Devolutions / Devolutions/IronRDP

Create `ironrdp-credssp` (CredSSP contract crate)

Open
#1,428 0 comments 0 reactions 0 assignees View on GitHub
scope/core
Dominant language
Rust
Stars
3.2k
Forks
275
Avg merge
1d 11h
Merged PRs (30d)
189

Description

Define the injectable CredSSP contract so `ironrdp-connector` can depend on a trait instead of the `sspi` crate.

### Scope
- [ ] New crate `ironrdp-credssp` (deps: `ironrdp-sequence`, `ironrdp-pdu`). Define:
- `CredsspProvider` (factory): `supported_protocols() -> SecurityProtocol` and `init(credentials, domain, protocol, server_name, server_public_key, kerberos_config) -> Result, Box>`.
- `CredsspBackend`: `next_pdu_hint()`, a step interface returning `CredsspStep { Done, NeedNetwork(Vec) }` (or equivalent) + a resume path — a sans-io shape mirroring the existing `resolve_generator` loop.
- `CredsspError: core::error::Error` with `fn kind(&self) -> CredsspErrorKind` where `CredsspErrorKind` is `#[non_exhaustive] { WrongPassword, LogonFailure, AccessDenied, Network, Protocol, Other }` (`AccessDenied` absorbs the `EarlyUserAuthResult::AccessDenied` outcome currently in `connector/src/credssp.rs`).
- Connect-identity inputs consumed by the trait: `Credentials`, `KerberosConfig`, `SmartCardIdentity`, and `NetworkRequest`.
- A noop provider (advertises no protocols; `init` returns a "no CredSSP backend provided" error).

### Acceptance criteria
- `ironrdp-credssp` has no `sspi`/`picky` dependency.
- Trait surface expresses the full handshake (multi-round network suspension, public-key echo input, EarlyUserAuthResult tail) without sspi types.

*Open question to settle in this PR:* whether `CredSspClient::process`'s generator can suspend more than once per round (decides the `NeedNetwork` cardinality — default to single-request + driver loop).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with connector/src/credssp.rs and the existing resolve_generator loop to understand the handshake states, network suspension, public-key echo, and EarlyUserAuthResult tail. Review the ironrdp-sequence and ironrdp-pdu crates named in the scope, then define the new ironrdp-credssp crate and noop provider without sspi or picky dependencies. Done means the trait surface expresses the full handshake and ironrdp-connector can depend on it.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authentication, backend-api-design
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.