RDP proxy server-side Kerberos support #1396

TheBestTvarynka · 2025-06-26T13:00:06Z

Hi,
I added Kerberos support for the RDP proxy.

This is the first PR in a series of PRs for the Kerberos credentials injection feature. I tried to make as few changes as possible.

The Kerberos server feature is unstable, so it will only work if you enable the enable_unstable option in the config file and provide the Kerberos server configuration. Here is an example of my config:

  "__debug__": {
    "disable_token_validation": true,
    "enable_unstable": true,
    "kerberos_server": {
      "realm": "625afe33-7041-43c4-b4f9-a63a4b7939ef.jet",
      "users": [
        {
          "username": "fake_user@625afe33-7041-43c4-b4f9-a63a4b7939ef.jet",
          "password": "fake_password",
          "salt": "625afe33-7041-43c4-b4f9-a63a4b7939ef.jetfake_user"
        }
      ],
      "krbtgt_key": [230, 176, 177, 188, 175, 216, 176, 149, 34, 213, 40, 102, 107, 175, 106, 164, 76, 187, 225, 146, 182, 58, 143, 28, 119, 5, 83, 229, 4, 209, 93, 237],
      "max_time_skew": 64,
      "ticket_decryption_key": [105, 224, 208, 190, 41, 253, 44, 134, 64, 29, 178, 11, 37, 172, 124, 169, 48, 202, 121, 255, 218, 220, 247, 114, 141, 182, 249, 108, 60, 251, 145, 17]
    }

If enable_unstable is not enabled, then NTLM will be used (even if you provide the Kerberos configuration).

We need the KDC implementation within the KDC proxy to support Kerberos credential injection fully. I will provide it in a separate PR.

CBenoit · 2025-06-26T14:49:28Z

devolutions-gateway/src/credential.rs

-    UsernamePassword { username: String, password: Password },
+    UsernamePassword {
+        username: String,
+        domain: Option<String>,


issue: The absence of the domain field is intentional, we decided to focus on supporting only the FQDN/UPN format, e.g.: username@domain via the username field.
This is handled cleanly by sspi::Username::parse.

CBenoit · 2025-07-01T11:24:26Z

devolutions-gateway/src/rdp_proxy.rs

+                let response = network_client
+                    .send(&request)
+                    .await
+                    .inspect_err(|err| error!(?err, "Failed to send a Kerberos message"))


nitpick: Verify this inspect_err is really necessary, since we are already propagating the original error.

removed inspect_err

CBenoit · 2025-07-08T14:03:29Z

The newer IronRDP crates are published!

…Kerberos server config;

Copilot

Pull Request Overview

This PR updates the ironrdp dependencies from version 0.5 to 0.6 and adds support for Kerberos server configuration during RDP proxying with DNS resolution capabilities.

Updates ironrdp-tokio, ironrdp-connector, and ironrdp-acceptor packages to version 0.6
Adds Kerberos server configuration structures and support for User-to-User authentication
Integrates ReqwestNetworkClient for DNS resolution during CredSSP authentication

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
devolutions-gateway/Cargo.toml	Updates ironrdp dependencies to 0.6 and adds reqwest feature to ironrdp-tokio
Cargo.lock	Reflects dependency updates including tokio 1.48.0, sspi 0.16.1, and new DNS resolution libraries
devolutions-gateway/src/config.rs	Adds DomainUser and KerberosServer configuration structures for Kerberos authentication
devolutions-gateway/src/rdp_proxy.rs	Integrates Kerberos server config, network client for DNS resolution, and new generator resolver functions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

devolutions-gateway/src/config.rs

TheBestTvarynka · 2025-11-06T17:05:54Z

@CBenoit, This PR is now ready for review again. I will update the PR description soon, but you can review it in the meantime.

In short: I implemented Kerberos support for the RDP proxy. We need the KDC implementation within the KDC proxy to support Kerberos credential injection fully. I will provide it in a separate PR.

