[org-event]

An RdpServer holds a single Credentials, so a server with more than one account cannot use NLA: CredSSP checks every client against that one identity.

This adds a list of accepted credentials:

• RdpServer::set_credential_list, RdpServerHandle::set_credential_list and ServerEvent::SetCredentialList replace the accepted set for subsequent connections.
• CredSSP checks the client's password against the entry whose user name matches, through CredsspSequence::init_with_identities. CredentialsProxy::auth_data returns every entry, so a SPNEGO client is matched against all of them.
• ClientInfo credentials (TLS and RDP security) must match one of the entries.
• Acceptor::set_credential_list does the same for embedders that drive the acceptor themselves.

set_credentials and CredsspSequence::init keep their behaviour: they are now a list of at most one entry. None (no credentials configured) keeps its behaviour from #1150: ClientInfo credentials are not checked. A list, even an empty one, requires a match: an empty list refuses every ClientInfo logon unless a credential validator decides them, and CredSSP fails.

Tests

testsuite-core:

• credssp_accepts_any_of_several_credentials: the accept/refuse table for HYBRID and HYBRID_EX.
• credssp_hands_the_matching_account_to_the_handler: with HYBRID_EX the delegated credentials are those of the matching account.
• refused_credssp_logon_hands_nothing_to_the_handler.
• an_empty_credential_list_fails_credssp and an_empty_credential_list_refuses_client_info_credentials.
• no_credentials_leave_client_info_credentials_unchecked and an_empty_credential_list_leaves_client_info_credentials_to_the_validator.
• client_info_credentials_must_match_an_accepted_account.

testsuite-extra:

• server_handle_set_credential_list_accepts_any_listed_account: an e2e connection as the second listed account.

The table and the ClientInfo test fail when the lookup checks only the first entry.

Refs #1357.

[Greg Lamberson (glamberson)]

An empty list shouldn't accept everyone on the TLS path.

On master, RdpServerHandle::set_credentials takes a Credentials, so nothing can open a running server through the handle. set_credential_list adds that: Send it an empty list, for example after an account store reloads with no rows, and with no validator any client gets in. An empty list should refuse ClientInfo logons, and an_empty_credential_list_accepts_any_client_info_credentials should assert that.

None meaning no requirement came from my fix in #1150. It was a workaround, and CBenoit's objection there was that forgetting to configure authentication can't be told apart from skipping it on purpose. I wouldn't carry that into a new API. The ClientInfoCredentialsPolicy he sketched in that review would fit a list.

This should also reference #1357, which he keeps open as the anchor for credential changes.

[org-event]

Thanks, agreed: an empty list shouldn't open the server.

Fixed in 8dcf6b2. The acceptor and the server now keep Option<Vec<Credentials>>:

• None, nothing configured, keeps the fix(acceptor): skip credential check when server credentials are None #1150 behaviour, so set_credentials(None) and Acceptor::new(.., None) don't change for existing users.
• A list from set_credential_list, empty included, requires a match. An empty list refuses every ClientInfo logon, and CredSSP still fails.
• With set_allow_unverified_credentials, the external validator still decides ClientInfo logons.

The test is now an_empty_credential_list_refuses_client_info_credentials, next to no_credentials_leave_client_info_credentials_unchecked and an_empty_credential_list_leaves_client_info_credentials_to_the_validator.

I kept ClientInfoCredentialsPolicy out of this PR so it stays about the list. I can do it as a follow-up under #1357, or fold it in here if you and CBenoit prefer. I've added the #1357 reference to the description.