FIDO2 Redirect to RDP from Horizon via RemoteFX

Posted by RestinRIP1990@reddit | sysadmin | View on Reddit | 6 comments

Hello, I am trying to get yubikeys to pass to rdp. I have successfully gotten the FIDO HID device to appear in my vdi session with GUID {745a17a0-74d3-11d0-b6fe-00a0c90f57da . I have created a GPO for RemoteFX to allow USB devices, and also to add this to the registry of allowed devices to be redirected. However in RDP it never recognizes the yubikey. I have verified webautn and windows hello is enabled on the rdp settings.

Reply to Post

6 Comments

[-]

justmirsk@reddit

The RDP protocol does NOT tunnel the FIDO2 protocol, this won't work.

[-]

RestinRIP1990@reddit (OP)

Ok i had read that you could use remote fx but this is not working either. Is there any method to pass this to a rds server or should I just give up on this

[-]

justmirsk@reddit

Hey there! I wanted to come.back and say that I am likely wrong. It looks like Microsoft has added support for the webauthn protocol to be tunneled through the native RDP client. I havent used it, but I see the option now. It wasn't there last time I checked, sorry for giving bad info.

[-]

RestinRIP1990@reddit (OP)

I have yet to see this option, but have seen screenshots. Did you have to do anything to activate it?

[-]

justmirsk@reddit

Not that I know of. I haven't checked OS versions, but I am on fully patched Win 10 Pro 22H2 and it is there. I would imagine redirecting USb and the protocol would suffice. Personally, I am not sure how I feel about redirecting the webauthn protocol. The whole point is to make sure you are physically present, allowing this to go to remote servers opens up the possibility for attack. I get the VDI piece to a degree, but I see this being abused in the near future.

[-]

justmirsk@reddit

I am not aware of any way to get the FIDO2 protocol to tunnel through the RDP protocol.