feat(dgw): provision the target-side KDC for credential injection

[irvingouj@Devolutions (irvingoujAtDevolution)]

This PR add OP_PROVISION_CONNECTION_OPTIONS, that is, for now, just kdc in there.
Then uses it, construct kdc sessions in each handler on demand.

It is already complete in terms of functionality, but I do believe that the bondary is starting to blur.

Most importantly
CredentialService is taking more responsibility than it should.

[Copilot]

Pull request overview

Adds target-side KDC provisioning for Kerberos credential injection.

Changes:

• Adds validated connection options and a preflight provisioning operation.
• Splits credential and connection-option storage with independent expiry.
• Routes target-side Kerberos requests through the provisioned KDC.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/preflight.rs	Tests provisioning operations.
src/target_connection_options.rs	Defines validated KDC options.
src/target_addr.rs	Adds URL conversion.
src/rdp_proxy.rs	Configures target-side Kerberos.
src/provisioning.rs	Stores credentials and options independently.
src/lib.rs	Registers the new module.
src/kdc_connector.rs	Shares supported KDC schemes.
src/credential_injection_kdc.rs	Carries options into session state.
src/api/preflight.rs	Adds the provisioning operation.

Comments suppressed due to low confidence (1)

devolutions-gateway/src/rdp_proxy.rs:405

• The core new routing behavior is not covered by the existing tests in this file: they only exercise injection_uses_kerberos, while no test verifies that a provisioned KDC becomes the client kdc_proxy_url (or that Kerberos rejects a missing KDC). Add focused coverage for both cases to prevent the target-side wiring from regressing.

    Ok(CredentialInjectionKerberosConfigs {
        server: Some(credential_injection_kdc.server_kerberos_config(client_addr)?),
        client: Some(ironrdp_connector::credssp::KerberosConfig {
            kdc_proxy_url: Some(url::Url::try_from(krb_kdc).context("convert target KDC address to URL")?),
            hostname: gateway_hostname.to_owned(),

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[Benoît Cortier (CBenoit)]

Approving for velocity, but consider fixing these issues

[Benoît Cortier (CBenoit)]

This only proves that the serialized TargetAddr can be parsed as a URL; it does not prove both parsers describe the same endpoint. For example, tcp://dc.example/path:88 becomes a TargetAddr whose host is dc.example/path, while Url treats /path:88 as a path. Provisioning ACKs it, but the later KDC connector reparses it and attempts to resolve the malformed host. Please validate a URL first and reject user info, paths, queries, and fragments before deriving the TargetAddr.

Note

Human-tuned, LLM-assisted content.

[irvingouj@Devolutions (irvingoujAtDevolution)]

Fixed: krb_kdc is now parsed as a Url first. We require scheme tcp/udp, a host, an explicit port, and reject userinfo/path/query/fragment before storing it. CredSSP receives that Url directly.

Note

LLM-assisted content (no human feedback).

[Benoît Cortier (CBenoit)]

I do not think this conversion belongs on TargetAddr: it is only needed for the KDC option, and TargetAddr and Url accept different syntax. Validate and retain a Url in TargetConnectionOptions instead, then pass it to CredSSP directly.

Note

Human-tuned, LLM-assisted content.

[irvingouj@Devolutions (irvingoujAtDevolution)]

Fixed: dropped TryFrom<&TargetAddr> for Url. TargetConnectionOptions keeps a validated Url and passes it straight to CredSSP.

Note

LLM-assisted content (no human feedback).