fix(dgw): reuse credential injection across reconnects

[irvingouj@Devolutions (irvingoujAtDevolution)]

Keep provisioned injection mappings until the association token acceptance deadline so native reconnects can reuse the same JWT. Checkout fails closed when required material is missing, and it happens before the upstream dial so a missing Kerberos KDC never opens a target socket.

Generic RDP and RDCleanPath share the CredSSP session path. Kerberos injection uses the token dst_hst for the client-facing TERMSRV SPN.

Issue: DVLS-14697

[Copilot]

Pull request overview

Refactors RDP credential injection by separating provisioning, synthetic KDC registration, and CredSSP orchestration.

Changes:

• Splits RDP proxy and CredSSP logic into dedicated modules.
• Replaces CredentialService with a one-shot provisioning store and live KDC registry.
• Updates all connection and API paths to use the new architecture.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
devolutions-gateway/src/service.rs	Initializes and wires the new stores.
devolutions-gateway/src/rdp_proxy/mod.rs	Adds RDP handshake and TLS orchestration.
devolutions-gateway/src/rdp_proxy/credssp.rs	Encapsulates CredSSP MITM behavior.
devolutions-gateway/src/rdp_proxy.rs	Removes the former monolithic proxy.
devolutions-gateway/src/rd_clean_path.rs	Integrates new credential-injection state.
devolutions-gateway/src/provisioning.rs	Makes provisioning retrieval one-shot.
devolutions-gateway/src/ngrok.rs	Updates state wiring.
devolutions-gateway/src/listener.rs	Updates TCP client construction.
devolutions-gateway/src/lib.rs	Replaces credential-service state fields.
devolutions-gateway/src/generic_client.rs	Builds session-scoped credential injection.
devolutions-gateway/src/credential_injection.rs	Adds credential and synthetic KDC runtime.
devolutions-gateway/src/credential_injection_kdc.rs	Removes the previous combined service.
devolutions-gateway/src/api/rdp.rs	Passes new state into RDP handling.
devolutions-gateway/src/api/preflight.rs	Writes directly to provisioning storage.
devolutions-gateway/src/api/kdc_proxy.rs	Resolves only live registered KDCs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Benoît Cortier (CBenoit)]

Warning

Automated review. Human insight is required, especially to resolve the conflicting SPN assumptions described below.

Requesting changes on this stacked delta (chore/regenerate-openapi-provisioning -> refactor/rdp-proxy-credssp-extract).

1. Blocking - the existing SPN regression thread remains unresolved. credential_injection.rs:222,260,351,416 now derives the synthetic-KDC service hostname from the association token's dst_hst. The base branch deliberately used conf.hostname after merged fix #1856, and this PR deletes service_kdc_for_uses_gateway_hostname_for_spn, the regression test that pinned that behavior. The author has supplied contrary product-path evidence in the existing thread, so this needs a human protocol decision rather than another automated guess. Whichever hostname is correct must be explicit, tested with different Gateway and destination hostnames, and described as a behavior change if #1856 is intentionally being reversed.

2. The new one-shot store changes observable retry behavior without documenting it. ProvisioningStore::take (provisioning.rs:143-197) removes credentials and connection options before target connection, TLS, or CredSSP can succeed (generic_client.rs:158-197, rd_clean_path.rs:490-580). A transient failure consumes the data, and a retry inside the advertised TTL can silently fall through to non-injected forwarding. This conflicts with the current time_to_live wording in openapi.rs:396-400 ("Minimum persistence duration") and is not a behavior-preserving refactor:. Either retain entries across failed attempts, or document the single-use contract in OpenAPI/PR history and make skipped injection explicit instead of silently falling back.

3. The CredSSP enclosure is incomplete and leaves two orchestration implementations. credssp.rs:73-153 owns both CredSSP legs, Connect Confirm interception, leftover flushing, and forwarding, but rd_clean_path.rs:551-634 open-codes the same sequence. rdp_proxy/mod.rs:12-14 then re-exports three internals solely to sustain that duplicate path. Build CredsspSession/PreparedCredssp from RDCleanPath too and call run; that removes roughly 80 duplicated lines and makes the stated module boundary real.

