Two-Factor Authentication (MFA/2FA) for Array AG SSL VPN

Last updated on June 13, 2024

Overview

The purpose of this document is to enable Rublon Multi-Factor Authentication (MFA) for users logging in to Array AG SSL VPN. In order to achieve that using SAML, you have to use Rublon Access Gateway. All required steps will be described in this document.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
FIDO	✔	N/A
Passcode	✔	N/A
SMS Passcode	✔	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	✔	N/A
Email Link	✔	N/A
YubiKey OTP	✔	N/A
RFID	–	N/A

Before you start

You need to install and configure Rublon Access Gateway itself before configuring Array VPN to work with it. Please read the Rublon Access Gateway documentation and follow the steps in Installation and Configuration sections. Afterwards, continue with this document.

Configuration

1. Log in to the Array admin panel.

2. Change Mode to Config.

3. Select the Virtual Site from the dropdown in the top left corner.

4. Go to the Site Configuration menu on the left and click AAA.

5. Select the General tab and check Enable AAA if not checked.

6. Select the SAML tab and check Enable SAML.

7. Select ACS Binding Type and SLO Binding Type depending on your requirements.

8. We recommend you switch IdP Authentication Mode to Single IdP.

9. Click the red APPLY CHANGES button in the upper-right corner.

10. Click the SP Metadata link to download Array metadata. You are going to need values from this file later.

11. Click Add IdP in the upper-right corner of the IDP LIST section.

12. Set IdP Name for your identity provider, e.g. Rublon.

13. Enter cn in the User Name field.

14. Click the red APPLY CHANGES button in the upper-right corner. Your identity provider will appear in the list of identity providers.

15. Log in to Rublon Access Gateway in a separate tab.

16. Select the Applications tab and scroll down to the bottom of the page.

17. Click DOWNLOAD XML METADATA in the Information for configuring applications with Rublon Access Gateway section.

18. Click DOWNLOAD CERTIFICATE. You are going to need this certificate file later.

19. Get back to the Array admin panel. Double-click the identity provider you created (Rublon if you were closely following the instructions).

20. Click Choose File in the IMPORT IDP METADATA section. Select the Rublon Access Gateway metadata file you downloaded in Step 17. Once selected, click Import in the upper-right corner.

21. Get back to Rublon Access Gateway.

22. Go to Applications → Add Application. Fill in the form and click SAVE. Refer to the following image and table.

Application name	Set a name for your application, e.g. Array.
Entity ID	Enter the value that comes after entityID= (without quotation marks) in the Array metadata file you have downloaded in Step 10.
Assertion Consumer Service	Enter the AssertionConsumerService value from the Array metadata file you have downloaded in Step 10. If your metadata file contains more than one value of this type, look for one that ends with the following string: /saml2-acs.php/SSLVPN.
Single Logout Service	Enter the SingleLogoutService value from the Array metadata file you have downloaded in Step 10.
NameID attribute	Enter cn.
Validate AuthnRequest	Uncheck.
Sign response	Check.
Sign assertion	Uncheck.
Certificate for signing	Upload the certificate you have downloaded in Step 18.
Certificate for encryption	Upload the certificate you have downloaded in Step 18.

23. Your configuration is now complete. You can log in to Array AG SSL VPN with Rublon 2FA.

Log in to Array VPN with Rublon 2FA

1. Open Array VPN login page.

2. You will be redirected to Rublon Access Gateway login page.

3. Provide your username and password. Click SIGN IN. A window should appear with a selection of various 2FA options from Rublon. Let’s choose Mobile Push.

4. You will be sent a push notification. Tap APPROVE.

5. You will be successfully logged in to Array VPN.

Troubleshooting

If you encounter any issues with your Rublon integration, please contact Rublon Support.