TheBestTvarynka · 2025-11-06T18:07:36Z

https://github.com/Devolutions/devolutions-gateway/actions/runs/19143172252/job/54713922610?pr=1396#step:3:500

Exception: /home/runner/work/devolutions-gateway/devolutions-gateway/ci/check-crate-is-not-in-the-tree.ps1:24
Line |
  24 |      throw "$UnwantedDependency was found in the dependency tree of $P …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | aws-lc-rs was found in the dependency tree of devolutions-gateway crate

Kerberos support requires the network client to send requests to the KDC, so I enabled the reqwest feature in ironrdp-tokio, which in turn added reqwest -> rustls -> aes-lc-rs crates to the dependency tree.

Why don't we want aws-lc-rs in the dependency tree of the devolutions-gateway? I see this requirement was added in #1092, but it does not explain why.

I see that KDC proxy extracts KDC URL from the JWT token and expects it to have "tcp" or "udp" scheme. Can I assume the same applies to the RDP proxy and add the KDC URL to the configuration file?

CBenoit · 2025-11-07T09:16:00Z

https://github.com/Devolutions/devolutions-gateway/actions/runs/19143172252/job/54713922610?pr=1396#step:3:500
Exception: /home/runner/work/devolutions-gateway/devolutions-gateway/ci/check-crate-is-not-in-the-tree.ps1:24
Line |
  24 |      throw "$UnwantedDependency was found in the dependency tree of $P …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | aws-lc-rs was found in the dependency tree of devolutions-gateway crate
Kerberos support requires the network client to send requests to the KDC, so I enabled the reqwest feature in ironrdp-tokio, which in turn added reqwest -> rustls -> aes-lc-rs crates to the dependency tree.

Maybe there is a problem in how we handle the dependencies in ironrdp-tokio? We are supposed to be able to choose the backend (I see features such as reqwest-rustls-ring). An alternative is to disable all the backends in the library, and let the consumer install the default crypto provider. But it’s also tricky because we need to make sure reqwest is using the certificates from the native certificate store. This can be implemented manually too. Another alternative is to implement the AsyncNetworkClient client directly in the Devolutions Gateway. We don’t have to use the one provided by ironrdp-tokio necessarily, if it’s not a good fit.

Why don't we want aws-lc-rs in the dependency tree of the devolutions-gateway? I see this requirement was added in #1092, but it does not explain why.

We don’t want to have both aws-lc-rs AND ring in the same build. We only need one crypto backend. Embedding more just make the executable bigger for no compelling reason so far.

I know it’s not very fun to deal with that, but it’s a problem with how dependency injection is implemented for rustls (not that I would have done better).

I see that KDC proxy extracts KDC URL from the JWT token and expects it to have "tcp" or "udp" scheme. Can I assume the same applies to the RDP proxy and add the KDC URL to the configuration file?

I guess we need to talk to the real KDC too? Is there a reason why we would prefer not having the tcp or udp scheme? I think there is both a TCP and a UDP mode (at least as far as I can see in the KDC proxy module).

CBenoit · 2025-11-07T09:29:22Z

devolutions-gateway/src/config.rs

+        pub users: Vec<DomainUser>,
+        /// The maximum allowed time difference between client and proxy clocks
+        ///
+        /// The value must be in seconds.


Suggested change

/// The value must be in seconds.

/// The value is expressed in seconds.

CBenoit · 2025-11-07T09:32:00Z

devolutions-gateway/src/rdp_proxy.rs

+    let krb_server_config = if conf.debug.enable_unstable {
+        if let Some(KerberosServer {


suggestion: You can probably collapse the nested if by using if-let-chain

let krb_server_config = if conf.debug.enable_unstable && if let Some(KerberosServer { … }) = config.debug.kerberos_server.as_ref() {

CBenoit · 2025-11-07T09:32:51Z

devolutions-gateway/src/rdp_proxy.rs

+                    username, // The username is in the FQDN format. Thus, the domain field can be empty.
+                    "", password,


suggestion: Maybe move the comment just above the line CredentialsBuffers::AuthIdentity(AuthIdentityBuffers::from_utf8(

CBenoit · 2025-11-07T09:33:17Z

devolutions-gateway/src/rdp_proxy.rs

+
+            Some(KerberosServerConfig {
+                kerberos_config: SspiKerberosConfig {
+                    // The sspi will automatically try to resolve the KDC host via DNS and/or environment variable.


Suggested change

// The sspi will automatically try to resolve the KDC host via DNS and/or environment variable.

