Rublon Authentication Proxy (v1.2.2)

Last updated on April 23, 2024

Overview

Rublon Authentication Proxy is an on-premise RADIUS proxy server allowing Rublon integration with any service that uses RADIUS as an authentication source. Currently supported system is Linux (tested on CentOS, Ubuntu). Available authentication methods are email and push.

Before you start

You have to set up an external Identity Provider (IdP) where user identities are managed.

The list of tested and verified Identity Providers:

• OpenLDAP 
• FreeIPA
• FreeRADIUS (standalone, full version)
• Active Directory

We refer to Identity Provider as authentication source throughout Rublon documentation.

If you are using a RADIUS server as your authentication source, you need to configure your RADIUS server first.

Every user who wants to log in using Rublon Authentication Proxy must have their email address added to their Active Directory / RADIUS account. Rublon needs the user’s email address to perform 2FA. No user database synchronization is required thanks to this.

How does Rublon Authentication Proxy work?

After deploying Rublon Authentication Proxy as an on-premise service and setting it up as a RADIUS authentication source in chosen integration apps (e.g. OpenVPN), Rublon Authentication Proxy listens for any incoming authentication requests. After receiving one, it starts 1FA against the chosen authentication source set in Rublon Authentication Proxy’s configuration (RADIUS or LDAP). If it proceeds, 2FA is being started. Upon successful 2FA, Rublon Authentication Proxy sends the Access Accept response back, which finishes the authentication process. The following diagram shows a simplified, successful communication process:

Updating Rublon Authentication Proxy

1. Stop rublon service:
   systemctl stop rublon.service
   or
   service rublon stop
2. Download the latest rublonauthproxy package and unpack it.
3. Replace the lib directory inside the previously deployed rublonauthproxy folder.
4. Make sure the rublonauthproxy/lib/rublonauthproxy file has proper permissions:
   chmod 775 rublonauthproxy/lib/rublonauthproxy
5. Run the service:
   systemctl start rublon.service
   or
   service rublon start

Uninstallation

1. Stop rublon service:
   systemctl stop rublon.service
   or
   service rublon stop
2. Remove rublon.service:
   rm -f /lib/systemd/system/rublon.service
3. Remove the rublonauthproxy directory:
   rm -rf rublonauthproxy

Configuration

The config.json configuration file must be located inside the rublonauthproxy/config directory. Use a proper JSON convention. All property names must be uppercase.

Example configuration templates are the easiest way to start a configuration. You can find them at the bottom of this post and they are also located inside the rublonauthproxy/config directory after unpacking Rublon Authentication Proxy.

Note that even though LDAP is set as an authentication source, it still requires RADIUS secret.

If you would like to use RADIUS as an authentication source, you have to configure your RADIUS server first. Instruction can be found here.

To obtain Rublon token and secret, sign in to Rublon Admin Console and add a new application as Authentication Proxy.

Sections

LDAP

RADIUS

RUBLON

Append Mode

AppendMode is a feature available in Rublon Authentication Proxy when using “standard” mode. It allows you to choose your authentication method by appending specific values to your password followed by the append mode separator chosen by admin. 

AppendMode works only in “standard” mode. You can enable it by adding the following options to your configuration file under the “PROXY” section:

“USE_APPEND_MODE”: true
“APPEND_MODE_SEPARATOR”: “,”

By default the separator is set to “,” (comma).

How does it work?

After enabling AppendMode inside the configuration file, you can append the following values to your password after “APPEND_MODE_SEPARATOR”:

• “push”
• “email”
• “123456” – the TOTP code; must be exactly 6 characters long with no spaces in-between

If the appended value is not recognized, the entire provided string is treated as a password and the predefined authentication method is used.

Note that AppendMode is case sensitive. Values like “Push”, “EMAIL”, “pUsH” do not work.

Examples

Let’s assume that your password is: “pancakes123”, and the separator is not set in the configuration file, so its value is by default set to “,” (comma).

