Is Rublon MFA compatible with Network Policy Server (NPS)?

Yes. You can use the Network Policy Server (NPS) as the identity provider (IdP) for the Rublon Authentication Proxy.

In this scenario:

1. NPS is added to the Rublon Authentication Proxy configuration file as if it were a RADIUS server.

2. NPS communicates with a RADIUS server (such as FreeRADIUS) or an LDAP server (such as Active Directory) to pull users.

Using Protocols Other Than PAP

If the service or device communicating with Rublon Authentication Proxy uses a RADIUS authentication protocol other than PAP, such as MS-CHAPv2 or EAP-MS-CHAPv2, set the proxy_requests parameter to true in the RADIUS authentication source that points to the NPS server:

auth_sources:
  - name: NPS
    type: RADIUS
    ip: 192.168.0.100
    port: 1812
    radius_secret: your-radius-secret
    proxy_requests: true

After changing the configuration, restart the Rublon Authentication Proxy service.

Setting proxy_requests to true is required when the NPS server rejects requests because the Message-Authenticator attribute is missing. In this case, Windows Event Viewer displays NPS Event ID 17, indicating that an Access-Request message was received without the required Message-Authenticator attribute.

Helpful Links

Is There an Alternative to Windows NPS?

MFA for RADIUS