Authentication workflows for the Logonbox VPN client

Budy

I have successfully setup DUO for securing the admin access to the Logonbox VPN portal. However, I cannot seem to find a way to integrate DUO as a 2FA for connecting Logonbox VPN clients as well, although it is already pre-setup in the Authentication Flows section on the portal.

Is this feature just missing for the Mac client? Also, we will likely have different groups of users, where some of them will have to have MFA enabled, while other will not. Currently, I cannot grasp, how I could tie an authenticaton flow to, e.g. a VPN peer definition, since there's no option to configure one.

Budy

…and, I think the same question applies to the portal itself. Can authentication flows be managed on AD-based groups?

ludup

Each route into the VPN has its own flow, so you have configured the admin flow for the portal, you should have a LogonBox VPN Client flow which defines the authentication for LogonBox clients.

Attach Duo to this flow and when a client logs in they should be prompted to complete Duo authentication.

The authentication flow can be configured right down to the user level by using the "Assigned Flow" authentication module.

First, create an Authentication Flow for each type of authentication you want to support. Add the modules necersary to each flow, then in the main LogonBox VPN Client flow, or other system flow, add the "Assigned Flow" module.

This allows you to specify any number of mappings of User/Group/Role to an Authentication Flow and provide a fallback/default.

If you don't see the Assigned Flow, your likely not on the latest version as it was only recently introduced.

Budy

Well, I either don't get it, or it doesn't work this way. What I got was, that there are 3 "main" schemes for the 3 types of logins: user/admin/vpn

Let's say, I want to have Duo as a flow. I create a new flow and put in Username+Password and Duo. Then I also create another flow named Password, where I only put in Username+Password.
Then I change the Admin scheme by removing Username+Password and add in Assinged Flow, where I configure all users of a certain AD group to have to Duo scheme?

ludup

That's not quite the right way to go about it.

Maybe we need to improve the validation when adding modules to the schemes because you can't just put Assigned Flow at the start of the user/admin/vpn flow (let's call these system flows). How do we know who the user is? You need at least Username module, or Username+Password at the beginning of a system flow.

Create a custom flow and put Duo in it. The best practice here is just to have a single module in that flow but that's not an enforced rule. Custom flows can ONLY be called by system flows.
Edit the system flow, ensuring there is at least a Username, or Username+Password at the start. Then you can add Assigned Flow and setup the assignments as you wish.
Rinse and repeat on all the system flows. You can create as many custom flows as you like with as many combinations of authentication module.

Budy

Yeah - I tried that as well, since that looked more like it to me, but when I tried that, I only got a blank dialog, where the Duo stuff is usually located.

Now, that I come to think about it, its likely, that the Duo settings haven't been preserved… let me check that… 😅

Budy

Okay, got it… I was somewhat confused, since I had a flow with Duo setup and deleted it. I think I messed up, when recreating it, when I probably didn't save the Duo credentials properly.