A Remote Desktop Protocol (RDP) connection fails when a user attempts to connect to a Windows Server via Okta Advanced Server Access (ASA) using a project that forwards traffic through the ASA Gateway. This occurs because the RDP client that the ASA Gateway uses does not support the encryption methods that Windows servers use for licensing packets during RDP negotiation. Upgrading the ASA Gateway to version 1.79.2 or later resolves the issue. The connection failure happens when the Windows Server uses the Remote Desktop Licensing Role and runs the Remote Desktop Licensing service. The following error appears in the ASA Gateway logs:

"MESSAGE" : "2023-05-11T20:33:00.319Z\tERROR\tsecurityFlags=SEC_AUTODETECT_REQ[0x00001000], missing required flag SEC_LICENSE_PKT[0x00000080]\t{"peerchild": "gatewayd-agent", "source": "rdp_internal"}",

"MESSAGE" : "2023-05-11T20:33:00.319Z\tERROR\tCONNECTION_STATE_LICENSING status STATE_RUN_FAILED [-1]\t{"peerchild": "gatewayd-agent", "source": "rdp_internal"}",

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• ASA Gateway version below 1.79.2
• Target Windows server that uses the Remote Desktop Licensing Role or Remote Desktop Session Host role

The Remote Desktop Protocol (RDP) client that the Okta Advanced Server Access (ASA) Gateway uses in affected versions does not support the encryption methods that Windows servers use for the licensing packets during RDP negotiation.

How does an administrator resolve the Remote Desktop Protocol connection failure?

Upgrade the Okta Advanced Server Access (ASA) Gateway to version 1.79.2 or later to resolve the connection failure.

1. Upgrade the ASA Gateway to version 1.79.2 or later.

NOTE: Mac clients must use MacFreeRDP version 1.72.1 or later in addition to installing the upgraded ASA Gateway.