2

I've inherited a system that may have never been fully integrated as it could have been.

We have a simple setup - A Windows 2008 R2 Server being used for Remote Desktop and Remote App access by users in our company.

Users login to their local computers with Domain Credentials and depending on what jobs they need to do, open a Remote Desktop Connection or Remote Application to the RDS Server.

SSO seemed to be a much easier thing to implement from my reading than it has proven to be in practice. One of the user complaints is, "Why do I have to type my password so many times?" I've integrated Active Directory Authentication with many of our applications to reduce the number of usernames and passwords, and like all good users they appreciate that and want more.

I followed the directions outlined here. Unfortunately it doesn't seem to have done the trick. I applied the policies for Credential Delegation and confirmed the settings for the RDS server were correct.

When I proceed to connect to the server - I get prompted for my credentials.

My concern is that there could be an issue with the self signed certificate on the Windows 2008 R2 Remote Desktop Server, but I do not have any idea how to proceed from this point. Everything I find points towards getting a publicly issued certificate, when we are only using this service internally. I've tried importing the certificate onto my test client machine. All ports are open between the Client, DC, and RDS. I just feel like there may be one piece of the puzzle missing somewhere.

I've searched through Microsoft Articles and Blogs and Posts - and nothing seems to get me to where I need to go, although it does seem to be a universally awkward and finicky thing to get working.

Any tips or advice?

Thanks in advance.

Improve this question
3
  • 3
    Getting the certificate right is critical to the SSO working. Have you considered setting up your own certificate authority instead of trying to build a self-signed cert? Do you already have a CA? It should be possible to use an openssl based ca, and just import the CA cert into your clients via a GP, but I have never tried that. I have only done the public cert, and the windows-based CA.
    – Zoredache
    Jan 22, 2014 at 19:04
  • I will try that and let you know how it goes. Certificates were never mentioned in any of the information I read in the "HOW-TOs" just in the I'm having issues threads. Unfortunately, they never seemed to resolve. Thanks
    – JTWOOD
    Jan 22, 2014 at 19:17
  • @JTWOOD Well, your clients need to trust the certs, or they get a cert error, which can break SSO. It's not necessary to use a public cert, it's just that the big CAs are trusted by default in Windows. You can add your own CA to the list of trusted CAs on your computers, or even add the self-signed cert as a trusted one on your PCs. Not sure if that would be enough to get it working, but it's worth trying first, because it's a lot easier and quicker than setting up a CA or getting a publicly trusted cert.
    – HopelessN00b
    Jan 22, 2014 at 19:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .