How To: Use CredSSP/NLA for SSO with RDWeb Apps

Version Affected: All

 

Overview

This article explains how to use CredSSP on domain-joined machines so users aren't prompted to re-enter their credentials when launching a Remote Desktop Web Access (RDWeb) app.

Configure CredSSP for RDWeb Single Sign-On

These policies are set with the Group Policy Editor (GPEDIT.MSC), either locally or at the domain level, under Computer Configuration\Administrative Templates\System\Credentials Delegation:

• Allow Delegating Default Credentials -- normally the only one required.
• Allow Default Credentials with NTLM-only Server Authentication -- enable this too if you run into issues.
• Allow Saved Credentials with NTLM-only Server Authentication -- enable this too if you run into issues.

Each of these policies needs its server list defined. The list can contain wildcards, and each entry takes the form TERMSRV/server -- for example, TERMSRV/* to allow every server.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.