topic Re: GlobalProtect MFA With Radius and Email in GlobalProtect Discussions

GlobalProtect MFA With Radius and Email

wocomike — Wed, 09 Jun 2021 19:31:35 GMT

Has anyone setup a free MFA with GlobalProtect? I was thinking something along the lines of using a FreeRadius server to generate an email code to the user. It has to be doable... FreeRadius, connected to LDAP/AD, pulls the email address and sends a code, which the user appends to their password on the GlobalProtect Client.

Doable? Or wishful thinking?

Re: GlobalProtect MFA With Radius and Email

robp — Wed, 09 Jun 2021 19:59:05 GMT

DUO has a freeradius client for linux that's easily setup for MFA. it's free for up to 10 users and readily works with GlobalProtect (it's just a RADIUS auth to GP).

Re: GlobalProtect MFA With Radius and Email

wocomike — Wed, 09 Jun 2021 20:07:45 GMT

Thanks Robp. Unfortunately I need this for hundreds (possibly more) users. I just ran across LinOTP. Anyone out there have experience with it?

Re: GlobalProtect MFA With Radius and Email

Mick_Ball — Thu, 10 Jun 2021 12:50:34 GMT

not used it myself but is it actually a random passcode generator or does it just act as a man in the middle for tokens and users groups/id's. still reading as may give it a go myself...

Re: GlobalProtect MFA With Radius and Email

cornelinux — Sat, 12 Jun 2021 10:14:00 GMT

What kind of 2nd factors do you want to use and where are your users located?

Note, that certain authentication mechanism will not work through RADIUS like WebAuthn, PUSH tokens in push mode...

However, HOTP, TOTP, Yubikeys (in OTP mode), SMS, Email... can technically work.

An important aspect is the enrollment process to get the 2nd factors to the users in a secure manner. You should put some thoughts into that.

LinOTP is rather cool but imho it is missing a dust off for a couple of years. You might want to take a look a the fork privacyIDEA, <disclaimer>which I started 7 years ago.</disclaimer> Also works well with paloalto and similar solutions.

It also allows you to automate processes - very interesting for the e.g. the enrollment, token replacement or whatever you can think of.

Re: GlobalProtect MFA With Radius and Email

wocomike — Sat, 12 Jun 2021 21:22:10 GMT

This is a godsend!!! Thank you Cornelinux, and thank you for your work on privacyIDEA. This will be perfect!

I want to do a blend of Google Authenticator and email codes.

Re: GlobalProtect MFA With Radius and Email

Proton951 — Mon, 12 May 2025 21:50:13 GMT

Hello, A bit too late to this discussion maybe. But Im trying to implement exactly what you were mentioning here.
Do you mind sharing some insights on what was the final solution that worked for you?