jeanpascalgoetze

Thank you for confirming!

Hello Devolutions,

we evaluate implementing Devolutions Gateway.

We recognized, that we need connectivity on Port 7171 to the Devolutions Gateway for it to work from the Clients Web-Browser, which is different than what is shown on your architecture sketch.

1.)

Is this some kind of misconfiguration on our side or is 7171 from the Clients Web-Browser to the Devolutions Gateway really needed to do RDP from Devolutions Server using the Gateway in Web-Browser.

2.)

By security policy, we are not allowed to have direct Internet access to the Devolutions gateway. How shall we secure the 7171/8181 Ports (e.g. is there Reverse Proxy support) - especially in case of 8181 which is TCP and not HTTPs.

Can this be tunneled using HTTPs ?

I am thinking about 2 scenarios

A) Using Azure Frontdoor + WAF with Azure Private Link to Devolutions Gateway, forwarding connections from 443/HTTPS to 7171/HTTPS and tunnel Connections on 443/HTTPS to 8181 TCP

B) Using Azure Application Gateway V2 +WAF with 443 forwarding to 7171 and TLS proxy for 8181

Thank you for your support !

Greetings Jean Pascal

Hello Francois,

thank you!

Do you mean own "infrastructure" Vault or just a Vaul designated for infrastructure accounts? (we already have it like that)

If it's the first one, how to create "infrastructure Vaults" ?

Because in the docs there is a screenshot of a "real" Infrastructure Vault with an SQL account in it, by I have no idea how you got that in there or how to create additional ones and how that should reprensent in the UI, where is only a single menu-option for Infrastructure Vault.

Picture from your docs:

Best regards

Jean Pascal

Hallo Francois,

that is exactly what I want to do.

I want to store the Database crendentials and the service accounts which Devolutions Server is using in there (e.g. the Activite Directory Domain Account to do the LADPS PAM things, which is configred as a linked Account in the PAM provider ... right now I need to store that in a PAM Vault)

I would like to use that Vault, as for my understanding it is ment for accounts which Devolutions Server is using itself and I also prefer not to have them in a PAM vaul due to RBAC concerns and automation (powershell) concerns.

Best Regards

Jean Pascal

Hi Maxime,

things working good so far but we encounter a new problem.

We now created ~700 PAM Vaults by PowerShell but the

Get-DSPamAccount

Now seems to run into a timeout, which seems to be fixxed by like 15 seconds or so and theres no switch to prolong that.

Is there a way to change that timeout or fasten up the API response? As we need the results of that for further scripting.

We are also struggeling a bit for all commands not giving back a results (e.g. New-DSPamFolder), so we always have to scan and filtering the existing results afterwards to work with that new object instead of just getting the id / name returned.

How can I add an entry to that "Infrastructure Vault"?

Sadly there is still no documentation page and also no "+" Sign on the Webinterface like on other Vaults to add Accounts.

It also not shows up on the "Move" menu for PAM credentials. (can only move them to normal PAM Vaults)

"Application access denied by system settings"

"Cli" was disabled and works now.

Thank you! :)

Would recommend to put that detail level on the PowerShell Output aswell and list "Active Cli" in the "Getting Started" sesction of the docs.

Will try the JIT and ScanConfig Cmdlets the next days and let you know if there are any problems.

Hello Maxime,

thank you!

So how can we deal with that "Unhandled error while logging in. Please submit a ticket if problem persists."

Authentication error now?

Should I open a ticket for that?

As the connection seems to work ( Get-RDMCurrentDatasource ) but not the login.

Are there any log where we could investigate that behaviour further?

Hello Maxime,

thank you!

I retested with a new secret but still the same error.

I saw the documentation says

For RDM Cmdlets:

$dsurl = "https<area>://your_dvls_url"

For Devolutions Server Cmdlets:

$env:DS_URL= "http<area>://localhost/dvls"

Do I need to execute that script from the Devolutions Server itself, as only localhost works?