// The sspi library will automatically try to resolve the KDC host via DNS and/or environment variable.

CBenoit · 2025-11-07T09:33:39Z

devolutions-gateway/src/rdp_proxy.rs

        security_protocol,
        ironrdp_connector::ServerName::new(server_name),
        server_public_key,
+        // We do not need to specify the Kerberos config here: the sspi-rs can automatically resolve the KDC host via DNS and/or env variable.


Suggested change

// We do not need to specify the Kerberos config here: the sspi-rs can automatically resolve the KDC host via DNS and/or env variable.

// We do not need to specify the Kerberos config here: sspi-rs can automatically resolve the KDC host via DNS and/or env variable.

CBenoit · 2025-11-07T09:35:02Z

devolutions-gateway/src/rdp_proxy.rs

        security_protocol,
        ironrdp_connector::ServerName::new(server_name),
        server_public_key,
+        // We do not need to specify the Kerberos config here: the sspi-rs can automatically resolve the KDC host via DNS and/or env variable.


note: I’m pretty sure we’re not going to use the env variables. Do you think the DNS approach is enough?

Do you think the DNS approach is enough?

I improved the KerberosServr structure: I added an ability to configure the KDC address

CBenoit

This is looking good to me overall. We need to address the dependency issue and we can merge.

…oxy and add ability to configure KDC addr;

TheBestTvarynka · 2025-11-12T16:15:39Z

I guess we need to talk to the real KDC too?

Yes, you are right.

Is there a reason why we would prefer not having the tcp or udp scheme?

I think no.

I think there is both a TCP and a UDP mode (at least as far as I can see in the KDC proxy module).

I refactored this part. I reused the KDC proxy code and implemented a simple network client based on its code.

Can you review it again?

TheBestTvarynka · 2025-11-14T12:47:41Z

@CBenoit The CI has failed because the hardcoded certificate (end-certificate in the certificate chain) had expired on November 5th:

devolutions-gateway/testsuite/tests/cli/jetsocat.rs

Lines 346 to 445 in 4304148

    
               const EXPIRED_DEVOLUTIONS_NET_CHAIN: &str = " 
        
           -----BEGIN CERTIFICATE----- 
        
           MIIHjDCCBXSgAwIBAgIQA+YDg5H+4+jZc0rMWYNN1zANBgkqhkiG9w0BAQsFADBc 
        
           MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xNDAyBgNVBAMT 
        
           K0dlb1RydXN0IEdsb2JhbCBUTFMgUlNBNDA5NiBTSEEyNTYgMjAyMiBDQTEwHhcN 
        
           MjUwNTA3MDAwMDAwWhcNMjUxMTA0MjM1OTU5WjAaMRgwFgYDVQQDEw9kZXZvbHV0 
        
           aW9ucy5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDT4diIqDe8 
        
           YF5wuSq8jDBOF5fx2nRddscoeEnhyiCktaoXMWy+3CMh3dxDdqy4WUVInmC9AsXa 
        
           /1VyT95XbUtxXTZbN+vW6N6/8Al+d5d/fct7wMnIh/ZWyJvDprVvI1zDnuudLXjR 
        
           8m5R9yxa9wivX/NUIoPp6++qDR905BTayf0DrmdnTEAWu++xEJi7NtE2MAH/fcHd 
        
           /MDpzKMCym9aS38IKFZNhwBxXMPuqmGC5eHjJ/YLDUWNuAyyD1AOZoYOxjOA0K10 
        
           v1Tva02xwi0vh73uYoQvDQmOMAOTN6FFN6wHXYF2xZi5dI68HJnYa9laszorPs/B 
        
           2SOUGIG1280NAgMBAAGjggOKMIIDhjAfBgNVHSMEGDAWgBSltNbrNsTna6bfxGQL 
        
           ASogBLhmIzAdBgNVHQ4EFgQUwGsZkQ58uMYU+jeMNgc1SfbfkCgwGgYDVR0RBBMw 
        
           EYIPZGV2b2x1dGlvbnMubmV0MD4GA1UdIAQ3MDUwMwYGZ4EMAQIBMCkwJwYIKwYB 
        
           BQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMC 
        
           BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMIGfBgNVHR8EgZcwgZQw 
        
           SKBGoESGQmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9HZW9UcnVzdEdsb2JhbFRM 
        
