fix(dgw): reuse credential injection across reconnects

devolutions-gateway/openapi/gateway-api.yaml

@@ -1837,7 +1837,11 @@ components:
           type: integer
           format: int32
           description: |-
-            Minimum persistence duration in seconds for the data provisioned via this operation.
+            Retention duration in seconds for data provisioned by this operation.
+
+            For "provision-credentials", this is the maximum staging time before the first credential
+            checkout. After checkout, Gateway retains the credentials for later connections authorized
+            for the same association.
 
             Optional parameter for "provision-token", "provision-credentials", and
             "provision-connection-options" kinds.

devolutions-gateway/src/api/kdc_proxy.rs

@@ -5,9 +5,8 @@ use picky_krb::messages::KdcProxyMessage;
 use uuid::Uuid;
 
 use crate::DgwState;
-use crate::credential_injection_kdc::{
-    CredentialInjectionKdcInterception, CredentialInjectionKdcRequest, CredentialInjectionKdcResolveError,
-    kdc_proxy_message_realm,
+use crate::credential_injection::{
+    CredentialInjectionKdcInterception, CredentialInjectionKdcRequest, kdc_proxy_message_realm,
 };
 use crate::extract::KdcToken;
 use crate::http::HttpError;
@@ -22,7 +21,7 @@ pub fn make_router<S>(state: DgwState) -> Router<S> {
 async fn kdc_proxy(
     State(DgwState {
         conf_handle,
-        credentials,
+        synthetic_kdc_registry,
         agent_tunnel_handle,
         ..
     }): State<DgwState>,
@@ -47,7 +46,9 @@ async fn kdc_proxy(
         KdcDestination::Inject { jti } => {
             enforce_credential_injection_enabled(jti, conf.debug.enable_unstable)?;
 
-            let kdc = credentials.kdc_for(jti).map_err(credential_injection_resolve_error)?;
+            let kdc = synthetic_kdc_registry
+                .get(jti)
+                .ok_or_else(|| HttpError::bad_request().msg("no live synthetic KDC published for this session"))?;
 
             debug!(
                 jti = %kdc.jti(),
@@ -92,17 +93,6 @@ async fn kdc_proxy(
     }
 }
 
-fn credential_injection_resolve_error(error: CredentialInjectionKdcResolveError) -> HttpError {
-    match error {
-        CredentialInjectionKdcResolveError::BuildKdcConfig { .. } => HttpError::internal()
-            .with_msg("credential-injection KDC could not be initialized")
-            .build(error),
-        _ => HttpError::bad_request()
-            .with_msg("credential-injection state is not available")
-            .build(error),
-    }
-}
-
 // Forwards the request to the real KDC indicated by the token (or by the debug override) and
 // returns the response wrapped as a `KdcProxyMessage`.
 //
@@ -193,10 +183,9 @@ mod tests {
 
     #[test]
     fn enforce_realm_mismatch_passes_under_bypass() {
-        // `bypass=true` is the `__debug__.disable_token_validation` downgrade. CBenoit asked
-        // for explicit coverage of this branch because it is the only place the realm
-        // authorization is intentionally weakened, and slipping the gate (e.g. by inverting the
-        // condition) would only surface in production.
+        // `bypass=true` is the `__debug__.disable_token_validation` downgrade.
+        // This is the only branch where realm authorization is intentionally weakened, so pin it
+        // explicitly to catch an inverted gate.
         assert!(enforce_realm_token_match("ad.example", "evil.example", true).is_ok());
     }
 

devolutions-gateway/src/api/preflight.rs

@@ -11,10 +11,9 @@ use uuid::Uuid;
 
 use crate::DgwState;
 use crate::config::Conf;
-use crate::credential_injection_kdc::CredentialService;
 use crate::extract::PreflightScope;
 use crate::http::HttpError;
-use crate::provisioning::InsertError;
+use crate::provisioning::{InsertError, ProvisioningStore};
 use crate::session::SessionMessageSender;
 
 const OP_GET_VERSION: &str = "get-version";
@@ -204,7 +203,7 @@ pub(super) async fn post_preflight(
     State(DgwState {
         conf_handle,
         sessions,
-        credentials,
+        provisioning,
         ..
     }): State<DgwState>,
     _scope: PreflightScope,
@@ -231,13 +230,13 @@ pub(super) async fn post_preflight(
                 let outputs = outputs.clone();
                 let conf = conf_handle.get_conf();
                 let sessions = sessions.clone();
-                let credentials = credentials.clone();
+                let provisioning = provisioning.clone();
 
                 async move {
                     let operation_id = operation.id;
                     trace!(%operation.id, "Process preflight operation");
 
-                    if let Err(error) = handle_operation(operation, &outputs, &conf, &sessions, &credentials).await {
+                    if let Err(error) = handle_operation(operation, &outputs, &conf, &sessions, &provisioning).await {
                         outputs.push(PreflightOutput {
                             operation_id,
                             kind: PreflightOutputKind::Alert {
@@ -264,7 +263,7 @@ async fn handle_operation(
     outputs: &Outputs,
     conf: &Conf,
     sessions: &SessionMessageSender,
-    credentials: &CredentialService,
+    provisioning: &ProvisioningStore,
 ) -> Result<(), PreflightError> {
     match operation.kind.as_str() {
         OP_GET_VERSION => outputs.push(PreflightOutput {
@@ -355,7 +354,7 @@ async fn handle_operation(
                     })?;
             }
 
