Always On VPN with Prelogon then Switch to SSO? DUO and ADFS involved.

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Always On VPN with Prelogon then Switch to SSO? DUO and ADFS involved.

L4 Transporter

Greetings all.


I'm having a time trying to configure this and could use some pointers where I may be going wrong.  Here is the environment:


  • Single portal already configured using ADFS (ADFS is also already set up with DUO MFA) with agent configurations based on AD security groups
  • Multiple gateways already configured based on AD security groups
  • Windows 10 laptop domain joined but also with a DUO MFA prompt at Windows login
  • I've set up two portal agent configs, one for the Always On VPN security group and the other for prelogon... auth override cookies have been configured.  Prelogon tunnel rename timeout is currently set to -1.  The user group based one is set to use SSO along with some other things like requiring a password to disconnect/uninstall.
  • Always on gateway has been configured with same auth override cookie config and also uses ADFS auth just like the portal.  I had multiple agent configs (one for prelogon and one for the user security group) with different IP addressing but I've changed this to a single "any" users config for now for testing and simplicity
  • I have an AD generated certificate for the PC generated and installed and I believe that part is working for prelogon sign in
  • Split tunneling is disabled on the gateway
  • AD GPO has mapped drives that we want to successfully map at Windows login so the tunnel being established still at that point is important


The behavior I'm seeing:

  • Prelogon seems to work as I see GP logs on the firewall and I can see the tunnel established on the client
  • During sign in, the DUO prompt appears and allows me to do the MFA.  Once that's done, Windows continues to sign in and shows the username
  • Once signed in, the tunnel is still established, however, it is for prelogon user still and never seems to switch to the windows/AD user.  GP logs on the firewall continue to show prelogon as does the GP client if opened on the laptop.  After opening the GP client (and not before), the ADFS prompt appears for the user to sign in.  In can be ignored and closed and the prelogon tunnel stays.


Checking the GP logs, it looks like account info is not being handed off as part of the sign in to GP for the SSO part.


I've tried: "pangps -registerplap" and that does add a symbol allowing me to check before login if the tunnel is established.  Helpful, but it didn't fix anything.  I also found somewhere talking about making sure default windows and GP were the only credential providers listed in Windows registry.. DUO was in there on ours too so I deleted that key which re-enabled the login options to appear.  Choosing the GP login option does seem to at least provide my username in the SSO logs but still didn't actually switch to the username in GP.


This is driving me crazy so I'm hopeful someone else has come across this and has some insight!

  • 0 replies
  • 47 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!