Skip to content

RDP proxy server-side Kerberos support #1396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

TheBestTvarynka
Copy link

@TheBestTvarynka TheBestTvarynka commented Jun 26, 2025

Hi,
I added server-side Kerberos support for the RDP proxy feature. I tried to make as few changes as possible.

The Kerberos server feature is unstable, so it will work only if you enable the enable_unstable in config file and provide the Kerberos server configuration. Here is an example of my cofig:

  "__debug__": {
    "enable_unstable": true,
    "kerberos_server": {
      "max_time_skew": 64,
      "ticket_decryption_key": [105, 224, 208, 190, 41, 253, 44, 134, 64, 29, 178, 11, 37, 172, 124, 169, 48, 202, 121, 255, 218, 220, 247, 114, 141, 182, 249, 108, 60, 251, 145, 17]
    }
  }

If the enable_unstable is not enabled, then the Kerberos server feature will not work and NTLM server will be used (even if you provide the Kerberos config).

UsernamePassword { username: String, password: Password },
UsernamePassword {
username: String,
domain: Option<String>,
Copy link
Member

@CBenoit CBenoit Jun 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: The absence of the domain field is intentional, we decided to focus on supporting only the FQDN/UPN format, e.g.: username@domain via the username field.
This is handled cleanly by sspi::Username::parse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants