Multi-Factor Authentication (2FA/MFA) for Stormshield SSL VPN – LDAP(S)

Last updated on July 1, 2026

Overview of MFA for Stormshield SSL VPN using LDAP(S)

This documentation describes how to integrate Rublon MFA with Stormshield SSL VPN using the LDAP(S) protocol to enable multi-factor authentication for VPN connections.

Enable Entra ID logins to Stormshield SSL VPN using Rublon MFA

If Stormshield SSL VPN authenticates users through LDAP or RADIUS, you can use Rublon Authentication Proxy to validate primary credentials against Microsoft Entra ID and then enforce Rublon MFA. This allows users to sign in to Stormshield SSL VPN with Microsoft Entra ID credentials, even when Stormshield SSL VPN does not support Microsoft Entra ID, SAML, OAuth 2.0, or OpenID Connect natively.

See how to authenticate LDAP and RADIUS with Microsoft Entra ID credentials and MFA, or explore the related use case: Microsoft Entra ID logins for LDAP and RADIUS applications with MFA.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
FIDO	–	N/A
Passcode	✔	N/A
SMS Passcode	–	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	–	N/A
Email Link	✔	N/A
YubiKey OTP	✔	N/A
RFID	–	N/A

Before You Start Configuring MFA for Stormshield SSL VPN using LDAP(S)

Before configuring Rublon MFA for Stormshield VPN:

• Ensure you have prepared all required components.
• Create an application in the Rublon Admin Console.
• Install the Rublon Authenticator mobile app.

Required Components

1. User Identity Provider (IdP) – You need an external Identity Provider, such as Microsoft Active Directory, OpenLDAP, or FreeIPA.

2. Rublon Authentication Proxy – Install the Rublon Authentication Proxy if you have not already.

3. Stormshield  – Properly installed and configured firewall.

Create an Application in the Rublon Admin Console

1. Sign up for the Rublon Admin Console. Here’s how.

2. In the Rublon Admin Console, go to the Applications tab and click Add Application. 

3. Enter a name for your application (e.g., Stormshield VPN) and then set the type to Rublon Authentication Proxy.

4. Click Save to add the new application in the Rublon Admin Console.

5. Copy and save the values of the System Token and Secret Key. You are going to need these values later.

Install Rublon Authenticator

All end-users must install the Rublon Authenticator mobile app. So, as a person configuring MFA for Stormshield VPN, we highly recommend you install the Rublon Authenticator mobile app, too. Thanks to that, you will be able to test MFA for Stormshield via Mobile Push.

Download the Rublon Authenticator for:

• Android
• iOS
• HarmonyOS

Configuring Multi-Factor Authentication (MFA) for Stormshield SSL VPN using LDAP(S)

Follow the following instructions to set up MFA for Stormshield SSL VPN using the LDAP(S) protocol.

1. From the Stormshield Network Security (SNS) administrator console, select the Configuration tab. Then, go to Users → Directories configuration.

2. Click Add directory. A new window will open.

3. Select Connect to an External LDAP directory and click Next.

4. Fill in the fields and click Finish. Refer to the following image and table.

Domain name	The name of the domain.
Server	The Rublon Authentication Proxy server. To create it, click the + (plus) sign. You must fill in the following fields:Object name: the name for your Rublon Authentication Proxy server, e.g., RAPIPv4 address: the IP address of your Rublon Authentication Proxy server
Port	ldap
Root domain (Base DN)	The Base DN of your domain.
Read-only access	Unchecked.
Anonymous connection	Unchecked.
ID	The cn of the account that will authenticate to LDAP. Note: Unlike other integrations where the user is specified in full LDAP CN notation (e.g., Cn=rublonadmin,ou=Rublon,dc=rublondemo,dc=local), Stormshield handles it differently. In this case, you only need to provide half of the CN without adding the domain. So, for the example above, you would enter: Cn=rublonadmin,ou=Rublon.
Password	The password to the account.

5. After you add the LDAP server, you will see it on the list of directories with its configuration on the right.

6. You can now test your LDAP server configuration. Go to Users → Users and Groups, and select Users from the Filter dropdown. If after you do this, you see the list of your Active Directory users, this means your LDAP server configuration is correct.

7. You now need to add LDAP as an available method. Go to Authentication → Available Methods and select Add a method → LDAP.

8. Congratulations. You have successfully configured Rublon MFA for Stormshield VPN using LDAP. You can now test MFA.

Testing Multi-Factor Authentication (MFA) for Stormshield SSL VPN Integrated Via LDAP(S)

This example portrays logging in to Stormshield VPN via the Stormshield SSL VPN Client. Mobile Push has been set as the second factor in Rublon Authentication Proxy configuration (AUTH_METHOD was set to push).

1. Start the Stormshield SSL VPN Client, e.g., right-click the app in the tray and select Start VPN.

2. Provide your Firewall address, Username, and Password, and click OK.

3. Rublon MFA will send a Mobile Push authentication request to your phone. Tap APPROVE.

4. You will be connected to the VPN.

Troubleshooting of MFA for Stormshield SSL VPN using LDAP(S)

If you encounter any issues with your Rublon MFA integration, contact Rublon Support.

Related Posts

Rublon Authentication Proxy

Rublon Authentication Proxy – Integrations