Workforce & VPN MFA

Keycloak-backed MFA for Windows logon and RDP, macOS login, Linux SSH and sudo, and every major VPN over RADIUS or SAML. One MFA policy across desktops, servers and remote access.

Overview

Keycloak handles the authentication decision, but it doesn't ship a RADIUS server, a Windows credential provider, a macOS login plugin or a PAM module, so we add the components each platform needs and keep Keycloak as the single place MFA policy lives. VPNs connect over SAML where the client supports it, giving users Keycloak's full login page with passkeys, and over RADIUS everywhere else, through an open-source Keycloak RADIUS extension or FreeRADIUS integrated with Keycloak. We cover Cisco Secure Client, Palo Alto GlobalProtect, Fortinet, Check Point, Ivanti, NetScaler, OpenVPN, Azure and AWS VPNs, among others. Windows sign-in and direct RDP use a credential provider; Remote Desktop Gateway uses NPS and RADIUS without an agent on each server. Macs use a login-window agent deployed through your MDM, and Linux servers use PAM for SSH and sudo, or short-lived SSH certificates issued after a Keycloak login. Offline behaviour, break-glass access and push timeouts are decided and tested before rollout.

Delivery Process

What's Included

• Highly available RADIUS front end for Keycloak
• VPN integration: Cisco, Palo Alto, Fortinet, Check Point and more
• Windows credential provider and RD Gateway via NPS
• macOS login-window agent deployed through MDM
• Linux PAM and short-lived SSH certificates
• Offline, break-glass and enrolment runbooks

Timeline & Scope

Tech Stack