Andy Dixon
50c0104d57
clients::rdp connects over any caller-dialled TCP stream (direct, proxy or SSH tunnel), upgrades to TLS and logs on with NLA (CredSSP/NTLM), optionally falling back to TLS-only logon for servers without NLA such as xrdp (credentials are passed so they log straight in). The server certificate is pinned through a caller check on its SHA256 fingerprint before any credentials are sent. The desktop decodes into the VNC client's RGBA framebuffer; input (IronRDP's scancode/Unicode/mouse operations), Display Control resizes and the deactivation-reactivation sequence run on the session thread. IronRDP's releases need three vendored patches (vendor/README.md): picky and sspi with their RustCrypto release-candidate pins relaxed so they share russh's stable versions (their own suites, 402 tests, pass against them), and ironrdp-session with two unreleased upstream bitmap fixes (#1486 stride, #1524 RDP6 orientation) without which xrdp desktops render sheared. Verified live against xrdp (scottyhardy/docker-remote-desktop): logon, full desktop rendering, keyboard and mouse input.
55 lines
1.9 KiB
C#
55 lines
1.9 KiB
C#
using System;
|
|
using System.Threading.Tasks;
|
|
using System.Collections.Generic;
|
|
using CommandLine;
|
|
using AADJoin.Creds;
|
|
|
|
namespace AADJoin
|
|
{
|
|
public class Program
|
|
{
|
|
static async Task Main(string[] args)
|
|
{
|
|
await Parser.Default.ParseArguments<Options>(args).WithParsedAsync(RunOptions);
|
|
}
|
|
|
|
static async Task RunOptions(Options opts)
|
|
{
|
|
var device = DeviceCreds.Empty();
|
|
var user = new UserCreds(opts.Username, opts.Password, opts.Domain);
|
|
|
|
// well-known client ids: https://github.com/Gerenios/AADInternals/blob/master/AccessToken_utils.ps1#L11
|
|
// graph_api: 1b730954-1685-4b74-9bfd-dac224a7b894
|
|
string clientId = "1b730954-1685-4b74-9bfd-dac224a7b894";
|
|
|
|
await AzureAD.CheckUsername(opts.Username);
|
|
var authResponse = await AzureAD.AzureAdAuthorize(clientId, user);
|
|
|
|
if (opts.JoinNewDevice)
|
|
{
|
|
var tenantAuthResponse = await AzureAD.AzureTenantAuthorize(clientId, authResponse);
|
|
device = await AzureAD.JoinDevice(opts.Domain, tenantAuthResponse);
|
|
} else if (opts.DevicePfx != null)
|
|
{
|
|
Console.WriteLine("Trying to load device PFX file...");
|
|
device = DeviceCreds.FromPfx(opts.DevicePfx, opts.PfxPassword);
|
|
} else
|
|
{
|
|
Console.WriteLine("Error: No device information provided.");
|
|
Environment.Exit(1);
|
|
}
|
|
|
|
if (opts.ServerP2PCert)
|
|
{
|
|
await AzureAD.ObtainServerP2PCertificate(user.Domain, authResponse.GetTenantId(), device);
|
|
} else if (opts.ClientP2PCert)
|
|
{
|
|
await AzureAD.ObtainClientP2PCertificate(user, authResponse.GetTenantId(), device);
|
|
} else
|
|
{
|
|
Console.WriteLine("Nothing left to do.");
|
|
}
|
|
}
|
|
}
|
|
}
|