1

We have an RDWeb server setup with SSO and are able to connect and get the menu of options to pick. We have Calculator setup as a test along with another company app. When you click on either one the RDP file downloads and when you open you get the “Start your app” screen and then a pop-up saying “Your credentials did not work”.

If you enter your network password, it goes right in. If you click either app after that, it connects right in. Close the browser and go back in and you get the prompt again.

3 Spice ups
2

Need a lot more details. How is this SSO setup?

3

Is this in to the main page?

How is your SSO setup, you said it’s setup, but clearly something is missing or misconfigured if you get an error after initial menu page.

I assume you want SSO to login to the RDWeb app list, then also in to the app itself?

You’re not clear on the latter part.

4

SSO is setup with Windows authentication.

RDWeb Authentication
RDWeb Authentication808×301 21.6 KB

We can login to the default RDweb page after modifying the web.config and default.aspx.
https://server.domain.net/RDWeb/Pages/en-US/Default.aspx

Yes, we want to be able to login to the page with SSO (which is working) and then also pass credentials to the App it’s self.

Sorry for the vagueness in details, but this is a new deployment to me so not sure what all you need to know. And like I mentioned in my initial post, I get an error the credentails fail when opening an app, but if I put in the same credentials, it takes it and launches the app and works every time until I close the browser. Thank you.

5

Here are some notes from a previous setup I’ve been party to.

  1. Ensure your Remote Desktop Services (RDS) deployment includes RD Web Access, RD Gateway, RD Connection Broker, and RD Session Host. All should be running on Windows Server 2016 or later and configured with publicly trusted SSL certificates.
  2. Enable Web SSO on RDWeb: Use Group Policy to configure Credential Delegation. Navigate to Computer Configuration > Administrative Templates > System > Credentials Delegation. Enable “Allow delegating saved credentials with NTLM-only server authentication” and “Allow delegating saved credentials”. Add the value TERMSRV/*. On the RDWeb server, open IIS Manager, go to Sites > Default Web Site > RDWeb > Pages, open Application Settings, set UseRDGateway to true and DefaultTSGateway to your RD Gateway FQDN.
  3. Configure RD Gateway for SSO: Ensure Network Level Authentication (NLA) is enabled on the RD Session Host. Use SSL certificates on the RD Gateway. Configure RD Gateway CAP and RAP policies to allow the appropriate users and groups.
  4. Configure RDP File Settings: Ensure .rdp files used by RemoteApps or desktops are configured to use the FQDN of the RD Gateway, enable credential delegation, and trust the publisher (via GPO or manually).
  5. Add Certificate Thumbprint to Trusted RDP Publishers: Use Group Policy to add the certificate thumbprint of your RD Connection Broker to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client > Specify SHA1 thumbprints of certificates representing trusted .rdp publishers.

It may not be as clear as a guide, but hopefully it helps.

1 Spice up
6

I’ve ended up finding a few GPOs that need set and some config files in IIS that needed modified. Here’s all my notes:

Computer Configuration → Policies → Administrative Templates ->System->Credentials Delegation ->Allow delegating default credentials
Computer Configuration → Policies → Administrative Templates ->System->Credentials Delegation ->Allow delegating default credentials with NTLM-only server authentication

Under both keys, add your servers the list. Either individually or with a wild card for the domain:
TERMSRV/*.domain.net
TERMSRV/server.domain.net

User and Computer Configuration → Administrative Tools → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Trusted Sites Zone → Logon Options and in the dropdown list select “Automatic logon with current username and password”.

C:\Windows\Web\RDWeb\Pages 
Edit: Web.config
Remove comment marks and add comment marks

Before
      <!--
      <authentication mode="Windows"/>
      -->
      <authentication mode="Forms">
          <forms loginUrl="default.aspx" name="TSWAAuthHttpOnlyCookie" protection="All" requireSSL="true" />
      </authentication>

After
      <authentication mode="Windows"/>

      <!--      <authentication mode="Forms">
          <forms loginUrl="default.aspx" name="TSWAAuthHttpOnlyCookie" protection="All" requireSSL="true" />
      </authentication>
      -->

Before
  <system.webServer>
    <handlers>
        <add name="PagesWebFeedHandler" path="WebFeed.aspx" verb="*" type="Microsoft.TerminalServices.Publishing.Portal.PagesWebFeedHandler" preCondition="integratedMode"/>
    </handlers>
    <modules runAllManagedModulesForAllRequests="true">
      <remove name="FormsAuthentication" />
      <add name="RDWAFormsAuthenticationModule" type="Microsoft.TerminalServices.Publishing.Portal.FormAuthentication.TSDomainFormsAuthentication" />
    </modules>

    <security>
        <authentication>
            <windowsAuthentication enabled="false" />
            <anonymousAuthentication enabled="true" />
        </authentication>
    </security>
    <httpRedirect enabled="false" />
  </system.webServer>

After
  <system.webServer>
    <handlers>
        <add name="PagesWebFeedHandler" path="WebFeed.aspx" verb="*" type="Microsoft.TerminalServices.Publishing.Portal.PagesWebFeedHandler" preCondition="integratedMode"/>
    </handlers>
    <!--
    <modules runAllManagedModulesForAllRequests="true">
      <remove name="FormsAuthentication" />
      <add name="RDWAFormsAuthenticationModule" type="Microsoft.TerminalServices.Publishing.Portal.FormAuthentication.TSDomainFormsAuthentication" />
    </modules>

    <security>
        <authentication>
            <windowsAuthentication enabled="false" />
            <anonymousAuthentication enabled="true" />
        </authentication>
    </security>
    -->
    <httpRedirect enabled="false" />
  </system.webServer>

C:\Windows\Web\RDWeb\Pages\en-US\
Edit: Default.aspx

Before
    public bool bShowPublicCheckBox = false, bPrivateMode = false, bRTL = false;

After
    public bool bShowPublicCheckBox = false, bPrivateMode = true, bRTL = false;
7

Does that mean your issue is solved?

If it is, please mark a best answer.

1 Spice up