>> [string]$Username = $env:DS_USER
>> [string]$Password = $env:DS_PASSWORD
>> [string]$DVLSUrl = $env:DS_URL
>>
>> [securestring]$SecPassword = ConvertTo-SecureString $Password -AsPlainText -Force
>> [pscredential]$Creds = New-Object System.Management.Automation.PSCredential ($Username, $SecPassword)
>>
>> $Response = New-DSSession -Credential $Creds -BaseURI $DVLSUrl -AsApplication

New-DSSession:
Line |
   8 |  $Response = New-DSSession -Credential $Creds -BaseURI $DVLSUrl -AsApp …
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | [New-DSSession] Unhandled error while logging in. Please submit a ticket if problem persists.

Get-RDMCurrentDatasource comes up with

IsConnected : True

IsOffline : False

In regards of privileged sets... do you have an code example for that please?

Couldn't find any info about it yet. (also couldn't try as the connection still doesnt work, like stated above)

Hello,

JIT access is currently supported. Here's an example using an existing 'Domain User' provider:

$providerID = 'the-provider-id'

$groupResponse = Get-DSADGroup -ProviderID $providerID -DN 'OU=Test,DC=mydomain,DC=loc' -AsJITSettings

$providerResponse = Get-DSPamProvider

$provider = $providerResponse.Data | Where { $_.ID -eq $providerID }

$provider.JitElevationSettings = $groupResponse.Data

Update-DSPamProvider -InputObject $provider

Additionally, a ticket has been created to develop a cmdlet for creating scan configurations. However, please note that we cannot begin immediate work on this due to other priorities. We will keep you updated on our progress.

Best regards,

Maxime

Another question came up, if it is already possible to manage the "new" PAM just-in-time elevation privilege sets

which got added in 2024.2 and if not, if there is a timeline for that (as this would strongly impact the architecture/design of our Providers and Scan-Configs)

Hello Maxime,

we did some more testing and managed to solve the SSL error for our productive environment (which has a public SSL certificate). So that error only exists for our testing environment (uses certificate from our PKI).

For the productive environment we are getting following error:

[securestring]$SecPassword = ConvertTo-SecureString $Password -AsPlainText -Force
[pscredential]$Creds = New-Object System.Management.Automation.PSCredential ($Username, $SecPassword)
$Response = New-DSSession -Credential $Creds -BaseURI $DVLSUrl -AsApplication

New-DSSession:
Line |
   8 |  $Response = New-DSSession -Credential $Creds -BaseURI $DVLSUrl -AsApp …
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | [New-DSSession] Unhandled error while logging in. Please submit a ticket if problem persists.

Hello Maxime,

thanks for the quick reply !

• What version of the PowerShell module and Devolutions Server are you using?

They are all latest...

• Devolutions Server = Version 2024.2.10.0

• PowerShell Module Module = 2024.2.5 (current version) 3 days ago

• Powershell = 7.4.5

• What parameters are you using (e.g., -AsApplication, -WindowsAuthentication)?

  • We followed the Docs Devolutions.PowerShell core module - Devolutions Documentation so

[string]$Username = "http<area>://localhost/dvls"
[string]$Password = "your_appkey"
[string]$DVLSUrl = "your_appsecret"

[securestring]$SecPassword = ConvertTo-SecureString $Password -AsPlainText -Force
[pscredential]$Creds = New-Object System.Management.Automation.PSCredential ($Username, $SecPassword)

$Response = New-DSSession -Credential $Creds -BaseURI $DVLSUrl -AsApplication

For "your_appkey" and "your_appsecret" we created them in the "Administration -> Application identities" menu of Devolutions Server without any further config except for "Enabled", wasn't shure about that. It's not described in the docs.

"http<area>://localhost/dvls" = our link to Devolutions Server, which has the SSL certificate. (localhost is not part of the SSL certificate)

• If you have RDM, can you connect to the data source with it?

  • We didn't upgrade RDM in our RDS environment yet, so it's not compatible to the current DVLS Server Version. (But I can install the latest version locally though, if needed)

  • Connection from the PowerShell Module to Data Source was successfull. (like described in the docs)

https://docs.devolutions.net/powershell/Getting-started/#testing-connection-to-a-data-source

Hello Maxime,

thank you for the feature update.