           U1JTQTQwOTZTSEEyNTYyMDIyQ0ExLmNybDBIoEagRIZCaHR0cDovL2NybDQuZGln 
        
           aWNlcnQuY29tL0dlb1RydXN0R2xvYmFsVExTUlNBNDA5NlNIQTI1NjIwMjJDQTEu 
        
           Y3JsMIGHBggrBgEFBQcBAQR7MHkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp 
        
           Z2ljZXJ0LmNvbTBRBggrBgEFBQcwAoZFaHR0cDovL2NhY2VydHMuZGlnaWNlcnQu 
        
           Y29tL0dlb1RydXN0R2xvYmFsVExTUlNBNDA5NlNIQTI1NjIwMjJDQTEuY3J0MAwG 
        
           A1UdEwEB/wQCMAAwggF9BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB3ABLxTjS9U3JM 
        
           hAYZw48/ehP457Vih4icbTAFhOvlhiY6AAABlqw1+UoAAAQDAEgwRgIhAK1rv7SB 
        
           +jm8Qy1YbH6ye6D/QhV9UIb/naDS1xbyazxIAiEAmy3tsZ38AwMsHGXjYTn2ONiN 
        
           4rIO6W4ESWbmopwmvT8AdQDtPEvW6AbCpKIAV9vLJOI4Ad9RL+3EhsVwDyDdtz4/ 
        
           4AAAAZasNfmFAAAEAwBGMEQCIBOIOKPB2twwfv7NfboUHZZtC1sOXiYa4jYzqwpk 
        
           S06kAiAwEM/shWHMYfV5quqQuJQ2Ru0iFKigAjxN4g3NDMU4KgB1AKRCxQZJYGFU 
        
           jw/U6pz7ei0mRU2HqX8v30VZ9idPOoRUAAABlqw1+ZoAAAQDAEYwRAIgRNq7xMon 
        
           czeiHM+1ruQeN0OUZjI+PM+H9RGtFCm7Y6wCICq0jMeJCkwJas+oCsbKolEA5737 
        
           pGcv+X94dwYwZ824MA0GCSqGSIb3DQEBCwUAA4ICAQCuLE+wNbMBu7YgW8XUfblH 
        
           zuL9Xb70CaEdQelfGIMrMAHVo30TkG3kyP4N241wbqH8CXWuYDYf/QW8tmiPFb/G 
        
           qjBbY/NhGMYMUqTG3u3rziuftgxi+OGducepUfTEgLLTFg03M25UpnHP8+EXhR/d 
        
           YchKc+YGtM9EWUXn8/EDFra1zpX9rxzEplvlQWYhYQcLAVezwMIo6UlauFj7dIq9 
        
           PIdUrnA09Rd3vYTIvGVlj8bTuTYTWdn2XthGq2rhzPNUorjh46xjmKet9+De7+n3 
        
           Z2Xvvv+iPr1JKRVB3qVPMJGCWWCFhl8iiRWwQ06pzgH9MQVezK0IABy5J2gxF0yB 
        
           MG5TiQpZdB2Nzi6qyzoK5EzXdaOjXH7CNWaw5ucWvQT3GoZeqRcVyFkE96iMRwJk 
        
           qQJ1mT3qDeqGshspR4Zo+wLcnfCPW9M0Mf/y/MGtlWMYvZ90jawO97s+bE2EXCt0 
        
           cDfm2stigBGm9EGx4zfMjWJ5PEtfBFdG0LMAaw7gySQUi2MTrK/oEmS6e0EOwK5F 
        
           f2AVMEB2Vc/YlNRvZR0YDY8q7VV2SI1SkCdXNNDyzzyA8IL6JGCe52cyiCIurXsT 
        
           Z+qKTR86hhmsa5bMSygfBjxTHUqTUjuqf5brc2beyvvZs7R9FhUqNLmGrIb+tdjj 
        
           VQoGRDW+K3J2NzNPL6XuYg== 
        
           -----END CERTIFICATE----- 
        
           -----BEGIN CERTIFICATE----- 
        
           MIIFyzCCBLOgAwIBAgIQD2IvbyHC/11SH3I6HUfWLTANBgkqhkiG9w0BAQsFADBh 
        
           MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 
        
           d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD 
        
           QTAeFw0yMjA1MDQwMDAwMDBaFw0zMTExMDkyMzU5NTlaMFwxCzAJBgNVBAYTAlVT 
        
           MRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjE0MDIGA1UEAxMrR2VvVHJ1c3QgR2xv 
        
