AuthPoint Gateway now supports EAP-MSCHAPv2 for IKEv2 VPNs

Why one app

Until now, AuthPoint and FireCloud each had their own client on the computer: the AuthPoint Logon App and the FireCloud Connection Manager. The Access App replaces both. With both products, two installations become one, and users have one app to learn instead of two. If you have one of them, adding the other later does not mean deploying another client.

What it does

It depends on the licenses in the account. With AuthPoint, users verify their identity when they sign in to their computer, and they open their web applications from the app's portal. They can approve a push notification, scan a QR code, or use a one-time passcode or a hardware token. With FireCloud, the app keeps the computer connected to FireCloud and gives users access to FireCloud resources. With both, web applications and FireCloud resources are in the same portal. Users keep the same accounts and tokens, so there is nothing to enroll again.

Before you install

The app runs on Windows 10 and 11 and on macOS 13 through 27. On Windows Server, the app is for AuthPoint sign-in, and FireCloud on macOS requires macOS 15 or later. The app takes the place of the Logon App and the Connection Manager on each computer where you install it, and its new configuration file sets it up. You can use the beta in production accounts, and as with any beta, a pilot group of users is the best place to start.

Ready to join the beta?

1. Sign up at https://watchguard.centercode.com/wgaccess with your WatchGuard account. You will receive an invitation to the WatchGuard Access App beta.
2. In WatchGuard Cloud, go to Administration > Beta Features and turn on WatchGuard Access App. Do this before you install, so that on computers that run the WatchGuard Agent, the app can take over from the Connection Manager. To show FireCloud resources in the app, also turn on Show FireCloud Resources to End-Users. Service providers can turn on both for the accounts they manage.
3. Download the installer and its configuration file from WatchGuard Cloud, and install the app. The installation needs both files.

You can use your existing AuthPoint and FireCloud licenses, including NFR licenses. If you do not have them yet, start a trial of AuthPoint, FireCloud, or both.

Share your feedback in Centercode, where our engineering and product teams review it to improve the app. If we publish a beta refresh, we will let you know in Centercode and in WatchGuard Cloud, and you update by running the new installer. Otherwise, beta installations need no action when the app becomes generally available.

AuthPoint now keeps a single sign-in session across SAML and OIDC applications. Until this release, AuthPoint held a separate session for each protocol, so a user who authenticated to an OIDC application and then opened a SAML application a few minutes later was challenged again, even though they'd already proven who they were. With Unified Session, one authentication now covers both protocols for the life of the session: the user signs in once and moves between SAML and OIDC applications without a second MFA prompt.

This closes a gap our own launches surfaced. Passkeys reached OIDC applications in February, External MFA for Microsoft Entra ID went generally available in March, and passkeys reached SAML applications in May. Once the same passkey covered both protocols, the fact that AuthPoint still treated them as two separate sessions became hard to miss. This release delivers it: identity, not protocol, is now what AuthPoint tracks a session against.

Unified Session applies automatically — there's nothing to turn on — to SAML and OIDC applications federated through AuthPoint in any account that already has both protocols configured in WatchGuard Cloud and is included with AuthPoint MFA and AuthPoint Total Identity Security licenses at no additional cost — see the AuthPoint release notes and Help Center for details, or reach out to your WatchGuard Account Manager with questions.

User Inheritance for Delegated Accounts

User Inheritance lets a Service Provider reuse one AuthPoint user across the accounts it manages, so a technician can authenticate to protected resources in those accounts without a separate licensed identity in each one. This already worked for child accounts. It now extends to delegated accounts, the accounts a customer owns and has delegated to a partner to manage.

Because a delegated account belongs to the customer, the customer stays in control. The Service Provider makes a user available to one or more delegated accounts. An operator on the customer account approves the request and assigns the groups and access policy the inherited user operates under. Once approved, the user authenticates to that account's AuthPoint-protected resources under the assigned policy.

A few things worth knowing:

• The inherited user consumes no AuthPoint user license in the customer account. The identity is licensed once, on the Service Provider account, regardless of how many accounts inherit it.
• No additional token is required. The inherited user authenticates with their existing token.
• Either side can end the inheritance at any time. If the customer revokes the delegation, the inherited user is removed automatically, with no orphaned access left behind.
• User and token management stay centralized on the Service Provider account.
• Service Providers manage delegated accounts within their own cloud region, so inheritance to delegated accounts is same-region.

RADIUS Authentication Reliability Enhancements

AuthPoint now runs RADIUS authentication, used for VPN and network access, across multiple AWS regions. If the region serving authentication becomes unavailable, the service can be recovered in another region instead of staying down until the original region is restored. This matters for partners supporting clients where network access cannot stay offline. This release also includes enhancements to prevent impacts caused by DDoS attacks, further strengthening the reliability of the authentication service. To take full advantage of these improvements make sure you are running the latest version of the AuthPoint Gateway.

Have Questions?

Refer to the AuthPoint release notes and the User Inheritance for Service Providers or User Inheritance for Managed Accounts pages on the AuthPoint Help Center for more information. For questions, contact your WatchGuard Account Manager or use standard support channels.