4. generic_client destructively reads entries it does not use. At generic_client.rs:157-160, take runs before entry.mapping.is_some(), so an RDP connection consumes a token-only provision-token entry and discards it. Match the safer RDCleanPath shape: check has_mapping first, then take only for the injection path.

5. Protocol gating was duplicated while its regression coverage was deleted. The two-flag condition is repeated at generic_client.rs:162 and rd_clean_path.rs:495, while the prior flag-matrix test was removed. The empty test module at rdp_proxy/mod.rs:274-278 incorrectly claims protocol selection remains covered. Centralize the predicate, restore the opt-in matrix test, and remove the empty scaffolding.

6. The kitchen metaphor makes the new boundaries harder to learn. credential_injection.rs:1-5,101,108,205,524-531 and rd_clean_path.rs:668-669 require readers to translate "supermarket/groceries/chef/dish/pass window" back into ProvisioningStore, ProvisioningEntry, preparation, and live KDC registration. Use those technical terms directly; this module's purpose is separation of concerns, so it should not introduce a second vocabulary for them.

Non-blocking cleanup: CredentialInjectionKdcResolveError no longer has a discriminating consumer (credential_injection.rs:55-72), so its four variants and duplicated pre-return warnings should either regain a matching caller or collapse to contextual anyhow errors. Also capitalize the newly added log messages and terminate sentence comments per repository conventions.

Note

LLM-assisted content (no human feedback).

[irvingouj@Devolutions (irvingoujAtDevolution)]

Implementation notes:

• ProvisioningStore owns pending token, credential, and connection-option material.
• SyntheticKdcRegistry contains only KDCs published by active Kerberos injection sessions.
• Synthetic KDC ticket/SPN handling and target-side Kerberos both use association dst_hst; conf.hostname remains Gateway identity for TLS/configuration uses.
• RDCleanPath now calls CredsspSession::run instead of maintaining a second CredSSP orchestration.
• Generic RDP checks has_mapping before one-shot checkout, preserving token-only provisioning rows.
• Added explicit Kerberos/NTLM selection coverage and dynamic-destination tests.
• Local DVLS matrix: 22 Playwright cases passed, including live NTLM and Kerberos CredSSP through Gateway.
• CI packaging fix retries Chocolatey and verifies candle.exe/WIXSHARP_WIXDIR after transient 503 failures.

Note

Human-tuned, LLM-assisted content.

[irvingouj@Devolutions (irvingoujAtDevolution)]

Final review follow-up:

1. SPN decision: dst_hst is the explicit service-name contract for supported credential-injection clients. Synthetic KDC tickets, CredSSP acceptor properties, and the target Kerberos leg use the same dynamic destination. Gateway-addressed clients that derive TERMSRV/<conf.hostname> from the transport endpoint are explicitly outside this unstable feature contract.
2. One-shot behavior: checkout is atomic; a consumed-JTI tombstone remains until the original expiry, so reuse and concurrent losers fail closed instead of falling through to non-injected forwarding. Re-provisioning clears the tombstone.
3. CredSSP enclosure: RDCleanPath constructs CredsspSession / PreparedCredssp and calls the single run implementation.
4. Token-only provisioning: both entry points inspect MappingStatus before checkout; token-only rows are preserved.
5. Protocol gating: both flags are centralized and covered by the full 2x2 matrix, with target username selection tested separately.
6. Terminology: kitchen/supermarket metaphors are removed from source and docs.

Additional cleanup: removed the unused typed KDC resolve error, centralized checkout validation, kept generation-guarded KDC leases for explicit same-JTI re-provision overlap, and regenerated OpenAPI artifacts.

Validation: full workspace Clippy; workspace lib/bin/test targets plus colliding examples run separately; generated .NET client build; 22-case DVLS matrix, including live NTLM and Kerberos CredSSP over RDCleanPath.

Note

Human-tuned, LLM-assisted content.

[irvingouj@Devolutions (irvingoujAtDevolution)]

Benoît Cortier (@CBenoit), ready for review

Note

Human-tuned, LLM-assisted content.

[Benoît Cortier (CBenoit)]

(Reviewed and feedback sent on Slack)

[irvingouj@Devolutions (irvingoujAtDevolution)]

Benoît Cortier (@CBenoit), ready for review.

