fails (the above article suggests the cookie can be transferred into the *.rdp file, but it doesn't appear to happen)
the MS Azure MFA service (and a few other 'cloud' auth products I've seen) is a radius server that expects a response to the SMS, via SMS - this is not the solution we're aiming for
Similarly, installing a 3rd party GINA on every host accessible via the gateway is also not an acceptable solution.
logically, the functionality should live at the gateway or the reverse proxy, but I cant find a way of doing it in the reverse proxy, and I cant find a product that uses the API MS provide for it - can someone steer me in the right direction?