2FA and certificate

chens — Fri, 01 Dec 2023 20:05:21 GMT

Hello friends.

For my workers, I am using 2FA (AD+DUO) as the authentication process.

I would like to add additional to the 2FA authentication, by enforcing checking the existence of a client certificate.

My goal is to eliminate using GP from laptops that don't have my PFX installed. (i will install them manually).

I want the cert to be an additional phase.

I don't want to use HIP because i dont have GP license and using the default GP profiles.

Is it possible?

Re: 2FA and certificate

TomYoung — Sat, 02 Dec 2023 01:59:03 GMT

Yes, it is possible. The only thing you need to do to configure GP client certificate authentication AND username/password/MFA is as follows:

Install the certificate on the client (step 4 in the link below). It could be unique for each client or the same.
Create a certificate profile (step 5) and select it on the bottom of the Authentication tab of the portal and/or gateway.
Make sure the Client Authentication configuration has "No (User Credentials AND Client Certificate Required)" selected for "Allow Authentication with User Credentials OR Client Certificate."

That's it!

Thanks,

Tom