           YmFsIFRMUyBSU0E0MDk2IFNIQTI1NiAyMDIyIENBMTCCAiIwDQYJKoZIhvcNAQEB 
        
           BQADggIPADCCAgoCggIBAOi2w4fkhoZPCI6L7nLMjvJTFg2rvXa7JPgQtpm9Ls4Z 
        
           9u2/SuiTDcjnGfjMYq9uTdBsiRjCC8fh3HsrPMCCAvfAf7bY349rOV4XWTGXZ2RS 
        
           UE20zKyhiF1Z+SkySD5+9yxzLNEyb+JXN8LLLcyB2Hw79jEq6v09+8zL5Ip3wFz9 
        
           +Uc3Tx4LVwTvW50pGMHFl3xpjO7iQS2RCkNcHHdqfEEkKy8EStVGA27aYYuHbgdx 
        
           ivjv0Axx3M4NrWfO8tGj8w0t8LhKDTuk/gFOI4klRcHRjcuH6giK6mkM3qpGGQLW 
        
           +Zc7Q93NFXalE5Qzn5/JESIcSPFDOezoAi9fMdtEa7Qj9/yCaUx5S14l66zlE1Od 
        
           y5hzpQBOlsw9KjJxsfpc4LQTB8aDaNjSqzLpwj6XlsRjaRon9GSS1q6HDYI3o8pR 
        
           x03xM1k7JTgiyyRO+84PVjLUOxy6u4SrEXRM0jdtxqnzfwW2CFsKo+5xHZB9xt5m 
        
           82zwUzY7+VOHEg8YpJxS2N6HR6QBvxo/6pgyfdmwAjiOGhA1GfHvQWf2vyHNguLq 
        
           1Jn4gr0b27HMZl6yqquv9O9XgDjPk147eym8GbN6AmBBke0HXR8fPwier1spgIoB 
        
           W3txZY6OiJr/JRl2n5MnUZ3QdyFfvzfkuBWwVCI7WI4gVJmhkOMeG9grhIRPm+zH 
        
           AgMBAAGjggGCMIIBfjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSltNbr 
        
           NsTna6bfxGQLASogBLhmIzAfBgNVHSMEGDAWgBQD3lA1VtFMu2bwo+IbG8OXsj3R 
        
           VTAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC 
        
           MHYGCCsGAQUFBwEBBGowaDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNl 
        
           cnQuY29tMEAGCCsGAQUFBzAChjRodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20v 
        
           RGlnaUNlcnRHbG9iYWxSb290Q0EuY3J0MEIGA1UdHwQ7MDkwN6A1oDOGMWh0dHA6 
        
           Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwPQYD 
        
           VR0gBDYwNDALBglghkgBhv1sAgEwBwYFZ4EMAQEwCAYGZ4EMAQIBMAgGBmeBDAEC 
        
           AjAIBgZngQwBAgMwDQYJKoZIhvcNAQELBQADggEBAJ5ytcBRxwtzXW/S2tOySJu4 
        
           bhFRUuYRF91SMDUX8aX8Z/JIdLZb1+d6LIaiVkybFKYL8K2xual6/NL0tcI0T3Nw 
        
           /QNwS12NrfbS/th9aus7kiSbnNbkM2sc61vx9lF0qYklhJzSOkUPPSyq4Bdhg8G6 
        
           puAqrvQNqxNNMTTyMs5KNJdpLMEdIKdelM+9KKEMy9/jWGuLoNr8BvjkDx19VQSI 
        
           MCrwTFiQSC3sMkZQrCgZIwnQbf2ynOSMDutLoja5uKB7l+vbH2qSPFf3vD2HoTH7 
        
           S8+k0HfXb/f7ZSM5GDln3DTbBPI2qmmMiwFZJOMuYAQP1cyP8ywlhfdEdKVcW6E= 
        
           -----END CERTIFICATE----- 
        
           -----BEGIN CERTIFICATE----- 
        
           MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh 
        
           MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 
        
           d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD 
        
           QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT 
        
           MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j 
        
           b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG 
        
           9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB 
        
           CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97 
        
           nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt 
        
           43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P 
        
           T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4 
        
           gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO 
        
           BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR 
        
           TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw 
        
           DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr 
        
           hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg 
        
           06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF 
        
           PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls 
        
           YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk 
        
           CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= 
        
           -----END CERTIFICATE-----"; 
        
           }

I do not think I can regenerate them, because the CA cert and the middle certs are trusted.

