Rublon Access Gateway

Last updated on November 2, 2026

Overview

Rublon Access Gateway works as a web application that allows you to secure the login process by using multi-factor authentication in the form of an additional Rublon MFA authentication performed after logging in through an authentication source. The application allows you to use one of three authentication sources (LDAP, Microsoft Active Directory, RADIUS). Rublon Access Gateway makes it possible to define integrations with common web applications like G Suite, Freshdesk, etc. The data between Rublon Access Gateway and added applications is transferred using the SAML 2.0 standard.

You can use Rublon Access Gateway to:

1. Add an application (Freshdesk, Salesforce, etc.) and therefore introduce Rublon MFA into its authentication process.
2. Configure an Authentication Source (LDAP, Microsoft Active Directory, RADIUS).
3. Secure your login process by using 2FA in the form of an additional Rublon MFA authentication performed after logging in with your authentication source.

Rublon Access Gateway supports the following authentication methods:

• Mobile Push
• FIDO
• Passcode
• SMS Passcode
• SMS Link
• Phone Call
• QR Code
• Email Link
• YubiKey OTP

Network Diagram

1. Initiate login to a cloud app.

2. Login request sent to Rublon Access Gateway.

3. Perform primary authentication against your identity provider (FreeRADIUS, FreeIPA, OpenLDAP, Active Directory, etc.).

4. Establish a connection to Rublon API.

5. Perform secondary authentication using one of the authentication methods.

6. Receive a success response.

7. Log in the user.

Installation

Rublon Access Gateway enables two-factor authentication for popular cloud services and other applications that allow integrations via SAML (e.g., Cisco AnyConnect).

Rublon Access Gateway works on both Windows Server and Linux.

Refer to the appropriate subsection to install Rublon Access Gateway on Windows Server or Linux. If you are updating an existing installation, refer to Updating Rublon Access Gateway.

Windows Server

Requirements:

• Windows Server with IIS and CGI support. ASP.NET is not required.
• PHP 8.3, version 8.3.36 or later, x64, Non Thread Safe.
• Microsoft Visual C++ 2015–2022 Redistributable (x64).
• An SSL certificate for the Rublon Access Gateway domain name.
• Outbound HTTPS connectivity to the Rublon API and access to your LDAP, Active Directory, or RADIUS server.

1. Install IIS HTTP Server. (We recommend you install IIS through the GUI.)

2. After installing IIS, add CGI Support:

1. To do that, use Add Roles and Features in Server Manager. 
2. Follow the steps described in the guide on how to install the IIS Server. The only difference is at the Server Roles step → Expand Web Server (IIS) → Expand Web Server → Expand Application Development → Select CGI. ASP.NET 4.8 is not required. 
3. Follow the rest of the steps to complete the installation wizard.

Alternatively, run the following command in PowerShell as an administrator:

Install-WindowsFeature Web-Server, Web-CGI -IncludeManagementTools

3. Download and install the latest Microsoft Visual C++ Redistributable in the x64 version. It is required by PHP.

4. Download the PHP 8.3, VS16 x64 Non Thread Safe ZIP archive, version 8.3.36 or later, from windows.php.net and unzip the contents of the downloaded file to the desired location, e.g., C:\PHP.

5. Download the cacert.pem file and save it as C:\PHP\extras\ssl\cacert.pem. It contains Certificate Authority certificates in PEM format. Rublon Access Gateway needs this file to connect to the Rublon API.

6. Copy C:\PHP\php.ini-production to C:\PHP\php.ini. Rublon Access Gateway needs the following changes to run:

Enable the required extensions:

extension_dir = "ext"

extension=curl
extension=fileinfo
extension=gd
extension=gmp
extension=intl
extension=ldap
extension=mbstring
extension=openssl
extension=zip

Set the paths to the certificate file from step 5:

curl.cainfo = "C:\PHP\extras\ssl\cacert.pem"
openssl.cafile = "C:\PHP\extras\ssl\cacert.pem"

Configure the FastCGI and security settings:

cgi.force_redirect = 0
fastcgi.impersonate = 1
zend.assertions = -1
display_errors = Off
log_errors = On
session.upload_progress.enabled = 0

Leave cgi.fix_pathinfo at its default value of 1. Do not set it to 0. Extension names do not use the php_ prefix or the .dll suffix.