I just tested this but I am failing at "New-DSSession" with following error

HttpRequestError : SecureConnectionError
StatusCode       :
TargetSite       : T RunSynchronous[T](System.Threading.Tasks.Task`1[T])
Message          : The SSL connection could not be established, see inner exception.
Data             : {}
InnerException   : System.Security.Authentication.AuthenticationException: Cannot determine the frame size or a
                   corrupted frame was received.
                      at System.Net.Security.SslStream.GetFrameSize(ReadOnlySpan`1 buffer)
                      at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](CancellationToken
                   cancellationToken, Int32 estimatedSize)
                      at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder`1.StateMachineBox`1.System.
                   Threading.Tasks.Sources.IValueTaskSource<TResult>.GetResult(Int16 token)
                      at System.Net.Security.SslStream.ReceiveHandshakeFrameAsync[TIOAdapter](CancellationToken
                   cancellationToken)
                      at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst,
                   Byte[] reAuthenticationData, CancellationToken cancellationToken)
                      at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions
                   sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken
                   cancellationToken)
HelpLink         :
Source           : Devolutions.Server.ApiWrapper
HResult          : -2146233087
StackTrace       :    at Devolutions.Server.ApiWrapper.RDMSWebClient.RunSynchronous[T](Task`1 task)
                      at Devolutions.Server.ApiWrapper.RDMSWebClient.GetPublicWebInstanceInformation()
                      at RemoteDesktopManager.PowerShellModule.NewDSSessionCommand.ProcessRecord()
                      at System.Management.Automation.CommandProcessor.ProcessRecord()

Any idea ?

Best regards

Jean Pascal

Hello Devolutions,

we need to batch create PAM Providers aswell as JIT and Scan configurations for them.

By now, the powershell Module only supports are very limited set of features, for managing PAM.

Please add the option to configure JIT access and also to batch create Scan configurations.

Thank you!

Hello Francois,

yes, on short term that would help.

I don't see us removing licenses from users athat often s long we aren't out of licenses but on long term, it should also remove the licenses. (Like checking licensing status on every login and not only on first login)

An other possible solution (which might be easier to implement) would be at least some kind of scheduler...

If user XYZ wasn't logged in for XYZ days, remove the license from him.

For us, the status hasn't to be " 100% live" but it should also not be totally messed up after some months w/o manual clean-ups.

Best Regards

Jean Pascal

We would love to see that aswell: RDM License assign to "Devolutions Server" Group

Hello Devolutions,

we would like to assign the RDM licenses, stored on our Devolutions Server, by using Devolutions Groups

(imported groups from Entra ID/Azure AD to be more precise).

It seems, that I only have the option to have “Auto Assign”, which grants everyone who starts RDM and connects

to the Devolutions Server Data Source, a RDM license or I can assign them manually to Devolutions Server Users (but not groups). It would be really nice, if you also add “Assign RDM license to Group”, so you can manage access to "some" Administrators, if not all should get it while not having the duty to manage them manually.

Thank you!

Hello Devolutions,

We would really love to see the capabilities for managing f Entra ID (ex. Azure AD) Application Secrets from

Enterprise Applications / Managed applications in Devolutions Server.

As by now the Azure AD PAM Provider only allows to manage “User Accounts” but using User-Accounts for privileged access usually is against the best practice of most implementations and you should use Managed Applications / Service Principles and Secrets instead of Passwords.

This feature should imply:

1. Overview and Notification of existing application secrets and see when they are running out (can be fetched from Azure API)

2. Option to manage them from Devolutions (PAM Module seems to be the right place)

   1. Fetch Secrets from Entra ID/Azure AD using the already existingPAM Provider and store them in Devolutions Server

   2. Delete existing secrets

   3. Create new ones (and store them in Devolutions Server)

      1. Scheduler for this (e.g. Delete Secret weekly and create a new one)

3. “Password” Propagation (Option to renew a secret and execute a propagation script, to exchange it in application XYZ aswell)

Thank you !

Dear Richard,

that was activated the whole time and that's where I got that error message from.

