RDP record contracts without agent¶
The RDP record contracts without agent module declares a contract that authorizes user groups known to CyberElements to directly access agentless RDP applications or VNC applications, through a site (Edge Gateway). It is the same general form as a regular RDP contract, extended with an access token option that can be inspected and revoked from a dedicated tab.
Direct access is performed by using a login of the form login/domain:application (for example test_user/DOMAIN:t1234). Only domains using login/password identification can be targeted (SAML domains are filtered out).
Connection behavior
If the password is correct and the application authorized, the application is launched according to its configuration; vault aliases, when defined, are honored. If needed, additional dialogs are shown to enter login/password (SSO "ask"), a comment, or the target server for dynamic applications. Some application options depend on the RDP client (resolution, clipboard redirection, printers, ...) and cannot be honored in this mode; console and restrictedadmin modes, on the other hand, are honored.
Prerequisite: enable the recording service on the Edge Gateway¶
Direct RDP access is handled by a dedicated xrdp instance on the Edge Gateway. It is not enabled by default: it listens on the network, which would needlessly widen the attack surface of platforms that do not use the feature. A contract declared here therefore has no effect until the service has been enabled on the Edge Gateways of the selected sites.
On every Edge Gateway concerned:
1 | |
That instance also needs to know which Edge Gateway instances to query to reach the Mediation Controller: this is the xmlrpc-connect setting of /etc/ipdiva/careserver/careserver.xml, the same one used by direct recording with an agent.
Contract list¶
The main grid displays the existing contracts in a paginated view (15, 25 or 50 rows per page):
| Column | Description |
|---|---|
| Name | Contract name. An icon precedes the name: a colored padlock for an enabled contract, an uncolored padlock for a disabled contract. |
| Groups | Number of user groups selected. |
| Sites | Number of sites selected. |
| Applications | Number of applications selected. |
Expanding a row shows the contract detail: groups (clustered by domain), sites, categories and individual resources.
A search field in the toolbar filters the list on the fly (triggered 700 ms after the last keystroke or immediately with the Enter key).
In addition to add, edit and delete, the toolbar offers Enable and Disable: these bulk actions apply to the current selection.
Add a contract¶
The + button opens the Add Contract window, with three tabs preceded by the following fields:
| Field | Description |
|---|---|
| Name | Mandatory. A string made only of spaces is rejected. |
| Description | Free text. |
| Allow users to use authentication tokens | Lets users obtain reusable tokens under this contract. Unticked, it greys out the next field. |
| Authentication tokens valididy in days (0 to disable token expiration) | Only active if the previous checkbox is ticked. The value 0 makes tokens never expire. |
The Validate button is enabled only when at least one group, one site and one application have been selected.
Two-column list (available on the left, selected on the right) with a Domain combo above the left-hand list to filter groups by authentication domain. Selection is performed by drag and drop. SAML domains are excluded (login/password authentication is required).
Two-column list (available on the left, selected on the right). Drag-and-drop selection and a Select all button.
Default site hidden
The platform's default site is automatically removed from the list of available sites.
Tree of application categories and their applications. Checking a category selects all of its applications at once; checking a single one puts the category in bold, to signal a partial selection. Unchecking a category also unchecks all of its content.
When created, the contract is enabled by default.
Edit a contract¶
Select the contract in the list and click the Properties icon, or double-click the row. The Contract Edition window offers the same tabs, pre-filled. Click Validate to save.
Delete a contract¶
Select one or more contracts and click the × button. A confirmation is requested (label adapted to the singular or plural case).
Enable or disable contracts¶
Select one or more rows in the grid, then click Enable or Disable in the toolbar. Enable is available when at least one selected contract is disabled, Disable when at least one selected contract is enabled.
RDP direct access tokens¶
The RDP direct access tokens module lists the tokens issued by users under RDP-without-agent contracts that allow tokens. It allows revoking a token before its expiration.
Token list¶
| Column | Description |
|---|---|
| Username | Identifier of the user who issued the token. |
| Application | Name of the application targeted by the token. |
| Expiration | Expiration date and time, formatted as DD/MM/YYYY HH:MM. |
The list is paginated (15, 25 or 50 rows per page).
Filters and search¶
| Element | Description |
|---|---|
| Domain | Combo of available domains. SAML domains are excluded. The initial selection takes the domain provided as a parameter, or the first domain in the list otherwise. |
| Search field | Substring filter. Triggered 700 ms after the last keystroke. |
Delete a token¶
Select one or more tokens and click the × button. A confirmation is requested. If the command fails, an error message is shown.
Irreversible action
Once deleted, a token can no longer be used: the user must request a new one to renew the direct access.