7. Verify your PHP installation in Command Prompt:

• C:\PHP\php.exe -v should show PHP 8.3, version 8.3.36 or later.
• C:\PHP\php.exe -m should list all extensions from step 6 and bcmath, which is built into PHP for Windows.

8. Register PHP in IIS:

1. Open IIS Manager, select the server node, and double-click Handler Mappings.
2. Select Add Module Mapping… and set Request path to *.php, Module to FastCgiModule, Executable to C:\PHP\php-cgi.exe, and Name to PHP.
3. Click OK and confirm that you want to create a FastCGI application.

Alternatively, you can download and install PHP Manager. In IIS Manager, double-click PHP Manager and register the new PHP version by specifying the path to php-cgi.exe. The extensions are already enabled in php.ini in step 6.

9. Restart IIS, for example by running iisreset to make your changes take effect.

10. Download the package of Rublon Access Gateway and unzip the files into the C:\inetpub directory so that your path looks as follows: C:\inetpub\rag.

11. Purchase an SSL certificate for your server (using a fully qualified domain name) from a commercial Certificate Authority (CA) or purchase a wildcard SSL certificate. Add the SSL certificate to IIS Manager (Server Certificates icon → Import).

It is also possible to generate a free certificate with Let’s Encrypt, but you will need to demonstrate control of the domain. Ensure that your certificate is renewed before it expires.

12. Create a Website for Rublon Access Gateway. Right-click the Sites submenu in IIS Manager, and choose Add Website…

13. Make the Physical path field point to the C:\inetpub\rag\public directory.

14. Select the https protocol in the Type dropdown.

15. Specify your domain Host name. 

16. Select your SSL certificate.

17. Click OK to add your website.

18. Select your site, double-click Default Document, and add index.php at the top of the list.

19. Open the Application Pools node underneath the machine node. The name of the application pool is the same as the name of your IIS site. Open Basic Settings… for this application pool and set .NET CLR version to No Managed Code.

If you would like to learn more about Application Pools, refer to this Microsoft documentation page.

20. Select your site from the pane on the left, and then double-click Authentication.

21. Right-click Anonymous Authentication and select Edit….

22. Select Application pool identity and click OK.

23. Grant the application pool Modify permissions on the Rublon Access Gateway data directories listed below. Do not grant Full control over the entire website directory.

Run PowerShell as an administrator. Replace your_application_pool_name with the actual name of your application pool:

cd C:\inetpub\rag
foreach ($d in 'config\volume','log','metadata','metadata\saml20-sp-remote','modules\rublon\public\logos','cert','tmp') {
  icacls $d /grant "IIS AppPool\your_application_pool_name:(OI)(CI)M"
}

Alternatively, grant Modify permissions in File Explorer separately for each of these directories:

Right-click the directory and select Properties.

Select the Security tab and then click Edit….

A window with permissions will open. Click Add….

Click Locations….

Select your Local Server Name (by default, Domain Name is selected) and click OK.

Type the following in the Object Names text field:

IIS AppPool\<your_application_pool_name>

Remember to replace <your_application_pool_name> with the actual name of your application pool.

Click Check Names and then click OK.

Grant Modify permissions, click OK, and then click OK again to close the Properties dialog.

24. Create C:\inetpub\rag\config\volume\env.json with the following contents:

{
  "tempdir": "C:/inetpub/rag/tmp/simplesaml",
  "cachedir": "C:/inetpub/rag/tmp/cache"
}

Rublon Access Gateway will not start on Windows without this file. If you installed Rublon Access Gateway in a different location, adjust the paths accordingly. You can also configure metadata access and trusted redirect domains in this file. Refer to Optional Settings.

25. Your Rublon Access Gateway should be configured to run on your domain name (previously defined/configured when installing IIS). To check if Rublon Access Gateway is working properly, open https://<your_domain>/config in your browser. The first page load after installation takes a few seconds because Rublon Access Gateway builds its cache.

26. The default password for the administrator panel is: 

7^aG$a51Gb.@gaSa6$)s/a

After you sign in to the Rublon Access Gateway config panel, change the password in Settings → Admin password.

