Enabling MFA for PRTG through a WAP server

Important notice: This approach is not officially supported by Paessler.
The configuration may have adverse effects on mini probes, remote probes, HTTP Push sensors, and connections with PRTG Desktop and mobile apps, since these cannot handle the additional request for authentication.

To enable multi-factor authentication (MFA) for PRTG through a Web Application Proxy (WAP) server, take the following steps:

• Step 1: Install the Remote Access role on the WAP server
• Step 2: Configure the WAP to connect to an AD FS server
• Step 3: Add a new Relying Party Trust on the AD FS server
• Step 4: Import external certificate into the WAP server
• Step 5: Publish a new application through the Remote Access Management Console on the WAP server
  • Step 5a: Publish settings with different external and internal URLs

Step 1: Install the Remote Access role on the WAP server

1. On the WAP server, open the Server Manager console.
2. Click Manage.
3. Click Add Roles and Features to open the Add Roles and Feature Wizard.
4. On the Installation Type page, select Role-based or feature-based installation. Click Next.
5. On the Server Selection page, select your AD FS server. Click Next.
6. On the Server Roles page, enable the check box next to Active Directory Federation Services and next to Remote Access. Click Next.
7. Click through the next pages until you reach the Role Services page.
8. On the Role Services page, enable the check box next to Web Application Proxy and click Add Features. Click Next.
9. On the Confirmation page, click Install and wait for the installation to finish.
10. Click the Open the Web Application Proxy Wizard link and continue with Step 2: Configure the WAP to connect to an AD FS server.

Step 2: Configure the WAP server to connect to an AD FS server

1. In the Web Application Proxy Configuration Wizard, go to the Federation Server page.
2. Enter the fully qualified domain name (FQDN) of your AD FS server as federation service name and the credentials of a local administrator account on your AD FS server.
3. On the AD FS Proxy Certificate page, select a certificate to be used by the AD FS proxy from the list of certificates that are installed on the WAP server. Click Next.
4. On the Confirmation page, click Configure and wait for the configuration of the WAP to finish, then click Close.

Step 3: Add a new Relying Party Trust on the AD FS server

1. On the AD FS server, add a new Relying Party Trust and select Claims aware. Click Start.
   Note: Selecting the option Non claims aware assumes Integrated Windows Authentication on the backend.
2. On the Select Data Source page, select Enter data about the relying party manually. Click Next.
3. On the Specify Display Name page, enter a display name, for example, PRTG. Click Next.
4. Click through the following pages. Do not enable the check boxes for the WS-Federation Passive protocol or the SAML 2.0 WebSSO protocol.
5. On the Configure Identifiers page, enter the URL of the PRTG core server as relying party trust identifier. If you have enabled SSL encryption for the PRTG website, the URL must start with https. Click Next.
6. On the Choose Access Control Policy page, select an access control policy that requires MFA, if desired. Click Next.
7. Finish.

Step 4: Import external certificate into the WAP server

Copy the certificate file in .pfx format from the PRTG core server to the WAP server and import it to the local certificate store there.

Step 5: Publish a new application through the Remote Access Management Console on the WAP server

1. Open the Remote Access Management Console on the WAP server and click Web Application Proxy, then click Publish to open the Publish New Application Wizard. Click Next.
2. On the Preauthentication page, select Active Directory Federation Services (AD FS) as preauthentication method. Click Next.
3. On the Relying Party page, select the Relying Party Trust that you created in Step 3: Add a new Relying Party Trust on the AD FS server from the list of relying parties. Click Next.
4. On the Publishing Settings page, enter a meaningful name, for example, PRTG, and the external URL for the application. In the list of external certificates, select the certificate that you imported into the WAP server in Step 4: Import external certificate into the WAP server. As backend server URL, enter the internal URL.
   Note: You can use the same external and internal URLs by having a CNAME in DNS point to the WAP server, then adding the same name to the hosts file on the WAP to point to the IP address of the PRTG core server. If the internal and external URLs are different, you need to take some additional steps. For more information, see Step 5a: Publish settings with different external and internal URLs. Click Next.
5. On the Confirmation page, click Publish and wait for the application to be published successfully, then click Close.

Step 5a: Publish settings with different external and internal URLs

If you have different external and internal URLs, you need to run some PowerShell commands on the WAP server.

1. Run a PowerShell prompt as administrator.
2. Run the following command using the name that you entered when publishing the application in Step 5: Publish a new application through the Remote Access Management Console on the WAP server. In this example, the name is PRTG.
   Get-WebApplicationProxyApplication -Name "PRTG" | fl *
   You should see two properties that you need to change:
   DisableTranslateUrlInRequestHeaders : False
DisableTranslateUrlInResponseHeaders : False
3. Run the following commands to change the respective properties to true:
   Get-WebApplicationProxyApplication -Name "PRTG" | Set-WebApplicationProxyApplication - DisableTranslateUrlInRequestHeaders:$true Get-WebApplicationProxyApplication -Name "PRTG" | Set-WebApplicationProxyApplication - DisableTranslateUrlInResponseHeaders:$true

See also

Microsoft article: Install and Configure the Web Application Proxy Server

• https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn383662(v=ws.11) Microsoft article: Create a Relying Party Trust
• https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust Microsoft article: Publish Application using AD FS Preauthentication
• https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn383640(v=ws.11)

More

Enabling MFA for PRTG is also possible through an Azure Active Directory’s Application Proxy. For more information, see this Microsoft article: Remote Access to on-premises applications through Azure Active Directory’s Application Proxy.

Thanks to Michael Finney for sharing this approach with us.