Devolutions Server - load balance and Windows Authentication via RDM

Devolutions Server - load balance and Windows Authentication via RDM

avatar

I am having issues deploying Devolutions Server as a load-balanced solution (I have the enterprise license.) Here's what I have done so far:

DVS01A .mydomain.com- Node 1 - DPS is installed and configured for Windows Authentication
DVS01B .mydomain.com- Node 2 - DPS is installed and configured for Windows Authentication
DVS01.mydomain.com - L4 or L7 load balancer

DVS01A and DVS01B web interface work with Windows credentials
DVS01A RDM connections work if I set the datasource to the DVS01A.mydomain.com and check Window authentication
DVS01B RDM connections work if I set the datasource to the DVS01B.mydomain.com and check Window authentication
DVS01 web interface work with Windows credentials
DVS01 RDM connections work if I set the datasource to the DVS01.mydomain.com if I UNCHECK Windows authentication and supply windows credentials manually
Bypassing the load balancer using hosts file has the same symptoms

What I'd like is to be able to use the current Windows credentials to connect to DPS from RDM without having to type the password (they already have to supply MFA on launch.)

By changing the namespace from a server to a shared namespace, I understandably break Kerberos. I would expect it to fail back to NTLMv2, but that doesn't seem to be the case. Regardless, when I try to create a namespace via setspn and assign it to the SVC account that the DPS App pool is running as, I am still not able to login. What's interesting is when I enable Kerberos debugging, I can see that I am successfully logging in via Kerberos, but I am still getting 401 errors like this:
2021-10-13 02:06:41 10.x.x.x POST /dps/api/loginWindows/partial - 443 - 10.y.y.y RDM/2021.2.16.0+(Windows) - 401 0 0 33

Do you know of a way to get Windows Authentication in RDM to work with a load-balanced DPS name?

Thanks,
Paul

All Comments (6)

avatar

Hello Paul,

Thank you for providing those details and for the troubleshooting you have performed so far.

The only requirements should be that both
X-Forwarded-For is configured at the load balancer and the devices that are used in the communication and the FQDN of the load balancer (DVS01.mydomain.com) is configured under Administration - Server Settings - General - DNS Name in the web interface of Devolutions Server.

You can refer to our KB for more details: https://kb.devolutions.net/kb_dvls_deploy_high_availability_load_balanced_env.html

If it still does not work, could you specify the version of RDM and Devolutions Server you are using?

Best regards,

Richard Boisvert

avatar

Thanks for the fast reply, Richard.

Yes, I had set those values per the Kb.

DPS 2021.1.20
RDM 2021.2.16

avatar

Hello Paul,

Was the Windows Authentication working prior to the upgrade of RDM to 2021.2.16, if you tried it previously?

Devolutions Server 2021.1 with RDM 2021.2 can cause issues, it would be strongly recommended that both versions match (2021.2.x). You could also uninstall RDM 2021.2 and install 2021.1 but you will need to reconfigure your data source since the .cfg file is now encrypted with the latest release.

Best regards,

Richard Boisvert

avatar

Hey Richard, what I noticed was to get Windows Authentication working, I needed to create an SPN and then configure IIS to use the AppPool credentials to decrypt Kerberos tokens. After that, it worked perfectly. I documented my steps for deploying a new server from scratch as an HA node in the forum for anyone else who may want to do something similar. Thanks.

avatar

Hello Paul,

Thank you for the detailed steps, it is great that you shared your procedure. We may even use it to make a KB if you do not mind!

Best regards,

Richard Boisvert

avatar

I would not mind at all, happy help to the community. Thanks!