27. Your installation is complete.

Linux

Rublon Access Gateway runs on Linux in two Docker containers using ready-made images for the amd64 and arm64 architectures:

Image	Purpose
ghcr.io/rublon/rublon-access-gateway:v1.4	Rublon Access Gateway with PHP-FPM 8.3.
ghcr.io/rublon/rublon-access-gateway-nginx:v1.4	nginx web server with HTTPS support.

No separate application package is required. You do not need to edit rag.conf or php.ini.

Requirements:

• a Linux distribution with Docker Engine and the Docker Compose plugin (docker compose)
• a domain name for Rublon Access Gateway
• an SSL certificate for that domain name

We recommend you install Rublon Access Gateway in your local network via Docker containers. Follow the steps below.

1. Before you start, ensure you have a domain name for your Rublon Access Gateway and a valid SSL certificate in PEM format. If you do not have a domain name, register one. If you do not have a certificate you can use, purchase an SSL certificate for your server (using a fully qualified domain name) from a commercial Certificate Authority (CA). It is also possible to generate a free certificate with Let’s Encrypt, but you will need to demonstrate control of the domain. Ensure that your certificate is renewed before it expires.

2. Create a directory for Rublon Access Gateway, e.g., /opt/rag, and a certs subdirectory inside it.

3. Copy your SSL certificate, including the certificate chain, to certs/rag.pem and your private key to certs/rag-key.pem.

4. Create /opt/rag/compose.yml with the following contents. Replace rag.example.com with your Rublon Access Gateway domain name:

name: rag
services:
  rag:
    image: ghcr.io/rublon/rublon-access-gateway:v1.4
    restart: unless-stopped
    volumes:
      - public:/var/www/rag/mac/public
      - config:/var/www/rag/mac/config/volume
      - cert:/var/www/rag/mac/cert
      - log:/var/www/rag/mac/log
  nginx:
    image: ghcr.io/rublon/rublon-access-gateway-nginx:v1.4
    restart: unless-stopped
    depends_on:
      - rag
    environment:
      - SERVER_NAME=rag.example.com
    volumes:
      - public:/var/www/rag/mac/public:ro
      - ./certs/rag.pem:/etc/ssl/certs/rag.pem:ro
      - ./certs/rag-key.pem:/etc/ssl/private/rag-key.pem:ro
    ports:
      - "443:443"
volumes:
  public:
  config:
  cert:
  log:

Things to note:

• The certificate is mounted with Read-Only rights in the nginx container at /etc/ssl/certs/rag.pem, and the private key at /etc/ssl/private/rag-key.pem.
• Rublon Access Gateway applications, settings, and logs are stored in Docker volumes. Refer to Data and Logs.

5. Save the compose.yml file.

6. Run the following commands from /opt/rag to start Docker containers:

cd /opt/rag
docker compose up -d

7. Run the following command to see the logs:

docker compose logs

8. After the first run, check if all containers have been started successfully. Run the following command to see a list of containers and their status:

docker compose ps

Ensure containers rag and nginx are up and running.

9. If you have specified your domain name as, e.g., rag.example.com, go to https://rag.example.com/config to access the administrator panel of your local Rublon Access Gateway instance.

10. The default password for the administrator panel is: 

7^aG$a51Gb.@gaSa6$)s/a

After you sign in to the Rublon Access Gateway config panel, change the password in Settings → Admin password.

11. Your installation is complete.

Data and Logs

Rublon Access Gateway stores its data in Docker volumes so that the data is preserved across container restarts and updates. With the project name rag specified in the preceding compose.yml example, the volumes are:

Volume	Contents
rag_config	Settings, administrator password, authentication sources, applications, logos, and env.json.
rag_cert	SAML signing certificate and private key.
rag_log	RAG.log.
rag_public	Web files shared with nginx. Recreated during updates.

To follow the application log:

docker compose exec rag tail -f /var/www/rag/mac/log/RAG.log

To back up the rag_config and rag_cert volumes to the current directory, for example:

docker run --rm -v rag_config:/config:ro -v rag_cert:/cert:ro -v "$PWD":/backup alpine \
  tar czf /backup/rag-backup.tgz /config /cert

For update instructions, refer to Updating Rublon Access Gateway.

Updating Rublon Access Gateway

Updating to Rublon Access Gateway 1.4

When updating from a version earlier than 1.4, install Rublon Access Gateway 1.4 alongside your existing installation, following the Windows Server or Linux instructions. Keep a backup of your existing installation and configuration. Copy the following data from the existing installation, then switch traffic to the new installation.

