Remote Desktop Gateway on Windows Server 2012 R2 and IPAD

Question

Hi guys,
Would love some help with an issue I been struggling for a couple of days now.
I have a RDS 2012 R2 Gateway configured and it works great with all Windows clients both internal and external communication. The problems comes now when my I want to use  IPAD
from APPLE. I installed latest RD Client from Microsoft and it works great from the internal network but as soon the device is moved to an external network the client get an error while connecting. Gateway is located in the domain network.
The error is “Failed to parse authorization Challenge”,
This is what I see in the log file from the RD Client.
[2014-Mar-06 16:53:49] RDP (0): --- BEGIN INTERFACE LIST ---
[2014-Mar-06 16:53:49] RDP (0): lo0 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): lo0 af=30 (AF_INET6)  addr=::1 netmask=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
[2014-Mar-06 16:53:49] RDP (0): lo0 af=2 (AF_INET)  addr=127.0.0.1 netmask=255.0.0.0
[2014-Mar-06 16:53:49] RDP (0): lo0 af=30 (AF_INET6)  addr=fe80::1%lo0 netmask=ffff:ffff:ffff:ffff::
[2014-Mar-06 16:53:49] RDP (0): pdp_ip0 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): pdp_ip0 af=2 (AF_INET)  addr=10.25.216.171 netmask=255.255.255.255
[2014-Mar-06 16:53:49] RDP (0): pdp_ip1 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): pdp_ip2 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): pdp_ip3 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): pdp_ip4 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): en1 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): ap1 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): en0 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): awdl0 af=18  addr= netmask=
[2014-Mar-06 16:53:49] RDP (0): --- END INTERFACE LIST ---
[2014-Mar-06 16:53:49] RDP (0): Not using any proxy
[2014-Mar-06 16:53:49] RDP (0): Protocol state changed to: ProtocolConnectingNetwork(1)
[2014-Mar-06 16:53:54] RDP (0): Resolved 'MB-RDS-01.contoso.LOCAL' to 'ERROR: Unable to connect to remote PC. Please provide the fully-qualified name or the IP address of the remote PC, and then try again.' using NameResolveMethod_Unknown(0)
[2014-Mar-06 16:53:54] RDP (0): Error message: Unable to connect to remote PC. Please provide the fully-qualified name or the IP address of the remote PC, and then try again.(phase: 0, type: 0, reason: 0, systemCode: 0, systemMessage: )
[2014-Mar-06 16:53:54] RDP (0): Protocol state changed to: ProtocolDisconnected(8)
[2014-Mar-06 16:53:54] RDP (0): Final rdp configuration used: {
    activeUsername = " Contoso\\User01";
    arcTimeout = 1800;
    cacheId = 12BF328DD1C8B841;
    certificatesUseRedirectName = 1;
    configurationVersion = 8;
    font = 1;
    gatewayId = F2EE288CD1C8B841;
    gatewayMode = 2;
    gwAutodetectState = kConnectionGwAutodectedForceGW;
    host = "MB-RDS-01.CONTOSO.LOCAL";
    label = "Murbiten - Terminal Server";
    loadBalanceInfo = "tsv://MS Terminal Services Plugin.1.Contoso_-_Termi";
    mouseMode = "-1";
    port = 3389;
    temporary = 1;
    type = rdp;
    useAlt = 0;
    utilityBar = "-1";
    webFeedVersion = "Windows 2008 R2 or newer";
    connections =     (
        F4BF288CD1C8B841,
        12BF328DD1C8B841
    host = "remote.customer.com";
    id = F2EE288CD1C8B841;
    port = 443;
    temporary = 1;
    type = rdp;
    kCFProxyTypeKey = kCFProxyTypeNone;
[2014-Mar-06 16:53:54] RDP (0): --- BEGIN INTERFACE LIST ---
[2014-Mar-06 16:53:54] RDP (0): lo0 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): lo0 af=30 (AF_INET6)  addr=::1 netmask=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
[2014-Mar-06 16:53:54] RDP (0): lo0 af=2 (AF_INET)  addr=127.0.0.1 netmask=255.0.0.0
[2014-Mar-06 16:53:54] RDP (0): lo0 af=30 (AF_INET6)  addr=fe80::1%lo0 netmask=ffff:ffff:ffff:ffff::
[2014-Mar-06 16:53:54] RDP (0): pdp_ip0 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): pdp_ip0 af=2 (AF_INET)  addr=10.25.216.171 netmask=255.255.255.255
[2014-Mar-06 16:53:54] RDP (0): pdp_ip1 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): pdp_ip2 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): pdp_ip3 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): pdp_ip4 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): en1 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): ap1 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): en0 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): awdl0 af=18  addr= netmask=
[2014-Mar-06 16:53:54] RDP (0): --- END INTERFACE LIST ---
[2014-Mar-06 16:53:54] RDP (0): Not using any proxy
[2014-Mar-06 16:53:54] RDP (0): Protocol state changed to: ProtocolConnectingNetwork(1)
[2014-Mar-06 16:53:54] RDP (0): Resolved 'remote.customer.com' to '194.71.11.69' using NameResolveMethod_Unknown(0)
[2014-Mar-06 16:53:54] RDP (0): Resolved 'remote.customer.com' to '194.71.11.69' using NameResolveMethod_Unknown(0)
[2014-Mar-06 16:53:54] RDP (0): Exception caught: Exception in file '/Users/build/jenkins/workspace/rc-ios-develop/protocols/RDP/librdp/librdp/private/httpendpoint.cpp' at line 346
    User Message : Failed to parse authorization Challenge
[2014-Mar-06 16:53:54] RDP (0): Exception caught: Exception in file '/Users/build/jenkins/workspace/rc-ios-develop/protocols/RDP/librdp/librdp/private/httpendpoint.cpp' at line 346
    User Message : Failed to parse authorization Challenge
[2014-Mar-06 16:53:54] RDP (0): Error message: Failed to parse authorization Challenge(phase: 0, type: 0, reason: 0, systemCode: -1, systemMessage: )
[2014-Mar-06 16:53:54] RDP (0): Protocol state changed to: ProtocolDisconnecting(7)
[2014-Mar-06 16:53:54] RDP (0): Protocol state changed to: ProtocolDisconnected(8)
[2014-Mar-06 16:53:54] RDP (0): ------ END ACTIVE CONNECTION ------
en → en
authorization
Adam Bokiniec

