robhartung

Hello

I've done some fact finding investigation in the last week to see if I can move this along faster.

The macOS system implementation of Kerberos is not usable. It's neglected by Apple and has outdated headers and is missing key features. So, to use a "system" Kerberos we would need to use MIT Kerberos. That's a challenge: our build system normally wants static libraries, and MIT doesn't really support that very well. I've hacked something together that works, but the pkinit extension (needed for smart card) is a "plugin" and can only be a shared library. This really complicates things on our side. Furthermore, MIT depends on OpenSSL which is something we're working hard to remove as a dependency in our systems. OpenSSL is a security, usability and maintainability nightmare on our side. Finally, the MIT Kerberos is quite hard to control: it depends on local configuration files for realm configuration and so on, which must be managed using a very poor quality API; any mistakes here create significant issues (for example, a misconfigured krb5.conf will cause a two-minute delay on RDP login as it tries and fails to find the KDC before falling back to NTLM). KDC proxying also does not seem to be possible in this scenario.

Even once I have put something together with those pieces that "works" on my side (and by "works", I mean I can login to the server using Kerberos), I've linked the OpenSC pkcs11 module for smartcard integration and enabled smartcard logon, but so far I've been unsuccessful in getting FreeRDP to actually use the smartcard. For some reason, even though it sees my smartcard and finds the valid key, it always tries to pre authenticate with encrypted timestamp instead of X.509.

To take this further will require me to debug into the FreeRDP code and try to determine exactly what is going on.

Our own SSPI implementation gets around all these problems. The only thing missing is the integration between the SSPI and the system smartcard APIs.

So, I'm going to pause the investigation for using system Kerberos and allow our developer to finish the work in sspi-rs. I hope he can achieve this for 2025.3. If there are further issues found, or blockers that make this not possible; we'll dust off the work I've done above and try to get an implementation up-and-running with MIT Kerberos, and just find ways to deal with the issues I've outlined above.

I hope it makes sense, but please don't hesitate to post back with further questions or comments Thanks again for your patience on this.

Kind regards,

@Richard Markiewicz

As always, thanks for the updates and in this case, a much more detailed explanation of the challenges. I'll stay hopeful that you and the team find a successful avenue for this implementation. Thanks for all your work!

Thanks for the update! I imagine, if this was easy to implement, it would have been done a long time ago, so it shouldn't be surprising that it's taking longer than expected. Looking forward to the work when it's done. Thanks.

My apologies. I've set the value you detailed, attempted again to connect without success. I will send you the session logs in email.

Yes, I configured for Smart Cards for the server that I'm testing. Screenshot includes my Local Resources settings. And the Data Source selector is set to Local Data Source.

I've tested the new version and I'm not seeing any difference. I will send you screenshots and the session logs via email.

With regard to the data source type, I'm not sure what it you are referring to. Can you clarify?

Yes, "Smart cards" is checked for the RDP configuration. Thanks for the clarification regarding the Yubikey auth in Settings.

I'm trying to test RDM for Mac, as well, and trying to connect to our servers. Smart card Auth is required on our servers, but I'm not clear on how to configure RDM to support Yubikeys. I've gone into Settings > Security and checked "Require Yubikey authentication, but when I launch a session, I get a regular user account, password, domain login prompt; I do not get a PIN prompt which is typical. I could provide session logs, but that's sensitive information in my environment, and I'm concerned that the issue is more of a RDM configuration issue. I haven't found any configuration documentation for supporting Yubikey. Could you provide configuration documentation so that I know that I'm doing that part correctly? If so, then I would work to get session logs approved to share.