Windows Server

Data	Source in the Existing Installation	Destination on Windows (1.4)
Settings, administrator password, and authentication sources	config/volume/*	config\volume\. Preserve the new env.json file created in step 24 of the Windows Server installation.
Identity Provider settings	metadata/saml20-idp-hosted.json	metadata\
Applications	metadata/saml20-sp-remote/*	metadata\saml20-sp-remote\
Application logos	modules/rublon/www/logos/*	modules\rublon\public\logos\
Signing certificate and private key, if replaced in Settings → Security	cert/*	cert\

Destination paths in the table are relative to the new Rublon Access Gateway installation directory, e.g., C:\inetpub\rag.

Linux

The following commands show how to migrate an existing Rublon Access Gateway 1.3 installation to version 1.4. Replace /path/to/1.3 with the absolute path to your existing installation directory. The commands assume that the old container is named rag and that the new installation directory is /opt/rag.

First, export the Identity Provider settings while the old container is still running. Export the signing certificate and private key only if you previously replaced them in Settings → Security:

cd /path/to/1.3
docker cp rag:/var/www/rag/mac/metadata/saml20-idp-hosted.json apps/

# Only if the signing certificate and private key were replaced:
docker cp rag:/var/www/rag/mac/cert ./cert-1.3

After preparing the new version 1.4 containers according to the Linux installation instructions, copy the exported data into the new installation. Run the certificate import command only if you exported a custom signing certificate and private key in the preceding step:

cd /opt/rag
docker compose cp /path/to/1.3/apps/. rag:/var/www/rag/mac/config/volume/

# Only if a custom signing certificate and private key were exported:
docker compose cp /path/to/1.3/cert-1.3/. rag:/var/www/rag/mac/cert/

docker compose restart rag

• Keep the same domain name and signing certificate so that connected applications do not require changes.
• The saved administrator password and LDAP/RADIUS settings from the previous version are accepted without changes.
• Users must sign in again after the update because existing sessions are not migrated.

Updating Docker Images

For an installation that uses the Docker Compose configuration described in this documentation, back up the rag_config and rag_cert volumes. Then edit compose.yml and set the image values to match the installation instructions: ghcr.io/rublon/rublon-access-gateway:v1.4 for the rag service and ghcr.io/rublon/rublon-access-gateway-nginx:v1.4 for the nginx service. Run the following commands from the directory containing compose.yml:

docker compose pull
docker compose down
docker volume rm rag_public
docker compose up -d

Removing rag_public ensures that nginx serves the web files from the new version. Docker populates a volume with the image contents only when the volume is created. The other volumes contain Rublon Access Gateway data and must be preserved. If you use a different Compose project name, replace rag_public with the corresponding public volume name.

Configuration

After a successful installation, open the configuration page of the Rublon Access Gateway in your browser. If the address of your Rublon Access Gateway is example.com, go to example.com/config. The remainder of this documentation will walk you through the process of Rublon Access Gateway configuration. You will learn about all configuration options and all features of Rublon Access Gateway.

Settings tab

1. Sign in to the Rublon Access Gateway administrator panel. 

2. Go to the Settings tab and choose the Rublon subtab.

3. Set the required data and save all changes by clicking the SAVE ALL SETTINGS button. Refer to the following image and table to learn how to fill the form.

Company token	Required. Enter the company token from the Rublon Admin Console (Settings tab → API section).
Admin e-mail	Required. Enter the email address of the owner of the organization created in the Rublon Admin Console.
Rublon Access Gateway URL address	Optional. You can set a static URL for the Rublon Access Gateway application. It is used for the SAML communication between Rublon Access Gateway and your application. You should set this address when, for example, your domain has an alias(es) or is available on the HTTP and HTTPS protocols. We recommend you set the Rublon Access Gateway URL address to a static HTTPS link because it is better to force SSL everywhere for security reasons.
Fail mode	Required. Set the behavior of Rublon Access Gateway in case the connection to the Rublon API server cannot be established. Bypass skips two-factor authentication, while Deny denies access. Default: Bypass.

4. Go to the SSO Portal subtab. Set the System Token and Secret Key of your Rublon Access Gateway application from the Rublon Admin Console. This step is required if you would like to use the Rublon SSO Portal.

