@hardening, @akallabeth

About SSO, if you already have a ccache we will probably use it, but the client will still require that you provide user/password (that's a limit in our implementation right now)

Is this still the case? Or is SSO without providing creds but solely the .ccache file possible?
Thanks!

@YugoCode @hardening did address this issue recently with #10549
so now just add /remoteGuard and it will reuse your existing kerberos .ccache

it might still not work if there is no ticket already (work in progress) but it is a start

Thanks for mentioning this update @akallabeth

Is there any way to know when the next release will happen, I believe the roadmap is close to 100% for 3.9.0, just would like to test this feature /remoteGuard with a ticket provided in KRB5CCACHE, if I really want to try it out before the release there is also the option to compile it I guess

Hi, I connected with kinit to the server and can see my connection with klist. If I connect to my server with:
xfreerdp3 /auth-pkg-list:'!ntlm,kerberos' /u:xxxxxxxxx /p:xxxxxxxxx /v:192.168.30.21 /d:xxxxxxxxx.LAN /cert:ignore
I get this error:
InitializeSecurityContext failed with SEC_E_INTERNAL_ERROR [0x80090304] [transport_connect_nla]: ERRCONNECT_AUTHENTICATION_FAILED [0x00020009]
I'm absolutely sure that the authentication is correct. But I disabled NTLMv1/v2 on this server, so the connection must be established via kerberos.

Maybe I missed a configuration, but I couldn't find a really good guide on this topic. Thanks!

Hi, just getting back to a previous question. Can xfreerdp3 now be used from Linux (Kali) with a ccache in klist without a password or krb5.conf entry? If so can you provide an example command as I see kerberos mentioned in the help and nla etc?

In earlier posts I also see people saying look for GSSAPI in build config to make sure it's supported but I guess that may not be required anymore if Kerberos is enabled by default? Thanks

Well smartcard logon is a bit different, and you can achieve the same with FreeRDP with /smartcard-logon.

About details with kerberos: yes you can pass the pure Kerberos steps of NLA with an existing ccache, but until you specify the restricted admin option, that allows to not provide the user's password in clear, you need the password to fill TSUserPasswordCred in NLA.

BTW one could arg that you should also be able to smartcard logon with a pre-established ccache kinit -X X509_user_identity='PKCS11:opensc-pkcs11.so' ..., but in this case the pin is required anyway to fill TSSmartcardCreds