Credential injection now keeps the mapping until the JWT can still authenticate, so jet_reuse reconnects inject again instead of consuming on first checkout. Required-but-missing material fails closed. Manual RDM/DVLS Kerberos and NTLM launches against IT-HELP-DC succeeded on this HEAD.

Note

LLM-assisted content (no human feedback).

[irvingouj@Devolutions (irvingoujAtDevolution)]

Benoît Cortier (@CBenoit) ready for review.

Credential injection now keeps mappings across token-accepted reconnects (get_mapping, fail-closed if required material is missing). Stacked E2E is #1938.

Note

LLM-assisted content (no human feedback).

[irvingouj@Devolutions (irvingoujAtDevolution)]

The clocks are separate on purpose. We stopped trying to make one duration cover all of them.

preflight time_to_live  = unused mapping wait (staging)
jet_reuse / RDP 10s     = can this JWT be replayed
exp + 5 min             = hard cap after first successful inject
jet_ttl                 = already-running session (unchanged)

Token reuse is only the token cache. jet_reuse is the optional reconnect window after disconnect. RDP still has the built-in ~10s handshake allowance even when jet_reuse is off (mstsc opens several sockets):

match (disconnected_info, jet_reuse) {
    (Some(info), ReconnectionPolicy::Allowed { window_in_seconds }) => {
        // not killed, inside window since disconnect, reconnect count <= 10
    }
    _ => {
        if matches!(jet_ap, ApplicationProtocol::Known(Protocol::Rdp)) {
            // ~10 seconds since last token use, not disconnect
            if now > bucket.get().last_use_timestamp + RDP_MAX_REUSE_INTERVAL_SECS {
                return Err(TokenError::UnexpectedReplay { ... });
            }
        }
    }
}

at token.rs

That layer never looks at the credential store. If reuse is refused, we never reach injection.

Credentials have two phases. Staging uses preflight time_to_live (default 15 min, max 2 h), capped to the token acceptance deadline (exp + 5 min leeway). After the first successful checkout, retention is that deadline — not jet_reuse, and not the original staging TTL:

let staging_expires = now + time_to_live;
let required_until = if mapping.is_some() {
    Some(crate::token::token_acceptance_deadline(exp))
} else {
    None
};
let expires_at = required_until.map_or(staging_expires, |deadline| staging_expires.min(deadline));

at provisioning.rs

pub(crate) fn token_acceptance_deadline(exp: i64) -> time::OffsetDateTime {
    let timestamp = exp.saturating_add(i64::from(LEEWAY_SECS));
    // ...
}

at token.rs

// First successful lookup keeps the mapping until the token deadline.
if now >= deadline || now >= entry.expires_at {
    anyhow::bail!("credential-injection material for {jti} is missing or expired; re-provision to retry");
}
entry.expires_at = deadline;

at provisioning.rs

So: unused secrets die with staging TTL. Once injected, “Gateway accepted this association JWT” implies the mapping is still there. We do not compare time_to_live to jet_reuse — they start at different events.

If the token is still acceptable and the mapping is gone, we fail closed (no ordinary forward, no upstream dial):

MappingStatus::RequiredMissing => anyhow::bail!(...),
MappingStatus::Available => true,
MappingStatus::Absent => false,
// checkout before connect_upstream

at generic_client.rs

if now >= deadline {
    MappingStatus::Absent
} else if entry.mapping.is_some() && now < entry.expires_at {
    MappingStatus::Available
} else {
    MappingStatus::RequiredMissing
}

at provisioning.rs

Kerberos KDC follows the same activated deadline, interned per JTI + provisioning generation so reconnects keep the same synthetic realm:

/// Reuse the synthetic KDC for this provisioning generation until `expires_at`.
pub(crate) fn intern_session_kdc(...) -> Arc<CredentialInjectionKdc> {
    if existing.provision_generation == provision_generation {
        return Arc::clone(&existing.kdc);
    }
}

at credential_injection.rs

We kept the preflight TTL field. It only covers the wait before first connect. After that, exp is the cap. A long jet_reuse still needs a token exp that covers it; Gateway will not keep credentials past the token.

Stacked hop tests are on #1938. Signed jet_reuse token-cache is not covered there (disable_token_validation + unsigned JWTs).

Note

Human-tuned, LLM-assisted content.

[irvingouj@Devolutions (irvingoujAtDevolution)]