5. Go to the Security subtab. This section provides an option to import your own certificate file with a private key for the Identity Provider. It is recommended for security reasons. The private key is used for signing SAML requests and responses. The certificate allows applications to verify these signatures. The certificate must have the extension *.crt, and the private key must have the extension *.pem. Each file must be no larger than 10 KB. You can use the SSL certificate you have used for your web server in the Installation section.

After replacing the signing certificate, update it in all connected applications so that they can verify Rublon Access Gateway signatures. On Linux, the signing certificate and private key are stored in the rag_cert volume.

6. Go to the SAML session subtab. This section provides an option to change the default SAML session duration (in seconds). By default, the SAML session is valid for 8 hours (28800 seconds). SAML session is initialized during the authentication process of your applications. It is recommended to configure the application so that after logging out, the SAML session will also be disconnected. If you log out without disconnecting your SAML session, the next login will use the same session.

7. Go to the Admin password subtab. This subtab provides an option to change the default administrator password for your Rublon Access Gateway. For security reasons, it is recommended to change the default password right after the first login. Anyone who has access to the domain and knows the specified password will be able to access the administration panel.

Enter the current password, then enter the new password twice. The new password must contain at least eight characters, including a lowercase letter, an uppercase letter, a special character, and a digit. The password is changed only when you enter a new password. Saving other settings does not change it.

8. Go to the Logging subtab. Check Verbose logging, which provides more detailed log entries in case some issues occur in the Rublon Access Gateway application.

If you would like to read the log file, please follow the steps below:

• On Windows, open C:\inetpub\rag\log\RAG.log in any text editor.
• On Linux, use the command in Data and Logs.

Optional Settings

Use env.json to configure optional metadata access and trusted redirect domains:

Setting	Description
admin.protectmetadata	By default, metadata is available only to a signed-in administrator in the Applications tab. Set this option to false to allow applications to retrieve metadata from the Rublon Access Gateway metadata URL without an administrator signing in.
trusted.url.domains	A list of hosts to which Rublon Access Gateway can redirect. A configured list replaces the built-in list. Include core.rublon.net as well as any other required hosts.

On Windows, add the optional settings to C:\inetpub\rag\config\volume\env.json, preserving the tempdir and cachedir paths from step 24 of the installation.

On Linux, create an env.json file with the optional settings. Do not include the Windows tempdir and cachedir paths. Copy the file into the container and restart Rublon Access Gateway. If an env.json file already exists, preserve its existing settings when preparing the updated file:

docker compose cp env.json rag:/var/www/rag/mac/config/volume/env.json
docker compose restart rag

Authentication Source tab

The Authentication Source tab allows you to select the active source type and update source type configuration data. Only one source type can be active at a time. Depending on the source that end-users will use for primary authentication, select and configure the appropriate source type. Three available source types are LDAP (e.g., OpenLDAP), Microsoft Active Directory, and RADIUS.

Authentication Source Configuration – LDAP

1. Open the Authentication Source tab and select OpenLDAP in the Source type dropdown. Click SET ACTIVE to set OpenLDAP as the active source type.

2. Select the OpenLDAP subtab. Fill in the form with the appropriate parameters. Please refer to the following image and table.

Server address	The hostname of your OpenLDAP server. You can also specify an LDAPS URI.
Server port	The port of your server
Search base	The DN that will be used as a base for the search. Enter one per line.
Search attributes	The attributes the username should match against, e.g., sAMAccountName, mail.
Search filter	Specify criteria used to identify entries in search requests. We recommend you create an Active Directory Security Group and add all the users required to use Rublon MFA to that group. Default: cn=* Example for Search filter using Security Group: (&(objectclass=person)(memberOf=CN=Group,CN=Users,DC=domain,DC=com)) in which: objectclass=person – specifies that the Search filter should search only for users memberOf – forces extraction and use of the members of the specified group only CN=Group,CN=Users,DC=domain,DC=com – the group base DN (group location in Active Directory)
Search username	The username of an account that has permission to read from your OpenLDAP.
Search password	The password corresponding to the search username specified above.
Attributes	Specify attributes to retrieve from the LDAP server. Keep camelCase syntax. Don’t insert spaces. Used to narrow down the list of user attributes. If left empty, then when logging in to an integrated application, Rublon Access Gateway will return all fields set for this particular user. If, for example, cn,mail are the defined attributes, then when logging in, Rublon Access Gateway will return only these two parameters.
Attributes mapping	Match attributes, which will be sent via REST API to identify users. Stick to the camelCase syntax and do not use spaces, e.g., givenName, department, homeDirectory.