If you would like to choose push as the authentication method, type:

    pancakes123,push

If you would like to choose email as the authentication method, type:

    pancakes123,email

If you would like to choose totp as the authentication method, type:

    pancakes123,123456

Where 123456 is the TOTP code from the mobile app.

Non-PAP protocol for RADIUS communication

By default, Rublon Authentication Proxy uses only the PAP protocol to authenticate users. This means that all systems trying to use other protocols (like CHAPv1, EAP-MS-CHAPv2) to communicate with Rublon Authentication Proxy will not work. However, it is possible to configure Rublon Authentication Proxy to proxy all non-PAP requests to the RADIUS server.

To do so, add:
    “PROXY_REQUESTS”: true

To your configuration file, under the “RADIUS” section. Rublon 2FA will be performed upon receiving the AccessAccept response packet from the RADIUS server.

If the RADIUS server was configured to accept these protocols, protocols such as CHAPv1 or MS-CHAPv2 (even EAP-MS-CHAPv2) should work from now on.

Refer to the following flowchart, which portrays how proxying works.

Configuration examples

LDAP as authentication source

{
"PROXY": {
"IP": "172.16.1.100",
"PORT": 1812,
"AUTH_SOURCE": "ldap"
},
"LDAP": {
"HOST": "172.16.3.100",
"PORT": 389,
"SEARCH_DN": "dc=test,dc=local",
"ACCESS_USER_DN": "cn=Administrator,cn=Users,dc=test,dc=local",
"ACCESS_USER_PASSWORD": "XXXXXXXXXXXX"
},
"RADIUS": {
"SECRET": "secret"
},
"RUBLON": {
"API_HOST": "https://core.rublon.net",
"TOKEN": "token",
"SECRET": "secret",
"AUTH_METHOD": "push"
}
}

Please note that even though you are using LDAP as an authentication source, you still need to provide RADIUS secret! That’s because Rublon Authentication Proxy works as if it were a RADIUS server on its own.

RADIUS as authentication source

{
"PROXY": {
"IP": "172.16.0.100",
"PORT": 1812,
"AUTH_SOURCE": "radius"
},
"RADIUS": {
"SERVER_IP": "172.16.3.100",
"PORT": 1812,
"SECRET": “secret”
},
"RUBLON": {
"API_HOST": "https://core.rublon.net",
"TOKEN": "token",
"SECRET": "secret",
"AUTH_METHOD": "email"
}
}

Running multiple instances

To run multiple instances, copy the rublonauthproxy directory and the rublon.service file and make sure both instances listen on a different port. You will have to edit the copied rublon.service file so that the file points to a valid location. After completing these steps, run the new service.

1. Copy the rublonauthproxy directory:

cp -r rublonauthproxy rublonauthproxy2

2. Edit the config.json file inside the rublonauthproxy2 directory.

3. Copy rublon.service:

cp /lib/systemd/system/rublon.service /lib/systemd/system/rublon2.service

4. Edit rublon2.service:

1. Change the start command:
   
   ExecStart=/home/testuser/rublonauthproxy/lib/rublonauthproxy start
   
   to
   
   ExecStart=/home/testuser/rublonauthproxy2/lib/rublonauthproxy start 2
   
   Note the “2” after “start”
   
   
2. Change the stop command:
   
   ExecStop=/home/testuser/rublonauthproxy/lib/rublonauthproxy stop
   
   to
   
   ExecStop=/home/testuser/rublonauthproxy2/lib/rublonauthproxy stop 2

5. Reload the services:

systemctl daemon-reload

6. Run the service:

service rublon2 start

Troubleshooting

Set DEBUG option within your configuration file to true and check your rublonauthproxy.log file located inside the rublonauthproxy/logs directory. Information contained there should in most cases be enough to troubleshoot issues related to Rublon Authentication Proxy. 

Note that most issues occur due to incorrect configuration.

If you encounter any issues with your Rublon integration, please contact Rublon Support.

Related Posts

Rublon Authentication Proxy – Release Notes

Preparing RADIUS server for Rublon Authentication Proxy