IOS Remote Desktop Client Logon Issue Prompts to Logon 3 Times with RDGW

Question

I have an issue when connecting from the Remote Desktop client iOS on multiple iPads/users.
First a little background: We have an RDS Web Access / RDS Gateway (2012 R2) setup and properly configured. We can logon using it just fine from the Mac OS version of the app, Android version of the app, or from a Windows PC. When we try to
connect via the iOS app we get the prompt to logon 3 times. Due to security reasons, we do not want them to store their credentials on the iPads, which is the only method I have found to eliminate the triple password entry. It only prompts once on the Mac
OS version, Android version or from a Windows PC.
The password isn't being entered incorrectly and the servers are not registering any Audit Failures for the logon attempts. Can you assist?
Additionally I would like to recommend the addition of a feature to be able to setup remote resources but prompt for the password on app launch for security reasons. That way they would have to enter it once but then they could access any resources needed.
Thanks,
Nate L

Answer 1

I am not comfortable posting the entire log file but let me give you the high level summary. The settings section for the active connection:
[2014-Jun-17 12:45:23] RDP (0): Final rdp configuration used: {
    activeUsername = "domain\username";
    arcTimeout = 1800;
    configurationVersion = 8;
    console = 0;
    gatewayId = XXXXXXXX;
    host = "InternalServerHostName.domain.local";
    label = "";
    mouseMode = "-1";
    offsetX = 0;
    offsetY = 0;
    peerIp = "ExternalRDSGatewayIP";
    port = 3389;
    previousMouseMode = 1;
    previousUtilityBar = 0;
    screenshotScale = "0.125";
    soundMode = 1;
    swapMouseButtons = 0;
    type = rdp;
    utilityBar = "-1";
    zoomFactor = 1;
    connections =    
        ...bunch of addresses...
    host = "ExternalRDSGatewayHostName";
    id = XXXXXX;
    port = 443;
    temporary = 1;
    type = rdp;
    kCFProxyTypeKey = kCFProxyTypeNone;
It then attempts to connect to the InternalServerHostName.domain.local.
[2014-Jun-19 09:40:01] RDP (0): Resolved 'InternalServerHostName.domain.local' to 'ERROR: Unable to connect to remote PC. Please provide the fully-qualified name or the IP address of the remote PC, and then try again.' using NameResolveMethod_Unknown(0)
[2014-Jun-19 09:40:01] RDP (0): Error message: Unable to connect to remote PC. Please provide the fully-qualified name or the IP address of the remote PC, and then try again.(phase: 0, type: 0, reason: 0, systemCode: 0, systemMessage: )
[2014-Jun-19 09:40:01] RDP (0): Protocol state changed to: ProtocolDisconnected(8)
[2014-Jun-19 09:40:02] RDP (0): Showing credentials dialog
It then displays the same settings again with the exception of an additional line after the gatewayId line:
gwAutodetectState = kConnectionGwAutodectedForceGW;
Then it goes through the interface list, not using any proxy, correlation id, then resolves name:
[2014-Jun-19 09:40:10] RDP (0): Resolved 'ExternalRDSGatewayHostName' to 'ExternalRDSGatewayIP' using NameResolveMethod_Unknown(0)
[2014-Jun-19 09:40:11] RDP (0): Exception caught: Exception in file '/Users/build/jenkins/workspace/rc-ios-develop/protocols/RDP/librdp/librdp/private/httpendpoint.cpp' at line 217
    User Message : The gateway failed to connect with the message: 403 Forbidden ( The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. 
[2014-Jun-19 09:40:11] RDP (0): Error message: The gateway failed to connect with the message: 403 Forbidden ( The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. 
)(phase: 0, type: 0, reason: 0, systemCode: -1, systemMessage: )
[2014-Jun-19 09:40:11] RDP (0): Protocol state changed to: ProtocolDisconnecting(7)
[2014-Jun-19 09:40:11] RDP (0): Protocol state changed to: ProtocolDisconnected(8)
[2014-Jun-19 09:40:11] RDP (0): Showing credentials dialog
Then it displays the same settings again except for the gwAutodetectState line changing to:
gwAutodetectState = kConnectionGwAutodectedHTTPSTried;
Then it connects ok. I went to our firewall (MS Forefront TMG) and monitored for traffic from the iPad iOS App (based on network it is on). I don't see the initial connection attempt at all, which is expected because according to the log above it looks
like it tries to connect to the host directly...which it shouldn't?
Then in the second attempt I see it trying to go to http://ExternalRDSGatewayHostName:443/remoteDesktopGateway/ which again it shouldn't be doing because that URL (the remoteDesktopGateway) is not part of the RDSGW or RDSWA 2012 R2 IIS
config or am I missing something? It should be going to Rpc or RDWeb right? or do I need to allow that path through too?
Thanks,
Nate