Fix #3099

Add session creation
Update ironrdp
2026-07-09 07:30:40 +02:00 · 2026-07-08 21:44:20 -04:00 · 2026-07-08 21:17:40 -04:00 · 2026-07-08 16:23:53 -04:00
29 changed files with 182 additions and 16 deletions
@@ -41,7 +41,7 @@ services:
      - 80:80 # Port for traefik because of the network_mode

  traefik:
-    image: traefik:v3.7
+    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
@@ -50,7 +50,7 @@ services:
      - 80:80{{end}}

  traefik:
-    image: docker.io/traefik:v3.7
+    image: docker.io/traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.45.0
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )
@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Генериране на токен за достъп",
    "actionDeleteAccessToken": "Изтриване на токен за достъп",
    "actionListAccessTokens": "Изброяване на токени за достъп",
+    "actionCreateResourceSessionToken": "Създаване на токен за сесия на ресурс",
    "actionCreateResourceRule": "Създаване на правило за ресурс",
    "actionDeleteResourceRule": "Изтрийте правило за ресурс",
    "actionListResourceRules": "Изброяване на правила за ресурс",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generovat přístupový token",
    "actionDeleteAccessToken": "Odstranit přístupový token",
    "actionListAccessTokens": "Seznam přístupových tokenů",
+    "actionCreateResourceSessionToken": "Vytvořit token relace prostředku",
    "actionCreateResourceRule": "Vytvořit pravidlo pro zdroj",
    "actionDeleteResourceRule": "Odstranit pravidlo pro dokument",
    "actionListResourceRules": "Seznam pravidel zdrojů",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generer adgangstoken",
    "actionDeleteAccessToken": "Slet adgangstoken",
    "actionListAccessTokens": "Vis adgangstokens",
+    "actionCreateResourceSessionToken": "Opret ressourcesessionstoken",
    "actionCreateResourceRule": "Opret ressourceregel",
    "actionDeleteResourceRule": "Slet ressourceregel",
    "actionListResourceRules": "Vis ressourceregler",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Zugriffstoken generieren",
    "actionDeleteAccessToken": "Zugriffstoken löschen",
    "actionListAccessTokens": "Zugriffstoken auflisten",
+    "actionCreateResourceSessionToken": "Ressourcensitzungstoken erstellen",
    "actionCreateResourceRule": "Ressourcenregel erstellen",
    "actionDeleteResourceRule": "Ressourcenregel löschen",
    "actionListResourceRules": "Ressourcenregeln auflisten",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generate Access Token",
    "actionDeleteAccessToken": "Delete Access Token",
    "actionListAccessTokens": "List Access Tokens",
+    "actionCreateResourceSessionToken": "Create Resource Session Token",
    "actionCreateResourceRule": "Create Resource Rule",
    "actionDeleteResourceRule": "Delete Resource Rule",
    "actionListResourceRules": "List Resource Rules",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generar token de acceso",
    "actionDeleteAccessToken": "Eliminar token de acceso",
    "actionListAccessTokens": "Lista de Tokens de Acceso",
+    "actionCreateResourceSessionToken": "Crear token de sesión de recurso",
    "actionCreateResourceRule": "Crear Regla de Recursos",
    "actionDeleteResourceRule": "Eliminar Regla de Recurso",
    "actionListResourceRules": "Lista de Reglas de Recursos",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Générer un jeton d'accès",
    "actionDeleteAccessToken": "Supprimer un jeton d'accès",
    "actionListAccessTokens": "Lister les jetons d'accès",
+    "actionCreateResourceSessionToken": "Créer un jeton de session de ressource",
    "actionCreateResourceRule": "Créer une règle de ressource",
    "actionDeleteResourceRule": "Supprimer une règle de ressource",
    "actionListResourceRules": "Lister les règles de ressource",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Genera Token di Accesso",
    "actionDeleteAccessToken": "Elimina Token di Accesso",
    "actionListAccessTokens": "Elenca Token di Accesso",
+    "actionCreateResourceSessionToken": "Crea token di sessione risorsa",
    "actionCreateResourceRule": "Crea Regola Risorsa",
    "actionDeleteResourceRule": "Elimina Regola Risorsa",
    "actionListResourceRules": "Elenca Regole Risorsa",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "액세스 토큰 생성",
    "actionDeleteAccessToken": "액세스 토큰 삭제",
    "actionListAccessTokens": "액세스 토큰 목록",
+    "actionCreateResourceSessionToken": "리소스 세션 토큰 생성",
    "actionCreateResourceRule": "리소스 규칙 생성",
    "actionDeleteResourceRule": "리소스 규칙 삭제",
    "actionListResourceRules": "리소스 규칙 목록",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Generer tilgangstoken",
    "actionDeleteAccessToken": "Slett tilgangstoken",
    "actionListAccessTokens": "List opp tilgangstokener",
+    "actionCreateResourceSessionToken": "Opprett ressurssesjonstoken",