For SSO:

Message
NullReferenceException - Object reference not set to an instance of an object.

at Devolutions.Server.ExternalAuthentication.MicrosoftAuthenticationProvider.BuildAuthorizationCodeRequest(ExternalProviderAuthLogin parameters, String authCode, String nonce, LoginSessionMetadata metadata)
at Devolutions.Server.ExternalAuthentication.OAuthExternalProviderService.GetAuthorizationCodeRequest(ExternalProviderAuthLogin parameters, HttpRequest request)
at Devolutions.Server.Controllers.APIControllers.V2.BackendApiController.LoginWithExternalProvider(ExternalProviderAuthLogin parameters)
at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextExceptionFilterAsync>g__Awaited|26_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)

For Passwords:

(The DVLS server can't resolve the name without using the proxy server - while the proxy Server can reach it by PowerShell and Browser - just gets an invalid API request error )

Message
AggregateException - One or more errors occurred. (No such host is known. (api.pwnedpasswords.com:443))

at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)
at Devolutions.Server.PasswordManager.GetPwnedRangePassword(String hashPassword)
at Devolutions.Server.Controllers.APIControllers.V2.BackendApiController.SearchPwnedByRange(String hashPrefix)

------------------------------------------

HttpRequestException - No such host is known. (api.pwnedpasswords.com:443)

at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.GetStringAsyncCore(HttpRequestMessage request, CancellationToken cancellationToken)

------------------------------------------

SocketException - No such host is known.

at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Sockets.Socket.<ConnectAsync>g__WaitForConnectWithCancellation|277_0(AwaitableSocketAsyncEventArgs saea, ValueTask connectTask, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)

I'll attach that, aswell as the Log4Net Log (DPS_Main.log) to the case, as requested.

Hello,

it is the latest Version (updatet 2 days ago) and the proxy (aswell as the servers using the web browser) can reach the endpoints.

It's a load balanced setup and AAD SSO worked for one of the servers for some days (last week) but after a reboot it doesn't work anymore.

The 2nd servers AAD SSO nerver worked und the app pool always crashed when the server was started while the SSO feature was enabled. That issue is now also gone (since that point where the first server stopped working), now it's 2 servers, which can connecto to Microsoft Login and haveibeenpwned by Browser but the Application seems to have problems doing that.

Hello Richard,

thanks for the reply.

Apparantly that didn't help.

Still getting an connection error when trying to SSO with Azure AD

Error:

NullReferenceException - Object reference not set to

an instance of an object. at

Devolutions.Server.ExternalAuthentication.MicrosoftAuthenticationProvider.BuildAuthorizationCodeRequest(ExternalProviderAuthLogin

parameters, String authCode, String nonce, LoginSessionMetadata metadata) at

Devolutions.Server.ExternalAuthentication.OAuthExternalProviderService.GetAuthorizationCodeRequest(ExternalProviderAuthLogin

parameters, HttpRequest request) at

Devolutions.Server.Controllers.APIControllers.V2.BackendApiController.LoginWithExternalProvider(ExternalProviderAuthLogin

parameters) at

Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper

mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)

at

Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker

invoker, ValueTask`1 actionResultValueTask) at

Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker

invoker, Task lastTask, State next, Scope scope, Object state, Boolean

isCompleted) at

Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed

context) at

Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State&

next, Scope& scope, Object& state, Boolean& isCompleted) at

Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()

--- End of stack trace from previous location --- at

Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextExceptionFilterAsync>g__Awaited|26_0(ResourceInvoker

invoker, Task lastTask, State next, Scope scope, Object state, Boolean

isCompleted) --- Default

Source:

Devolutions.Server

Hello everyone,

we try to get Devolutions Server up and running but right now, we have a problem as Devolutions Server seems to not use the Systems Web Proxy Settings (Classic Squid SOCKS Proxy, nothing special)

The proxy is configured from IE Settings, from netsh, from environments variables and from Active Directorty (for local user and local mashine).

You can also see no connections from the devolutions server to the Proxy when trying to access Azure AD or haveibeenpwned.

It also works without any problem from Web-Browser, so the proxy aswell as required networking is working in general.

Someone knows how to force "Devolutions Server" to use the Proxy ?

Greetings!