Freerdp webview /aad

Help
1

I have been wracking my brain trying to get this to work and I’m at a loss.
Does anyone else have this solved?

I have a very specific need, where my work requires web auth for RDP.
sdl-freerdp supports /aad with sdl client but I can’t get the webview to open.
It keeps asking me to open a browser via a link but that breaks the auth flow in my company’s policy (thanks intune)

My only option is using the SDL client’s webview.

2

Unfortunately looks like there’s no option to enable it in the nixpkgs package, it unconditionally disables it:

The good thing is it should be pretty trivial to patch the package to add an option.

3

Thanks for this but I’m not very strong on patching derivations.
I know I can do:

pkgs.freerdp.overrideAttrs (oldAttrs:
{
  cmakeFlags = oldAttrs.cmakeFlags ++ [];
})

I just don’t know how I would replace the WITH_WEBVIEW since it’s in another function.

1 Like
4

maybe try

cmakeFlags = builtins.map (
  line: if line == "-DWITH_WEBVIEW:BOOL=FALSE" then "-DWITH_WEBVIEW:BOOL=TRUE"
 else line
) oldAttrs.cmakeFlags;

within the overrideAttrs?

1 Like
5

source:

      (freerdp.overrideAttrs (oldAttrs:{
        cmakeFlags = map (line: if line == "-DWITH_WEBVIEW:BOOL=FALSE" then "-DWITH_WEBVIEW:BOOL=TRUE" else line) oldAttrs.cmakeFlags;
        buildInputs = oldAttrs.buildInputs ++ [ webkitgtk_4_1 ];
      }))

That appears to work but now it fails to compile. It’s trying to download sources from git:

       > CMake Error at /nix/store/v2i1hgv567g3v91im5x4g5bff52143i0-cmake-4.1.2/share/cmake-4.1/Modules/ExternalProject/shared_internal_commands.cmake:928 (message):
       >   error: could not find git for clone of webview-populate
       > Call Stack (most recent call first):
       >   /nix/store/v2i1hgv567g3v91im5x4g5bff52143i0-cmake-4.1.2/share/cmake-4.1/Modules/ExternalProject.cmake:3080 (_ep_add_download_command)
       >   CMakeLists.txt:29 (ExternalProject_Add)
       >
       >
       > -- Configuring incomplete, errors occurred!
       > 
       > CMake Error at /nix/store/v2i1hgv567g3v91im5x4g5bff52143i0-cmake-4.1.2/share/cmake-4.1/Modules/FetchContent.cmake:1906 (message):
       >   CMake step for webview failed: 1
       > Call Stack (most recent call first):
       >   /nix/store/v2i1hgv567g3v91im5x4g5bff52143i0-cmake-4.1.2/share/cmake-4.1/Modules/FetchContent.cmake:1609 (__FetchContent_populateSubbuild)
       >   /nix/store/v2i1hgv567g3v91im5x4g5bff52143i0-cmake-4.1.2/share/cmake-4.1/Modules/FetchContent.cmake:2145:EVAL:2 (__FetchContent_doPopulation)
       >   /nix/store/v2i1hgv567g3v91im5x4g5bff52143i0-cmake-4.1.2/share/cmake-4.1/Modules/FetchContent.cmake:2145 (cmake_language)
       >   /nix/store/v2i1hgv567g3v91im5x4g5bff52143i0-cmake-4.1.2/share/cmake-4.1/Modules/FetchContent.cmake:2384 (__FetchContent_Populate)
       >   client/SDL/common/aad/CMakeLists.txt:39 (FetchContent_MakeAvailable)
1 Like
6

See if this PR fixes your problems:

2 Likes
7

VERY CLOSE:

image
image821×646 8.77 KB

1 Like
8

Added glib-networking, hopefully that fixes it.

1 Like
9

Unfortunately not, still the same error.
I wonder if it’s related to this error:

[12:33:40:277] [1947519:001db7a5] [WARN][com.freerdp.crypto] - [verify_cb]: Certificate verification failure ‘unable to get local issuer certificate (20)’ at stack position 0
[12:33:40:277] [1947519:001db7a5] [WARN][com.freerdp.crypto] - [verify_cb]: DC = a8005ae6-5236-44b5-9b29-3fb2ab1b83c2, CN = 146e3997-4aeb-4b34-9e80-ed7741b36d05

(That’s microsoft’s CN)

ignoring cert doesn’t change anything.

1 Like
10

Nah, glib-networking is just not loading properly. I’ll try and fix.

1 Like
11

I did find this:
https://www.reddit.com/r/NixOS/comments/k1lt7c/tlsssl_support_not_available_install/

12

OK just wrapped every $out/bin executable with GIO_EXTRA_MODULES. Should work now.

1 Like
13

You wanna join on discord so we can do this without spamming the thread?
need gstreamer:

image
image825×660 16.6 KB

14

Update for anyone else looking here: We did not end up solving @nosferatu’s actual problem here (blocked on upstream issues), although my PR was able to enable the webview properly.

1 Like
15

Just some more info, freerdp likely has some segfault bugs related to this and isn’t ready yet.

But yeah the webview appears and login is possible, it just segfaults immediately following login.

1 Like
16

BTW I filed an issue with upstream for this just now with some info from you to make sure they know about it, as I did not see any open upstream issues about this:

1 Like
17

@nosferatu a FreeRDP dev pointed out on that issue that there is support for Microsoft Identity Broker with SSO-MIB, unfortunately (or, rather, thankfully) I’m not familiar with this area, but it looks like the microsoft-identity-broker and intune-portal packages might be useful.

A few examples I was able to find:

18

Unfortunately for my particular usecase the intune integration is not going to work. In fact I need the /aad functionality to get around the fact I can’t use intune in my usecase.

1 Like
19

If you could share a more exact reason why intune integration does not work for your usecase, feel free to comment that in the issue, if not, I understand.

Thanks for debugging with me though!

21

Its just a quirk of how I separate my work devices from personal devices.

Some of my company’s policies conflict with how I use my personal device.

1 Like