Answer 1

Hi Jeremy,
I found a solution, thanks for you effort. The solutions is the following.
First thing that needs to be done is either solution from options below, I did the Solution 1 in my case and added a NPS server to AD. (https://blogs.technet.com/b/networking/archive/2010/01/14/remote-desktop-gateway-client-fails-authentication-with-your-user-account-is-not-authorized-to-access-the-rd-gateway.aspx)
Solution 1
Register the NPS server in Active Directory:
In Server Manager, browse to the following location: Roles\Network Policy and Access Services\NPS (Local).
Right click on the NPS (Local) node and choose Register server in Active Directory.
Click OK to authorize the server when prompted.
Solution 2
Open Active Directory Users and Computers on any Domain Controller of the same domain as the Remote Desktop Gateway.
Add the Computer Name of the Remote Desktop Gateway to the RAS and IAS Servers group.
Situation B
Restart the RDS host and Gateway server.
Secondly and the most important is to configure an alternate address that match your public certificate. My public certificate CNAME is “remote.domain.se”.
All commands need to be run as administrator in PowerShell
To show you current configuration run the following commands:
CollectionName is the Collection Name you created for the RDS deployment.
To get your collection name type
Get-RDSessionCollection
When you got the collection name type
Get-RDSessionCollectionConfiguration -CollectionName "RDS - Terminal Server" | FL *
The default configuration will look like this:
CustomRdpProperty     : use redirection server name:i:1
No to add you public domain name that match the certificate run the following command
Set-RDSessionCollectionConfiguration –CollectionName " RDS - Terminal Server " -CustomRdpProperty "use redirection server name:i:1 `n alternate full address:s:remote.domain.se
Run again to verify your settings
Get-RDSessionCollectionConfiguration -CollectionName "RDS - Terminal Server" | FL *
Now it show look something like this
CustomRdpProperty     : use redirection server name:i:1
                         alternate full address:s:remote.domain.se
IPADs and iPhones can now connect to your environment.
Adam Bokiniec