    "actionCreateResourceRule": "Opprett ressursregel",
    "actionDeleteResourceRule": "Slett ressursregel",
    "actionListResourceRules": "List opp ressursregler",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Genereer Toegangstoken",
    "actionDeleteAccessToken": "Verwijder toegangstoken",
    "actionListAccessTokens": "Lijst toegangstokens",
+    "actionCreateResourceSessionToken": "Resourcesessietoken maken",
    "actionCreateResourceRule": "Bronregel aanmaken",
    "actionDeleteResourceRule": "Verwijder Resource Regel",
    "actionListResourceRules": "Bron regels weergeven",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Wygeneruj token dostępu",
    "actionDeleteAccessToken": "Usuń token dostępu",
    "actionListAccessTokens": "Lista tokenów dostępu",
+    "actionCreateResourceSessionToken": "Utwórz token sesji zasobu",
    "actionCreateResourceRule": "Utwórz regułę zasobu",
    "actionDeleteResourceRule": "Usuń regułę zasobu",
    "actionListResourceRules": "Lista reguł zasobu",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Gerar Token de Acesso",
    "actionDeleteAccessToken": "Eliminar Token de Acesso",
    "actionListAccessTokens": "Listar Tokens de Acesso",
+    "actionCreateResourceSessionToken": "Criar token de sessão de recurso",
    "actionCreateResourceRule": "Criar Regra de Recurso",
    "actionDeleteResourceRule": "Eliminar Regra de Recurso",
    "actionListResourceRules": "Listar Regras de Recurso",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Сгенерировать токен доступа",
    "actionDeleteAccessToken": "Удалить токен доступа",
    "actionListAccessTokens": "Список токенов доступа",
+    "actionCreateResourceSessionToken": "Создать токен сеанса ресурса",
    "actionCreateResourceRule": "Создать правило ресурса",
    "actionDeleteResourceRule": "Удалить правило ресурса",
    "actionListResourceRules": "Список правил ресурса",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "Erişim Jetonu Oluştur",
    "actionDeleteAccessToken": "Erişim Jetonunu Sil",
    "actionListAccessTokens": "Erişim Jetonlarını Listele",
+    "actionCreateResourceSessionToken": "Kaynak Oturum Belirteci Oluştur",
    "actionCreateResourceRule": "Kaynak Kuralı Oluştur",
    "actionDeleteResourceRule": "Kaynak Kuralını Sil",
    "actionListResourceRules": "Kaynak Kurallarını Listele",
@@ -1462,6 +1462,7 @@
    "actionGenerateAccessToken": "生成访问令牌",
    "actionDeleteAccessToken": "删除访问令牌",
    "actionListAccessTokens": "访问令牌",
+    "actionCreateResourceSessionToken": "创建资源会话令牌",
    "actionCreateResourceRule": "创建资源规则",
    "actionDeleteResourceRule": "删除资源规则",
    "actionListResourceRules": "列出资源规则",
@@ -1099,6 +1099,7 @@
    "actionGenerateAccessToken": "生成訪問令牌",
    "actionDeleteAccessToken": "刪除訪問令牌",
    "actionListAccessTokens": "訪問令牌",
+    "actionCreateResourceSessionToken": "建立資源工作階段權杖",
    "actionCreateResourceRule": "創建資源規則",
    "actionDeleteResourceRule": "刪除資源規則",
    "actionListResourceRules": "列出資源規則",
@@ -12,7 +12,7 @@
                "@asteasolutions/zod-to-openapi": "8.5.0",
                "@aws-sdk/client-s3": "3.1056.0",
                "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
                "@headlessui/react": "2.2.10",
                "@hookform/resolvers": "5.4.0",
                "@monaco-editor/react": "4.7.0",
@@ -1124,9 +1124,9 @@
            "integrity": "sha512-9o7PkCw9fdvGTPs0hgsUJG10QleGgcdsSCw1ekLpUOlVXtWCuiuPH+0bPDFhLWxqbVA+8pyVhwqdOI+t1T3TNA=="
        },
        "node_modules/@devolutions/iron-remote-desktop-rdp": {
-            "version": "0.0.0",
-            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
-            "integrity": "sha512-O0YVpOJDwUzekH3N2QKj+48WP+56wI0sj4VmaJkGoW5XgyAj2ONn2k3i+vk17Eavx+Vg6vAg3lwYRAOK4kKIDQ=="
+            "version": "0.0.1",
+            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
+            "integrity": "sha512-sIHllJ6rJfAgClsUFjJfVGFjIxm6ZQRyGfinwCzHYgwnHAMFE+Kvm0YzR9tg811Fhjm5F6gNUSLAll+7Eh0Deg=="
        },
        "node_modules/@dotenvx/dotenvx": {
            "version": "1.69.1",
@@ -34,7 +34,7 @@
    "dependencies": {
        "@asteasolutions/zod-to-openapi": "8.5.0",
        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
        "@aws-sdk/client-s3": "3.1056.0",
        "@headlessui/react": "2.2.10",
        "@hookform/resolvers": "5.4.0",
@@ -71,6 +71,7 @@ export enum ActionsEnum {
    setResourceWhitelist = "setResourceWhitelist",
    getResourceWhitelist = "getResourceWhitelist",
    generateAccessToken = "generateAccessToken",
+    createResourceSessionToken = "createResourceSessionToken",
    deleteAcessToken = "deleteAcessToken",
    listAccessTokens = "listAccessTokens",
    createResourceRule = "createResourceRule",
@@ -736,11 +736,14 @@ export async function verifyResourceSession(
            }
        }

