Skip to content

Comments

GUACAMOLE-2210: Add support for AAD authentication to RDP protocol.#633

Open
aleitner wants to merge 1 commit intoapache:staging/1.6.1from
aleitner:GUACAMOLE-2210-AAD
Open

GUACAMOLE-2210: Add support for AAD authentication to RDP protocol.#633
aleitner wants to merge 1 commit intoapache:staging/1.6.1from
aleitner:GUACAMOLE-2210-AAD

Conversation

@aleitner
Copy link
Contributor

  • Adds Azure AD (Entra ID) authentication support for RDP connections using FreeRDP 3's AadSecurity mode
  • Implements the OAuth2 authorization code flow server-side using libcurl to automate the Microsoft login sequence
  • Adds #include "config.h" to source files that were missing it, fixing struct member offset mismatches.

Authentication Flow

When security=aad is set on an RDP connection:

  1. FreeRDP initiates the AAD handshake and invokes the GetAccessToken callback with the required scope and Proof-of-Possession key
  2. The callback prompts for username/password via guac_argv if not already configured
  3. An OAuth2 authorization URL is built using the client ID from FreeRDP's GatewayAvdClientID setting and the common tenant endpoint
  4. The Microsoft login page is fetched via HTTP GET and the $Config JavaScript object is parsed for session tokens (sFT, sCtx, urlPost, canary, apiCanary)
  5. The GetCredentialType API is called to update server-side session state and obtain a fresh flow token
  6. Credentials are POSTed to the login endpoint with the required CSRF tokens. On success, Microsoft redirects to the native client URI with an authorization code
  7. The authorization code is exchanged for an access token at the token endpoint, including the Proof-of-Possession binding
  8. The access token is returned to FreeRDP, which completes the AAD-authenticated RDP session

Paired with apache/guacamole-client#1168

@aleitner
Copy link
Contributor Author

Didn't realize we don't have curl. This would require adding curl as a dependency

Copy link
Contributor

@necouchman necouchman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like the build is failing with an error about the switch() statement and one of the enums.

@aleitner
Copy link
Contributor Author

Looks like the build is failing with an error about the switch() statement and one of the enums.

Ahh whoops! I was testing with only freerdp3 as that's when AAD support was implemented. Just added a case to the switch for freerdp2 so that it errors if AAD is selected

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants