-
Notifications
You must be signed in to change notification settings - Fork 21
RDP proxy server-side Kerberos support #1396
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
RDP proxy server-side Kerberos support #1396
Conversation
UsernamePassword { username: String, password: Password }, | ||
UsernamePassword { | ||
username: String, | ||
domain: Option<String>, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
issue: The absence of the domain field is intentional, we decided to focus on supporting only the FQDN/UPN format, e.g.: username@domain via the username field.
This is handled cleanly by sspi::Username::parse
.
devolutions-gateway/src/rdp_proxy.rs
Outdated
let response = network_client | ||
.send(&request) | ||
.await | ||
.inspect_err(|err| error!(?err, "Failed to send a Kerberos message")) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nitpick: Verify this inspect_err
is really necessary, since we are already propagating the original error.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
removed inspect_err
406f0f8
to
60b5d33
Compare
The newer IronRDP crates are published! |
Hi,
I added server-side Kerberos support for the RDP proxy feature. I tried to make as few changes as possible.
The Kerberos server feature is unstable, so it will work only if you enable the
enable_unstable
in config file and provide the Kerberos server configuration. Here is an example of my cofig:If the
enable_unstable
is not enabled, then the Kerberos server feature will not work and NTLM server will be used (even if you provide the Kerberos config).