Web Portal with SSO (beta)

Key prerequisites and limitations

Web Portal 2026 with SSO is designed for the Creative theme and uses all customizations from AdminTool > Web > Web Portal Customization. If the selected theme is not Creative , the Web Portal does not display.

When enabled in a farm, all servers must run the same Remote Access version and be enabled for Web Portal 2026 with SSO

This feature is Beta and should not be deployed on production servers.

Why a new Web Portal?

Compared with the previous Web Portal, this implementation provides higher reliability and better performance under load. Plus, it allows:

• Advanced SSO capabilities

  • Windows Integrated Authentication (Negotiate / Kerberos / NTLM)
  • Third-party identity provider integration (currently SAML)

• Stronger security controls

  • Built-in anti-forgery protections
  • Endpoint rate limiting
  • Modern authentication and cookie/session controls

Its architecture will allow us to easily address any potential security audit feedback.

It is also a more accessible product through recommendations and improved contrast.

Web server flexibility (Kestrel by default)

The application is not tied to one front-end web server. By default, it runs on Kestrel (HTTP port 81). It can be fronted by IIS or Apache as a reverse proxy by changing web server configuration.

Example: Apache reverse proxy to Web Portal service

# Apache VirtualHost example
ProxyPreserveHost On
ProxyPass        /  http://127.0.0.1:81/
ProxyPassReverse /  http://127.0.0.1:81/

RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"

This keeps Web Portal logic unchanged while Apache handles public HTTP/HTTPS exposure.

Please contact the development team if interested as this scenario is not yet accessible from AdminTool program and must be configured manually.

Enable Web Portal 2026 with SSO

1. Open AdminTool
2. Go to: Web > Web server
3. Enable: Web portal 2026 with SSO

Important : this option is Beta. Use only in test environments.

Supported sign-in modes

Web Portal 2026 with SSO supports:

• Traditional login form using Windows credentials
• Web credentials. See: https://docs.tsplus.net/tsplus/web-credentials/
• Windows Integrated Authentication (automatic in trusted / local scenarios)
• External identity provider via SAML , such as Entra ID (formerly Azure AD) or Okta

Note: Support for external authentification via OIDC planned later, on request

2FA behavior

2FA is applied to standard account flows, including:

• Login form using Windows credentials
• Web credentials
• Windows Integrated Authentication

External authentication providers often enforce their own MFA / 2FA. So 2FA configuration set in Remote Access 2FA addon does not apply to this scenario.

Local-network bypass is available through CustomSettings:TwoFaBypassForLocalNetwork parameter located in file: C:\Program Files (x86)\TSplus\Clients\webportal\appsettings.json , where C:\Program Files (x86)\TSplus is TSplus Remote Access setup folder. When enabled, bypass occurs only if client and gateway are in the same private subnet.

Configure Windows authentication flow

For users signing in with Windows authentication, one of the following is required:

1. Pre-register credentials with the TSplus command: AdminTool.exe /windowscredential-addorupdate . See documentation at https://docs.tsplus.net/tsplus/commands-list/#add-or-update-credentials-to-the-windows-credentials-manager-windowscredential-addorupdate
2. Or let the user sign in once through the Web Portal login form with Windows credentials.

For configuring Windows Integrated authentication, please see: Enable Windows Integrated Authentication on an Active Directory Domain. As this authentication mode is arduous to configure, customers often favor setting up an external identify provider.

Configure external authentication (SAML)

Required settings in appsettings.json

The file appsettings.json is located in C:\Program Files (x86)\TSplus\Clients\webportal , where C:\Program Files (x86)\TSplus is TSplus Remote Access setup folder.

Edit the Saml2 section:

• IdPMetadata
• Issuer
• SingleSignOnDestination (optional if metadata provides it)
• SingleLogoutDestination (optional if metadata provides it)
• Certificate-related fields

Windows password availability for session launch

For external SAML authentication, launching sessions still requires usable Windows credentials. Use one of:

1. Register Windows credentials with command: AdminTool.exe /windowscredential-addorupdate . See documentation at https://docs.tsplus.net/tsplus/commands-list/#add-or-update-credentials-to-the-windows-credentials-manager-windowscredential-addorupdate
2. Or forward password from IdP claim by setting CustomSettings:UseSamlPasswordClaim to the claim type containing the Windows password.

If no password is available from claim or credential store, user validation fails.

Complete appsettings.json configuration file reference

The file appsettings.json is located in C:\Program Files (x86)\TSplus\Clients\webportal , where C:\Program Files (x86)\TSplus is TSplus Remote Access setup folder.

Logging

Global host setting

IpRateLimiting

IpRateLimiting:GeneralRules

Each rule object has:

Default protected endpoints:

• POST:/Account/Login
• POST:/Account/ResetPassword
• POST:/Launch
• POST:/RemoteApp
• POST:/2FA/Validate
• POST:/2FA/ResendCode
• POST:/2FA/Status

Saml2

CustomSettings

In appsettings.json , these values are stored as strings ( "true" / "false" ) and mapped to booleans by .NET configuration binding.