-            let replaced = credentials
+            let replaced = provisioning
                 .insert_credentials(token, mapping, time_to_live)
                 .inspect_err(|error| warn!(%operation.id, error = format!("{error:#}"), "Failed to insert credentials"))
                 .map_err(|error| match error {
@@ -397,7 +396,7 @@ async fn handle_operation(
                 PreflightError::new(PreflightAlertStatus::InvalidParams, format!("invalid token: {error:#}"))
             })?;
 
-            let replaced = credentials.insert_connection_options(jti, connection_options, time_to_live);
+            let replaced = provisioning.insert_connection_options(jti, connection_options, time_to_live);
 
             if replaced {
                 outputs.push(PreflightOutput {

devolutions-gateway/src/api/rdp.rs

@@ -25,7 +25,8 @@ pub async fn handler(
         subscriber_tx,
         recordings,
         shutdown_signal,
-        credentials,
+        provisioning,
+        synthetic_kdc_registry,
         agent_tunnel_handle,
         ..
     }): State<DgwState>,
@@ -46,7 +47,8 @@ pub async fn handler(
             subscriber_tx,
             recordings.active_recordings,
             source_addr,
-            credentials,
+            provisioning,
+            synthetic_kdc_registry,
             agent_tunnel_handle,
         )
         .instrument(span)
@@ -66,7 +68,8 @@ async fn handle_socket(
     subscriber_tx: SubscriberSender,
     active_recordings: Arc<ActiveRecordings>,
     source_addr: SocketAddr,
-    credentials: crate::credential_injection_kdc::CredentialService,
+    provisioning: crate::provisioning::ProvisioningStore,
+    synthetic_kdc_registry: crate::credential_injection::SyntheticKdcRegistry,
     agent_tunnel_handle: Option<Arc<agent_tunnel::AgentTunnelHandle>>,
 ) {
     let (stream, close_handle) = crate::ws::handle(
@@ -84,7 +87,8 @@ async fn handle_socket(
         sessions,
         subscriber_tx,
         &active_recordings,
-        &credentials,
+        &provisioning,
+        &synthetic_kdc_registry,
         agent_tunnel_handle,
     )
     .await;

devolutions-gateway/src/credential/INTENT.md

@@ -0,0 +1,56 @@
+# Intention:
+
+
+## Context and terminology
+
+Logical Session: a logical session is defined when a connection reaches Gateway and is authenticated with the association token.
+
+```rust
+pub struct AssociationTokenClaims {
+    pub jet_aid: Uuid,
+
+    ..
+    pub jet_ttl: SessionTtl,
+
+    pub jet_reuse: ReconnectionPolicy,
+    pub exp: i64,
+    ..
+    pub jti: Uuid,
+}
+```
+
+Injected credentials: injected credentials are the actual credentials sent by the provisioner (DVLS) to Gateway, which are used later by a logical session to serve the purpose of granting access to a client without exposing the actual credentials.
+
+Checkout: When an injected credential has arrived and is sitting in memory, and the association token arrives at Gateway and the lookup of the injected credential is successful, we consider the injected credential checked out by the logical session.
+
+Staging/Stage: when an injected credential arrives at Gateway but checkout has not happened yet, we consider the injected credential to be in staging.
+
+Remove/Eject: remove and eject here specifically mean actively removing the injected credentials/materials from memory and making sure they will not be accessible on a best-effort basis.
+
+## Decisions
+1. Credential-injection support must follow the lifecycle of its logical session.
+
+A logical session is established when Gateway accepts its association token for the initial connection.
+
+As long as Gateway would authorize an initial connection or reconnect for that logical session, the same connection must remain possible with credential injection.
+
+When Gateway can no longer authorize any connection or reconnect for that logical session, it must immediately remove all credential-injection material owned by the session.
+
+This DOES NOT mean that the injected credentials should live as long as the logical session continues.
+A session's lifetime is defined by `jet_ttl`, but whether it can establish a connection or reconnection is defined by `jet_reuse` and `exp`.
+The injected credentials should be removed when the session can no longer establish a connection or reconnection.
+
+2. Provisioning for the same JTI should be permitted, but the policy for different kinds of provisioning should be defined on a per-kind basis.
+For credential injection, the policy is that the old injected credentials should be removed when new injected credentials are provisioned for the same JTI.
+
+3. If a connection requires credential injection but its required credentials are not available, the connection should fail immediately.
+The connection should not continue without the required injection support.
+An association token does not identify whether credential injection is required, so this rule only applies while Gateway still has credential-injection state for the JTI.
+
+4. The injected credentials naturally arrive earlier than the connection that uses them.
+The second half (checked out) of the lifetime of the injected credentials is defined in 1); we define the staging lifetime of the injected credentials here:
+
+The amount of time that the injected credentials can stay in staging is defined by the provisioning TTL, which is supplied by the provisioner through the preflight provisioning operation.
+When the provisioning TTL expires, Gateway must actively remove the staged material from memory.
+
+5. A synthetic KDC should have only one instance per JTI at all times.