Integrate Okta RADIUS Agent Server with On-Prem NPS having RDG as RADIUS Client

Question

How to Integrate Okta RADIUS Agent Server with On-Prem NPS having RDG as RADIUS Client

Answer 1

Hi Ravi,

1. Prepare Prerequisites

Ensure RDG is installed and working on your Windows Server.

Set up Microsoft NPS on a domain-joined server.

Install the Okta RADIUS Agent on a server with outbound internet access to Okta.

2. Configure RDG as RADIUS Client to NPS

On the NPS server: Open Network Policy Server from Server Manager.
Go to RADIUS Clients and add RDG:
Friendly Name: e.g., RDG
IP Address: RDG server’s IP
Shared Secret: Choose a secure shared secret (used later in RDG setup)

3. Set Up Connection Request Policy

In NPS:

Navigate to Policies > Connection Request Policies. Create a policy for RDG traffic. Configure to Forward requests to a remote RADIUS server group(Okta RADIUS Agent).

4. Configure Okta RADIUS Agent

• Install the agent and configure its radius-agent.config file:

    {
    "agentListenPort": 1812,
    "sharedSecret": "yourSharedSecret",
    "authenticationTimeout": 30,
    "oktaApiToken": "yourApiToken",
    "oktaOrg": "https://yourcompany.okta.com"
  

===> Restart the RADIUS agent after saving changes.
5. Define Network Policies

Still in NPS:

Create a Network Policy to match RDG connections and Set conditions (user groups, Windows version, etc.). Under Authentication, select Accept users from RADIUS server.

6. Configure RDG to Use NPS

In RD Gateway Manager:

Open the properties of the RD Gateway server.

Under RD CAP Store, select RADIUS server.

Add the NPS server and shared secret.

7. Test the Integration:

• Try connecting via Remote Desktop through RDG.
• Ensure users are prompted for Okta MFA.
• Monitor logs on NPS and Okta RADIUS Agent to verify correct flow.

=========================================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

In the Okat Radius Agent where does the radius-agent.config file go?

{

"agentListenPort": 1812,

"sharedSecret": "yourSharedSecret",

"authenticationTimeout": 30,

"oktaApiToken": "yourApiToken",

"oktaOrg": "https://yourcompany.okta.com"