chadbrown

It opens within the RDM application. So embedded I would assume?

Oh I understand now. We are using the Devolution Server for the datasource.

And yes, if I remove the PIN and manually enter the PIN, it works with no issues. Each login is the account it’s supposed to be.

Yes. I just checked again to be sure. The thumbprint entry is different on each certificate.

Hey Richard.

• What kind of data source to do you use?

  • I don't know how to answer this question. But if you give me some context, I can try to figure it out.

• You created two separate X.509 entries, right? How are they setup (e.g. are they linked to the system certificate store by e.g. thumbprint)?

  • Yes. I have two separate .509 certificates. They are linked to the Yubikey I have setup, and I have exported them both, and uploaded each one to their respective credential entry and chosen to store them on the server.

• How are you connecting the X.509 entries to your RDP session(s)? Do you have multiple RDP sessions, each linking to a separate X.509 entry, or are you using a different mechanism to resolve which X.509 entry to use for auth?

  • I currently have the RDP sessions setup to Prompt on Connection that allows me to select which credential I want to use. We do this as we have a shared database and each user may title their credentials something different.

Hopefully I understood your question and answered them accordingly.

Thanks!

Ok. So I was able to get this setup in RDM with the certificate. I now have a new weird problem.

I have two separate accounts, one for AD admin, and one for server admin both using the yubikey certificate method.

I have created two separate entries in RDM, one for each account. However, if I store my PIN in the credential in the .509 entry, both entries open the connection with the server admin account. I have verified the certificate is correct under both entries.

Hi Adam,

my apologies for the late reply.

I didn’t see your reply, and just now getting time to circle back to this.

We are currently using PIV and currently using On-Prem AD.

Thanks!

-Chad

Hello,

We are moving to Yubikey+PIN authentication for windows. Currently we have our passwords saved in our uservault, and then select them on connection attempt.

Is there a way to setup an RDP session to use my new account and my yubikey? I know this can be done in native RDP, but not sure about how to handle this through RDM.

Any timeline updates on this?

Thanks!