feat(dgw): provision the target-side KDC for credential injection

[irvingouj@Devolutions (irvingoujAtDevolution)]

This PR add OP_PROVISION_CONNECTION_OPTIONS, that is, for now, just kdc in there.
Then uses it, construct kdc sessions in each handler on demand.

It is already complete in terms of functionality, but I do believe that the bondary is starting to blur.

Most importantly
CredentialService is taking more responsibility than it should.

[Copilot]

Pull request overview

Adds target-side KDC provisioning for Kerberos credential injection.

Changes:

• Adds validated connection options and a preflight provisioning operation.
• Splits credential and connection-option storage with independent expiry.
• Routes target-side Kerberos requests through the provisioned KDC.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/preflight.rs	Tests provisioning operations.
src/target_connection_options.rs	Defines validated KDC options.
src/target_addr.rs	Adds URL conversion.
src/rdp_proxy.rs	Configures target-side Kerberos.
src/provisioning.rs	Stores credentials and options independently.
src/lib.rs	Registers the new module.
src/kdc_connector.rs	Shares supported KDC schemes.
src/credential_injection_kdc.rs	Carries options into session state.
src/api/preflight.rs	Adds the provisioning operation.

Comments suppressed due to low confidence (1)

devolutions-gateway/src/rdp_proxy.rs:405

• The core new routing behavior is not covered by the existing tests in this file: they only exercise injection_uses_kerberos, while no test verifies that a provisioned KDC becomes the client kdc_proxy_url (or that Kerberos rejects a missing KDC). Add focused coverage for both cases to prevent the target-side wiring from regressing.

    Ok(CredentialInjectionKerberosConfigs {
        server: Some(credential_injection_kdc.server_kerberos_config(client_addr)?),
        client: Some(ironrdp_connector::credssp::KerberosConfig {
            kdc_proxy_url: Some(url::Url::try_from(krb_kdc).context("convert target KDC address to URL")?),
            hostname: gateway_hostname.to_owned(),

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.