-        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge
+        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge.
+        // Skip the challenge when SSO is also enabled so browsers get the SSO redirect instead of a native Basic
+        // Auth dialog; clients that proactively send Authorization: Basic are still accepted above.
        if (
            headerAuthExtendedCompatibility &&
            headerAuthExtendedCompatibility.extendedCompatibilityIsActivated &&
-            !clientHeaderAuth
+            !clientHeaderAuth &&
+            !sso
        ) {
            return headerAuthChallenged(res, redirectPath, resource.orgId);
        }
@@ -808,6 +808,16 @@ authenticated.post(
    accessToken.generateAccessToken
 );

+authenticated.post(
+    `/resource/:resourceId/session-token`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyUserAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceSessionToken),
+    logActionAudit(ActionsEnum.createResourceSessionToken),
+    resource.createResourceSessionToken
+);
+
 authenticated.delete(
    `/access-token/:accessTokenId`,
    verifyApiKeyAccessTokenAccess,
@@ -0,0 +1,133 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resources, users, userOrgs } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import { createResourceSession } from "@server/auth/sessions/resource";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { createSession, generateSessionToken } from "@server/auth/sessions/app";
+import { response } from "@server/lib/response";
+
+const createResourceSessionTokenParams = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createResourceSessionTokenBody = z.strictObject({
+    userId: z.string().nonempty(),
+    idpId: z.coerce.number().int().positive().optional()
+});
+
+export type CreateResourceSessionTokenResponse = {
+    requestToken: string;
+};
+
+export async function createResourceSessionToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = createResourceSessionTokenParams.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = createResourceSessionTokenBody.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+        const { userId, idpId } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const candidates = await db
+            .select({ userId: users.userId })
+            .from(userOrgs)
+            .innerJoin(users, eq(userOrgs.userId, users.userId))
+            .where(
+                and(
+                    eq(users.userId, userId),
+                    eq(userOrgs.orgId, resource.orgId)
+                )
+            );
+
+        if (candidates.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `User not found in the organization that owns this resource`
+                )
+            );
+        }
+
+        if (candidates.length > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Multiple users match this username (external users from different identity providers). Specify idpId to disambiguate."
+                )
+            );
+        }
+
+        const targetUserId = candidates[0].userId;
+
+        const appSessionToken = generateSessionToken();
+        const appSession = await createSession(appSessionToken, targetUserId);
+
+        const requestToken = generateSessionToken();
+        await createResourceSession({
+            resourceId,
+            token: requestToken,
+            userSessionId: appSession.sessionId,
+            isRequestToken: true,
+            expiresAt: Date.now() + 1000 * 30, // 30 seconds
+            sessionLength: 1000 * 30,
+            doNotExtend: true
+        });
+
+        logger.debug("Resource session token created successfully");
+
+        return response<CreateResourceSessionTokenResponse>(res, {
+            data: { requestToken },
+            success: true,
+            error: false,
+            message: "Resource session token created successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
@@ -17,6 +17,7 @@ export * from "./getResourceWhitelist";
 export * from "./authWithWhitelist";
 export * from "./authWithAccessToken";
 export * from "./getExchangeToken";
+export * from "./createResourceSessionToken";
 export * from "./createResourceRule";
 export * from "./deleteResourceRule";
 export * from "./listResourceRules";
@@ -77,7 +77,8 @@ function getActionsCategories(root: boolean) {
            [t("actionDeleteSiteResource")]: "deleteSiteResource",
            [t("actionGetSiteResource")]: "getSiteResource",
            [t("actionListSiteResources")]: "listSiteResources",
-            [t("actionUpdateSiteResource")]: "updateSiteResource"
+            [t("actionUpdateSiteResource")]: "updateSiteResource",
+            [t("actionCreateResourceSessionToken")]: "createResourceSessionToken"
        },

        Target: {
Author	SHA1	Message	Date
Owen	6d129c0738	Fix #3099	2026-07-08 21:44:20 -04:00
Owen	67a3d226f5	Add session creation	2026-07-08 21:17:40 -04:00
Owen	19a3773880	Update ironrdp Ref #3272	2026-07-08 16:23:53 -04:00