3. Click SAVE to update your LDAP configuration.

Authentication Source Testing – LDAP

You can test authentication with LDAP as the authentication source.

1. Select the Authentication Source tab, and ensure OpenLDAP is the chosen source in the Source type dropdown. If not, select OpenLDAP as the Source type, and click SET ACTIVE to save the change.

2. Switch to the Users tab to see the user list. In case of any errors, double-check your LDAP configuration in the Authentication Source tab.

Authentication Source Configuration – Microsoft Active Directory

1. Open the Authentication Source tab, and select Microsoft Active Directory in the Source type dropdown. Click SET ACTIVE to set Microsoft Active Directory as the active source type.

2. Select the Microsoft Active Directory subtab. Fill in the form with the appropriate parameters. Please refer to the following image and table.

Server address	The hostname of your Microsoft Active Directory. You can also specify an LDAPS URI.
Server port	The port of your Microsoft Active Directory.
Search base	The DN that will be used as a base for the search. Enter one per line.
Search attributes	The attributes the username should match against, e.g., sAMAccountName, mail.
Search filter	Specify criteria used to identify entries in search requests. We recommend you create an Active Directory Security Group and add all the users required to use Rublon MFA to that group. Default: cn=* Example for Search filter using Security Group: (&(objectclass=person)(memberOf=CN=Group,CN=Users,DC=domain,DC=com)) in which: objectclass=person – specifies that the Search filter should search only for users memberOf – forces extraction and use of the members of the specified group only CN=Group,CN=Users,DC=domain,DC=com – the group base DN (group location in Active Directory)
Search username	The username of an account that has the permission to read from your Microsoft Active Directory.
Search password	The password corresponding to the search username specified above.
Attributes	Specify attributes to retrieve from the Active Directory server. Keep camelCase syntax, don’t insert spaces. Used to narrow down the list of user attributes. If left empty, then when logging in to an integrated application, Rublon Access Gateway will return all fields set for this particular user. If, for example, cn,mail are the defined attributes, then when logging in, Rublon Access Gateway will return only these two parameters.
Attributes mapping	Match attributes, which will be sent via REST API to identify users. Stick to the camelCase syntax and do not use spaces, e.g., givenName, department, homeDirectory.

3. Click SAVE to update your Microsoft Active Directory configuration.

Authentication Source Testing – Microsoft Active Directory

You can test authentication with Microsoft Active Directory as the authentication source.

1. Select the Authentication Source tab, and ensure Microsoft Active Directory is the chosen source in the Source type dropdown. If not, select Microsoft Active Directory as the Source type, and click SET ACTIVE to save the change.

2. Switch to the Users tab to see the user list. In case of any errors, double-check your Microsoft Active Directory configuration in the Authentication Source tab.

Authentication Source Configuration – RADIUS

1. Open the Authentication Source tab, and select RADIUS in the Source type dropdown. Click SET ACTIVE to set RADIUS as the active source type.

2. Select the RADIUS subtab. Fill in the form with the appropriate parameters. Please refer to the following image and table.

Servers	The list of RADIUS servers to use. Click the green + (plus sign) button to open a form that asks you to specify the address and port of your RADIUS server, as well as the RADIUS Secret. Clicking the ADD SERVER button adds the server to the Servers list.
Timeout	Time (in seconds) after which connection attempts to the RADIUS server will be aborted.
Retries	This field remains in the form but is not used in Rublon Access Gateway 1.4. Each server in the list is contacted once.
NAS identifier	The NAS-Identifier that should be set in Access-Request packets.
Username attribute	The attribute name in which the username should be stored.
Attribute vendor	The vendor for the RADIUS attributes you want.
Attribute vendor type	The vendor attribute-type of the attribute, which contains the attributes for the user
Attributes mapping	Match attributes that will be sent via REST API to identify users. Stick to the camelCase syntax and do not use spaces, e.g., givenName, department, homeDirectory.

