Hybrid New UI setup for External MFA and Internal IWA

Version Affected: 24.4.x

Description:  

This article will explain how to setup WindowsSSO / IWA for internal access and MFA for external access using the New UI with a two realm setup.

Users will be directed to go to Realm A first and based off IP they will either be prompted for MFA or redirected to Realm B for WindowsSSO / IWA.

Instructions:  

Realm A Policy Setup for MFA and / or redirect for WindowsSSO / IWA.

1. Create a new Policy for External Access (MFA)

2. On “Authentication Rules” tab Add a New Rule “IP Range” to redirect if user is coming from an Internal IP range (trusted IP’s) to Realm B for WindowsSSO / IWA workflow. If not coming from trusted IP user will remain on Realm A for MFA.

3. On “Login Workflow” tab select the login MFA workflow as desired.

4. See screenshots:

   1. 

   2. 

Realm B Policy Setup for WindowsSSO / IWA.

5. Create a new Policy for Internal Access (WindowsSSO / IWA)

6. On “Authentication Rules” tab Add a New Rule “IP Range” to “Skip MFA” if user is coming from an Internal IP range (trusted IP’s).

7. On “Login Workflow” tab select “Passwordless”.

8. Go to “Advanced Settings” and select Realm B workflow tab.

9. Scroll down to “Custom Identity Consumer” section.

10. Set the following settings

    1. Receive Token: Token

    2. Require Begin Site: True

    3. Begin Site: Windows SSO

    4. Begin Site URL: WindowsSSO.aspx

    5. User Impersonation: True

    6. Windows Authentication: True

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.