Multi-Factor Authentication (2FA/MFA) for Kemp – RADIUS

Last updated on February 6, 2025

Overview

The purpose of this document is to enable Rublon Two-Factor Authentication (2FA) for users logging in to Kemp. In order to achieve that using RADIUS (e.g. FreeRADIUS) as your authentication source, you have to use Rublon Authentication Proxy, an on-premise RADIUS proxy server, which allows you to integrate Rublon with Kemp to add Two-Factor Authentication to your logins.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
WebAuthn/U2F Security Key	–	N/A
Passcode	✔	N/A
SMS Passcode	–	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	–	N/A
Email Link	✔	N/A
YubiKey OTP Security Key	✔	N/A

Before you start

You need to install and configure Rublon Authentication Proxy before configuring Kemp to work with it. Read Rublon Authentication Proxy and follow the steps in Installation and Configuration sections. Afterwards, continue with this document.

Configuration

1. Open the Kemp admin console.

2. Navigate to the menu located on the left, and select Add New under the Virtual Services section.

3. Specify the parameters for your Virtual Service, and click the Add this Virtual Service button. If you would like to learn more, please visit this web page.

4. Navigate to Virtual Services → Manage SSO, and fill in the Add new Client Side Configuration field with the name of your new SSO configuration. Afterwards, click Add to create a new Client Side Configuration.

5. Select RADIUS in the Authentication Protocol drop-down list.

6. Enter the address of your Rublon Authentication Proxy in the RADIUS Server(s) field. Confirm by clicking the Set RADIUS Server(s) button.

7. Enter the RADIUS Secret set in Rublon Authentication Proxy as the RADIUS Shared Secret, and confirm by pressing the Set Shared Secret button.

8. Set Logon Format (Phase 1 RADIUS) to Username Only.

9. You can optionally enable Send NAS Identifier. It’s disabled by default. If you enable it, a NAS identifier string is sent to the RADIUS server. This string is set to hostname by default. If you check Send NAS Identifier, a RADIUS NAS Identifier field will appear, and you will be given an opportunity to specify the value to be used as the NAS identifier. If the value is not specified, the hostname is used.

Other settings depend on your preferences. If you would like to learn more, please visit this page.

10. Navigate to View/Modify Services, and click the Modify button. Extend ESP options.

11. Check Enable ESP, and fill in the required data.

12. Set Client Authentication Mode to Form Based. Set the SSO Domain you have created before, and finally specify the Allowed Virtual Hosts, Allowed Virtual Directories and Server Authentication Mode according to your configuration. If you would like to learn more about the ESP configuration, please visit this page.

13. Your configuration is complete. Your users have 2FA enabled when logging in to their Virtual Service.

Log in to Kemp with Rublon 2FA

1. Run Kemp Virtual Service. As you can see in the picture below, the user has to provide the credentials from RADIUS.

Depending on the configuration of your Rublon Authentication Proxy, you will be presented with the appropriate second authentication factor. The two Rublon Authentication Proxy modes are described below:

Challenge mode

An additional window will appear for you to enter Mobile Passcode from Rublon Authenticator. Here, the second authentication method is the Mobile Passcode (TOTP). This option allows you to configure Two-Factor Authentication in Kemp using Rublon Authentication Proxy.

Standard mode

The default method of second authentication is set in the Rublon Authentication Proxy configuration, and it will appear after entering the username and password. Available options are: push, email.

In standard mode, it is also possible to enable the Append Mode option.

2. Let’s assume you have configured your Rublon Authentication Proxy to use Email Links as the authentication method (AUTH_METHOD is set to email). After providing your login and password, you will be sent an email with a request to confirm your login. Click Sign In to finish the logging process.

3. After correctly finishing the 2FA process, you will be transferred to the virtual service.

4. After successfully logging in to Kemp, an active session in Users Management will appear. See the picture below.

Troubleshooting

If you encounter any issues with your Rublon integration, please contact Rublon Support.

Related Posts

Rublon Authentication Proxy

Rublon Authentication Proxy – Integrations