3. Click SAVE to update your RADIUS configuration.

NOTE: The Attribute vendor and Attribute vendor type fields are required if you declared returning of attribute 26 (Vendor-Specific) in the RADIUS configuration, and the dictionary (/etc/raddb/dictionary) creates a custom vendor to return your own attribute. For example:

10000 is the vendor ID, and 1 is the ID of your own attribute.

In addition to the above change, you should also modify /etc/raddb/sites-enabled/default. It is possible only after obtaining administrative privileges (sudo command). This change concerns additionally returning the email address to the RADIUS server after successful authentication. By default, the server returns only the User-Name field, which is not sufficient for Rublon MFA authentication.

Remember to restart the service after both changes. Use the following command:

systemctl restart radiusd

It’s also worth checking if the service is up properly:

systemctl status radiusd

The RADIUS module is enabled by default. You do not need to rename default-disable to default-enable.

Authentication Source Testing – RADIUS

You can test the authentication with RADIUS as the authentication source.

1. Select the Authentication Source tab, and ensure RADIUS is the chosen source in the Source type dropdown. If not, select RADIUS as the Source type, and click SET ACTIVE to save the changes.

2. The Users tab is inactive for the RADIUS authentication source because it’s not possible to get the list of users without accessing the database. Such access to the database would be possible if the client made it public, which is impossible for security reasons.

Applications tab

After you have configured the settings and your authentication source, you can add your application to Rublon Access Gateway – either manually or by importing application metadata.

The Applications tab allows you to download XML metadata and the Rublon Access Gateway certificate, display all applications, and add or remove an application.

Adding an Application by Importing an XML File

1. Sign in to your Rublon Access Gateway instance, open the Applications tab, and select the Import application metadata subtab.

2. Enter the name of your application, select your XML file, and click Upload.

3. Your entry will appear on the applications list under the All applications subtab.

Manually Adding an Application

If your application does not support exporting to an XML file, you can also enter the metadata values manually. Refer to the following image and table to learn more.

Application name	Name of the application. It has to be unique.
Entity ID	The unique identifier of the Service Provider. This value has to be exactly the same as the one you set on the Service Provider side.
Assertion Consumer Service	The service provider endpoint that receives and processes SAML assertions.
Single Logout Service	A URL provided by the service provider to allow for IdP-initiated logouts.
Relay State	The page the user should be redirected to after an IdP-initiated SSO. Only a few integrations require setting this parameter. Refer to the documentation of your integration and look for information about Relay State. If there is no specific information regarding this field, leave it empty.
NameID format	Defines the NameID format sent to the Service Provider.
NameID attribute	Attribute that identifies the user to the Service Provider (sent as NameID).
Send Attributes	Defines whether to send only the NameID attribute or all attributes defined in Attributes under Authentication Source → Microsoft Active Directory or Authentication Source → OpenLDAP, depending on your active authentication source. In case RADIUS is your active authentication source, all attributes are sent regardless of this option.
Signature algorithm	Signature algorithm used in the SAML assertion and response.
Validate AuthnRequest	Check this checkbox if you would like Rublon Access Gateway to require signatures on authentication requests.
Sign response	Check this checkbox if you would like Rublon Access Gateway to cryptographically sign responses for verification by your Service Provider.
Sign assertion	Check this checkbox if you would like Rublon Access Gateway to cryptographically sign assertions for verification by your Service Provider.
Certificate for signing	Select the certificate file, which will be used to sign SAML Responses and Requests.
Certificate for encryption	Select the certificate file, which will be used to encrypt SAML Responses.
Map attributes	Specify one or more IdP attributes whose names can be optionally changed in the SAML response. IdP Attribute – one of the attributes defined in the Attributes field of your authentication source (LDAP or Active Directory). SAML Response Attribute – the name of the attribute returned in the SAML response Used only if All attributes is selected in Send Attributes.

Removing an Application

1. Go to the Applications tab and select the All applications subtab.

2. Find the application you wish to remove and click the REMOVE button.

Application Logos

In the applications list, click Change logo to set the application logo displayed in the SSO Portal. The logo must be a PNG, JPG, or SVG file no larger than 500 KB. Rublon Access Gateway checks the file type based on its contents and rejects SVG files that contain scripts.

