Devolutions / Devolutions/IronRDP
Create `ironrdp-credssp` (CredSSP contract crate)
- Dominant language
- Rust
- Stars
- 3.2k
- Forks
- 275
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 189
Description
Define the injectable CredSSP contract so `ironrdp-connector` can depend on a trait instead of the `sspi` crate.
### Scope
- [ ] New crate `ironrdp-credssp` (deps: `ironrdp-sequence`, `ironrdp-pdu`). Define:
- `CredsspProvider` (factory): `supported_protocols() -> SecurityProtocol` and `init(credentials, domain, protocol, server_name, server_public_key, kerberos_config) -> Result, Box>`.
- `CredsspBackend`: `next_pdu_hint()`, a step interface returning `CredsspStep { Done, NeedNetwork(Vec) }` (or equivalent) + a resume path — a sans-io shape mirroring the existing `resolve_generator` loop.
- `CredsspError: core::error::Error` with `fn kind(&self) -> CredsspErrorKind` where `CredsspErrorKind` is `#[non_exhaustive] { WrongPassword, LogonFailure, AccessDenied, Network, Protocol, Other }` (`AccessDenied` absorbs the `EarlyUserAuthResult::AccessDenied` outcome currently in `connector/src/credssp.rs`).
- Connect-identity inputs consumed by the trait: `Credentials`, `KerberosConfig`, `SmartCardIdentity`, and `NetworkRequest`.
- A noop provider (advertises no protocols; `init` returns a "no CredSSP backend provided" error).
### Acceptance criteria
- `ironrdp-credssp` has no `sspi`/`picky` dependency.
- Trait surface expresses the full handshake (multi-round network suspension, public-key echo input, EarlyUserAuthResult tail) without sspi types.
*Open question to settle in this PR:* whether `CredSspClient::process`'s generator can suspend more than once per round (decides the `NeedNetwork` cardinality — default to single-request + driver loop).
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with connector/src/credssp.rs and the existing resolve_generator loop to understand the handshake states, network suspension, public-key echo, and EarlyUserAuthResult tail. Review the ironrdp-sequence and ironrdp-pdu crates named in the scope, then define the new ironrdp-credssp crate and noop provider without sspi or picky dependencies. Done means the trait surface expresses the full handshake and ironrdp-connector can depend on it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authentication, backend-api-design
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100