CBenoit reviewed Jun 26, 2025

View reviewed changes

CBenoit reviewed Jul 1, 2025

View reviewed changes

TheBestTvarynka force-pushed the feat/rdp-proxy-kebreros-support branch from 406f0f8 to 60b5d33 Compare July 8, 2025 11:02

TheBestTvarynka force-pushed the feat/rdp-proxy-kebreros-support branch from 60b5d33 to c4adbb1 Compare September 9, 2025 16:19

TheBestTvarynka changed the base branch from master to dev/rdp-kerberos-credentials-injection November 6, 2025 16:31

TheBestTvarynka added 8 commits November 6, 2025 18:41

feat(devolutions-gateway): RDP proxy server-side Kerberos support;

a96af44

refactor(devolutions-gateway): small refactoring;

77379f8

refactor(devolutions-gateway): code clean-up;

5374877

refactor(devolutions-gateway): more doc comments;

43cda90

refactor(devolitions-gateway): better error handling;

a152cbc

refactor(devolutions-gateway): rdp proxy small refactoring;

f12ae57

feat(devolutions-gateway): remove domain from credentials and update …

061297b

…Kerberos server config;

chore: fix compilation;

ef23b69

TheBestTvarynka force-pushed the feat/rdp-proxy-kebreros-support branch from d60b303 to ef23b69 Compare November 6, 2025 16:48

CBenoit requested a review from Copilot November 6, 2025 16:51

Copilot AI reviewed Nov 6, 2025

View reviewed changes

devolutions-gateway/src/config.rs Outdated Show resolved Hide resolved

devolutions-gateway/src/config.rs Outdated Show resolved Hide resolved

TheBestTvarynka marked this pull request as ready for review November 6, 2025 17:05

refactor(devolutions-gateway): small refactoring;

606a900

CBenoit reviewed Nov 7, 2025

View reviewed changes

feat(devolutions-gateway): implement custom network client for rdp pr…

5450f44

…oxy and add ability to configure KDC addr;

TheBestTvarynka added 2 commits November 12, 2025 17:16

refactor(devolutions-gateway): restructure modules;

fa6942f

refactor(devolutions-gateway): small refactoring;

0fe4e93

	/// The value must be in seconds.
	/// The value is expressed in seconds.

		let krb_server_config = if conf.debug.enable_unstable {
		if let Some(KerberosServer {

		username, // The username is in the FQDN format. Thus, the domain field can be empty.
		"", password,

	// The sspi will automatically try to resolve the KDC host via DNS and/or environment variable.
	// The sspi library will automatically try to resolve the KDC host via DNS and/or environment variable.

	// We do not need to specify the Kerberos config here: the sspi-rs can automatically resolve the KDC host via DNS and/or env variable.
	// We do not need to specify the Kerberos config here: sspi-rs can automatically resolve the KDC host via DNS and/or env variable.

RDP proxy server-side Kerberos support #1396

Are you sure you want to change the base?

RDP proxy server-side Kerberos support #1396

Conversation

TheBestTvarynka commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CBenoit Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CBenoit commented Jul 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

TheBestTvarynka commented Nov 6, 2025

Uh oh!

TheBestTvarynka commented Nov 6, 2025

Uh oh!

CBenoit commented Nov 7, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CBenoit left a comment

Choose a reason for hiding this comment

Uh oh!

TheBestTvarynka commented Nov 12, 2025

Uh oh!

TheBestTvarynka commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

TheBestTvarynka commented Jun 26, 2025 •

edited

Loading

CBenoit Jun 26, 2025 •

edited

Loading

TheBestTvarynka commented Nov 14, 2025 •

edited

Loading