Downloading Rublon Access Gateway Metadata

1. Sign in to your Rublon Access Gateway instance using the administrator password. Open the Applications tab.

2. Click the Download XML metadata button at the bottom of the page to get your metadata. 

3. You can also download the certificate, which Rublon Access Gateway will use to sign SAML messages.

4. If your application doesn’t support XML importing, you can also manually copy the metadata values.

5. Verify all links are in HTTPS. If not, set a static Rublon Access Gateway URL address in Settings → Rublon.

By default, metadata is available only to a signed-in administrator in the Applications tab. If an application needs to retrieve metadata directly from the Rublon Access Gateway metadata URL, set "admin.protectmetadata": false in env.json. Refer to Optional Settings.

Users Tab

The Users tab shows a list of users with all attributes fetched from the defined authentication source. Users tab is not supported for the RADIUS authentication source because, in order to fetch the full list, Rublon Access Gateway would need to have direct access to the RADIUS database, which is impossible due to security risks.

SSO Portal

Refer to the Rublon SSO Portal documentation to learn how to configure and use the Rublon SSO Portal.

Useful links

1. Installation of URL Rewrite module to force HTTPS on a website (How to redirect HTTP to HTTPS in IIS section):
https://miketabor.com/how-to-install-a-lets-encrypt-ssl-cert-on-microsoft-iis

2. Introduction to Application Pool Identities:
https://docs.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities

3. How to enable detailed IIS errors:
https://mid.as/kb/00211/how-to-enable-detailed-iis-errors

Troubleshooting

If you encounter any issues with your Rublon MFA integration, please contact Rublon Support.

To help us troubleshoot your issue faster, you can do the following:

1. Send us your SAML queries.

2. Enable detailed IIS errors and send us a detailed description of the issue.

1. How to Get the SAML Queries

If you experience issues with a particular cloud application, sending us your SAML queries can help us troubleshoot your issue.

To get the SAML queries:

1. Install the SAML Chrome Panel extension on Google Chrome.

2. Open DevTools.

3. Initialize the log-in process to your application, e.g., via the Rublon SSO Portal.

4. Go all the way up to the point where the log-in attempt fails.

5. Export the SAML queries from the browser’s SAML tab.

2. How to Enable Detailed IIS Errors

If you are getting an HTTP error on your IIS, such as 404, you can force IIS to show a more verbose description of the issue: <HostName> → IIS → Error Pages → Edit Feature Settings →  Detailed errors.

Refer to link number 3 in Useful Links for more detailed instructions.

Make sure to send us the verbose version of your IIS error.

Solutions to Known IIS Errors

If you are getting a 404.15 – Not Found error:

1. In IIS, open the Configuration Editor.
2. Change the value for the parameter configuration/system.webServer/security/requestFiltering/requestLimits@maxQueryString to 10000.

Unable to Create the Cache Directory

If Rublon Access Gateway reports Unable to create the "cache" directory (...) on Windows:

• Check the tempdir and cachedir paths in C:\inetpub\rag\config\volume\env.json, as described in step 24 of the Windows Server installation.
• Ensure that the application pool has Modify permissions on the data directories listed in step 23.
• If the paths and permissions are correct, ensure that Anonymous Authentication uses Application pool identity, as described in steps 20–22. PHP must not run as the anonymous IUSR account.

The Page Takes a Long Time to Load and Returns an Error

Check the application log for details. On Windows, incorrect cache paths or insufficient permissions are common causes. Follow the checks in Unable to Create the Cache Directory above. For log locations and commands, refer to the Logging subtab instructions in the Settings tab.

Error While Adding an Application

If you see Error while adding application. and the log contains SSL certificate problem, check that the Certificate Authority bundle exists and that curl.cainfo and openssl.cafile point to it, as described in steps 5–6 of the Windows Server installation. Then restart IIS:

iisreset

Changes to php.ini Do Not Take Effect

PHP processes may still be using the previous settings. Restart IIS to apply the changes:

iisreset

Linux Displays Pages from the Previous Version After an Update

The rag_public volume may still contain web files from the previous version. Follow Updating Docker Images to recreate this volume while preserving the data volumes.

Related Posts

Rublon Access Gateway – Release Notes

Rublon Access Gateway – Integrations

Rublon Access Gateway – Download

Rublon SSO Portal – Documentation