RDM stop working when internet / Entra is not availible
We use a DLVS and RDM with authentication via Entra ID. When a user start RDM they has to authenticate once a day (9 hours) by Entra. This works fine when everything is normal.
Today we had an internet outage so Entra was inaccessible. The problem is that users can’t use RDM anymore, it looks it depends on internet. We expected RDM to continue working because the user was already authorized when he starts working.
The client's refresh token is set to 9 hours so we expect that after initial authentication the user can work in RDM without authenticate the next 9 hours.
It appears that RDM checks Entra every time you start a jump to a server. If the internet/Entra is unavailable, you cannot jump to an internal host. This is expected because you are already authorized.
All Comments (2)
Hello Freddy ,
Thank you for your message and for explaining the situation in detail. I understand the issue you experienced during the internet outage: although your users had already authenticated through Entra ID earlier in the day, RDM stopped working as soon as Entra became unreachable.
This is actually expected with the way Entra ID authentication works. Even after the initial login, Entra tokens are still validated at different points during the day, including when opening a session or performing certain actions in RDM. When Entra cannot be reached, DVLS has no way to confirm or refresh the token, so the request is rejected for security reasons.
The 9-hour refresh-token lifetime does not allow offline operation. It only means that users will not be prompted to log in again as long as Entra remains reachable. If Entra is offline, no refresh or validation is possible, which is why RDM could not continue working during the outage.
To avoid this issue in the future, here are a few options:
A. Add a fallback authentication method
You can configure DVLS to allow authentication through your domain (LDAP/LDAPS) in addition to Entra ID. This gives users a way to log in even if Entra or the internet is unavailable.
B. Use RDM offline mode (requires a non-Entra authentication method)
Offline mode cannot function with Entra ID, because it requires online token validation. If offline usage is required, an additional authentication provider is needed.
C. Improve redundancy for Entra connectivity
Some environments use a backup internet connection or redundant DNS so cloud authentication remains reachable at all times.
Best regards,
Michel Audi
Hi Michel,
Thanks for the clear answer!