Hi Markus
Thanks for your PM. I'm replying here for visibility. I note that you'll be out-of-office for a while, so this message should be waiting for you whenever you're back.
The wlfreerdp log shows the exact same double gateway logon as RDM, and from your message it sounds like in this case you do get a second MFA prompt, which is surprising on the face of it. So there are two things here: first, why does wlfreerdp work and why does RDM not? And, why do you get a double prompt which I guess is not the behaviour you see with Microsoft's client.
For the first, what we see is with RDM the second authentication request went out 1.1 seconds after the first approval. I guess that is just too soon and the MFA extension or Entra ignores a second push request for the same user so soon after the first. That's my guess, the logs don't prove it. With wlfreerdp, the second authentication request went out ~16 seconds after the first. That's the key difference and if I had to guess, wlfreerdp is stalling in NLA trying Kerberos (it's trying to find a KDC for <domain> ), and that gap is long enough for the second MFA to work. What would be the interesting test here is you were to retry your wlfreerdp command, adding /auth-pkg-list:!kerberos to the command. If it then hangs like RDM does, it confirms the timing issue.
I'm sorry that I don't have a corresponding setup on my side to validate that myself.
For the second point, you wrote
On Windows, you're then forwarded to the RDP host and the desktop appears
I assume in this case you only get one MFA prompt? The implication (and again I can't test it myself or prove it without a packet capture) is that mstsc is reusing the same Gateway tunnel for the initial connection and the redirect. FreeRDP doesn't do that: on a redirect, the whole connection (Gateway tunnel included) is torn down and established, meaning a second Gateway authorization and a second MFA prompt. In principle FreeRDP could retain the tunnel through the redirect, I'm not sure how tricky that would be. Once you can confirm or refute the things I've written above, we'll need to figure out the best way to fix this for you. But certainly a fix is possible once we've answered all the questions.
Please, let me know if something isn't clear or you have further questions
Kind regards,
