Duo RD Gateway CAP/RAP Session timeout settings

#15

@DuoKristina,
Thank you for your reply. However, as already stated:
“I’m NOT interested in deploying to the session hosts (as already addressed). Deploying solely to the RD Gateway server is favorable…”

I’ve experimented with deploying to session hosts. While this might seem like a preferable solution for some, it would be time consuming for our organization. We have over hundreds of virtual machines in our cloud environment (I know a GPO is an option). By deploying to a RD Gateway, a single deployment will provide the secondary authentication we are looking to achieve.

Once again, “I’m assuming Duo will/is continuing to evolve the technology and will incorporate some level of RAP / CAP functionality down the road.”

0 Likes

#16

However, as already stated

Yes, I understand. I was just explaining for the community why some people do prefer that setup.

Once again, “I’m assuming Duo will/is continuing to evolve the technology and will incorporate some level of RAP / CAP functionality down the road.”

So please do submit your feature requests. These are taken into account by our Product team when they plan out our roadmaps.

0 Likes

#17

So is there a way to change the timeout settings with Duo installed on the RD Gateway. We are experiancing this issue and prefer the DUO application on the RDGW. And if not how do we get that option to be put on a roadmap to be fixed as this is something that needs to be able to be controlled. Thanks

0 Likes

#18

Any customer interested in improvements to the Duo RDG plugin should definitely contact their account exec or sales engineer, customer success manager, or Duo Support to submit a feature request.

0 Likes

#19

You are repeating yourself ;). I guess this means, DUO still doesnot have an option for this problem… ?

0 Likes

#20

The new poster, who commented two months after the last round of discussion, specifically asked “how do we get that option to be put on a roadmap” in their comment.

I responded to that question, and as the answer for how to get something on the roadmap hasn’t changed, someone who had read the thread in its entirety would indeed note that it was repeated information.

0 Likes

#21

True… But was hoping for a new answer :).

Support told me they found something and are investigating how to fix it, but don’t have any timeframe. Problem is… I can’t stall this much longer for a lot of my customers… Would like to use DUO (as a happy customer of it). But it looks like i’m losing the patience of my customers… so if still nothing to report… no timeframe or even a small indication when we can expect something, we will going investigate the other software option, starting next week. Options like Google Athenticator. So please… tell me … there is more to say about this problem then install it on a session host…

0 Likes

#22

It sounds like you have the most up-to-date information. I do hope that during your contacts with Support you’ve submitted your feature requests so they can be considered as we plan future work on the Windows integrations.

0 Likes

#23

My information is also already old. I guess about 2 month… but no updates after that.

Well, will email them again… and otherwise… shame… but like I said… probably that we will dump duo.

Last update, was that the registery keys aren’t working because of an DUO update… and that the latest DUO (2.3.0) is set the limit to 8 hours. But, because of change of things, it is not easy to fix that without changing something in the authentication framework…

as I have read… installing the duo-rdgateway on our session host, will give someproblems with the duo trusted ip policy?

0 Likes

#24

Yes I agree, installing on the session host means that Duo is not aware of the originating IP address, all sessions originate from the gateway… So you cannot have trusted IP. That is the reason we cannot use it on the session hosts. We need trusted IP because there are many shared computers at head office and these computers are locked down.

Maybe this is a push from their sales team to get you to license every single user of shared computers at a trusted site?

0 Likes

#25

I can confirm that 2.3.0.18 with the reg keys from support is working, I have set a 24 hour session limit and have had no complaints for months now.

Not sure if I am at risk for not installing any updates though.

0 Likes

#26

I have send support an email about the register keys.
There reaction:

“Currently there is not a way to adjust this timeout. I can add you to the feature request for supporting a configurable session timeout if you would like.”

Can someone give me the register keys so our customers can use DUO without complaining about being kicked from the servers.

0 Likes

#27

Hi Gary,

How did you get the registry keys to resolve this issue? Also, what version of windows server are you currently using with the windows registry keys? I’m having timeout issues with a Windows Server 2012 R2 gateway server with DUO Authentication for Remote Desktop Gateway 2.2.0.16.

0 Likes

#28

Is someone able to share the reg keys that resolved the issue? Duo support advise there is no fix, this is just not acceptable for our users, we are getting so many complaints. Suggestions to use the RDSH agent don’t really work for us, as this doesn’t pass through the IP so we cannot do location whitelisting.

0 Likes

#29

We have the same issue, battling with Duo support for them to provide the registry keys for RD Gateway 2.3.0.18. Please can you share the registry keys?

0 Likes

#30

Thanks everyone for keeping this topic alive. @DuoKristina I know we have all been asking for this feature with support and our Account Executives. My account executive didn’t make it sound like there is a way to be “added” to the feature request. Maybe someone at Duo can refer to this thread if they need proof of the need for this feature.
Thanks

0 Likes

#31

@GaryDoven

If your AE did not know how to add you to the existing feature request, contact Support. They definitely know how to do that.

0 Likes

#32

Hey all,

Wanted to jump in and ensure we set some expectations around RDG and session timeout. It is a feature we would like to address in the future, but do not have a definitive timeline for beginning development.

To set some context about where we are today, we previously attempted to add this feature to our RDG application. The implementation did not work consistently and will be removed from the product in a future update. In the meantime, we continue to work to address this feature in the correct manner.

This may not be the answer you would like to read today but any registry setting to alter default timeout behavior may break in future updates and in its current state is unsupported.

We ask that the registry setting not be shared as this is an unsupported configuration and may result in unexpected behavior.

If you are looking to be added to the feature request around this, as @DuoKristina said please contact support and they will be more than happy to help.

1 Like

#33

Any update on this at all?

0 Likes

#34

Hi @thecalstanley,

Take a look at our @PatrickKnight 's last post to this thread.

0 Likes