Repository navigation
feat(dgw): honor an explicit agent on KDC tokens - #2068
Conversation
KDC tokens can now name an explicit agent with `jet_agent_id`, same as association and JMUX tokens. When it's set, `/jet/KdcProxy` forwards every Kerberos message through that agent or fails, with no fallback to a direct connection or to route matching. Tokens without the claim keep working as before. Before this, an RDP session pinned to an agent still sent the client's Kerberos through route matching, so it could reach the KDC directly from the Gateway or through another agent. The .NET `KdcClaims` and tokengen get the optional claim, and the API spec documents it. Issue: DGW-453
…re dialing Reject a udp:// KDC with an explicit agent before routing, so the agent is not asked to dial the KDC. Build the test Gateway config with DgwConfig, encode and decode KDC proxy messages with picky-krb, and cover an explicit agent with Agent Tunnel disabled. Issue: DGW-453
Let maintainers know that an action is required on their side
|
There was a problem hiding this comment.
🟢 Approval recommended
The implementation consistently enforces fail-closed agent pinning and includes comprehensive compatibility and routing coverage.
0 open findings
What changed in this PR
Adds explicit agent pinning to KDC tokens, ensuring Kerberos traffic fails closed rather than using another route.
Changes:
- Propagates
jet_agent_idthrough token generators and claims. - Enforces TCP-only agent routing without fallback.
- Adds serialization, routing, and endpoint tests.
No material issues were identified.
| File | Description |
|---|---|
utils/dotnet/Devolutions.Gateway.Utils/src/KdcClaims.cs |
Adds the optional agent claim. |
utils/dotnet/Devolutions.Gateway.Utils.Tests/JsonSerializationTests.cs |
Tests claim serialization. |
tools/tokengen/src/server/server_impl.rs |
Accepts the claim through the server API. |
tools/tokengen/src/main.rs |
Adds the CLI argument. |
tools/tokengen/src/lib.rs |
Emits the claim in KDC tokens. |
testsuite/tests/agent_tunnel/kdc.rs |
Tests pinned routing and failure behavior. |
testsuite/Cargo.toml |
Adds integration-test dependencies. |
docs/API-spec.md |
Documents the claim and TCP requirement. |
devolutions-gateway/src/token.rs |
Deserializes and preserves the claim. |
devolutions-gateway/src/kdc_connector.rs |
Enforces pinned routing and UDP rejection. |
devolutions-gateway/src/api/webapp.rs |
Initializes generated KDC claims compatibly. |
devolutions-gateway/src/api/kdc_proxy.rs |
Passes the explicit agent to routing. |
crates/devolutions-gateway-generators/src/lib.rs |
Extends generated test claims. |
Cargo.lock |
Records new test dependencies. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Run the KdcProxy end-to-end check against the real Gateway binary, so the testsuite no longer needs axum, picky-asn1 and picky-krb. Prune the tests that duplicated routing coverage and fold the claim round-trip tests into one rstest. Issue: DGW-453
Benoît Cortier (CBenoit)
left a comment
There was a problem hiding this comment.
Much better, thank you
KDC tokens can now name an explicit agent with
jet_agent_id, same as association and JMUX tokens. When it's set,/jet/KdcProxysends every Kerberos message through that agent or fails, with no fallback to a direct connection or to route matching. Tokens without the claim work as before.Before this, an RDP session pinned to an agent still sent the client's Kerberos through route matching, so it could reach the KDC from the Gateway directly or through another customer's agent. The .NET
KdcClaimsand tokengen get the optional claim, and the API spec documents it. Through an agent the KDC has to betcp://; audp://KDC with an explicit agent is now rejected before the agent is asked to dial anything.Issue: DGW-453