UAG - Generating RDP Configuration¶

Data Structures¶

`RdpConfigModel`¶
Attribute	Type	Required	Description
`otp`	string	yes	One-time password for the RDP connection. The listener, server and account written to the file are derived from it.
`host`	string		Address offered by the portal and selected by the user. Used only if, together with `port`, it matches an address the listener answers on; otherwise the listener’s default address is used. An IPv6 address is accepted with or without brackets.
`port`	number		Value-format: port. Port offered by the portal together with `host`. If omitted, the port of the listener mapping in which `host` was found is used.
`app`	string		Identifier of a RemoteApp of the account for which the OTP was issued.
`suffix`	string		Suffix of the file name: `fudo-<suffix>.rdp`. Without it, the file is named `fudo.rdp`.
`safe_id`	string		Identifier of the safe whose `rdp_config` lines are appended to the file and whose `rdp_file_signing_enabled` setting applies.
`server_id`	string		Deprecated. Accepted for compatibility with older portal versions and ignored.
`listener_id`	string		Deprecated. Accepted for compatibility with older portal versions and ignored.

Address in the File¶

The address written to the file comes from the listener for which the OTP was issued, in this order:

The external address and external port of the listener mapping, if set.
Otherwise, the listening address. A listener on 0.0.0.0 answers on all interface addresses available for its port; host and port select one of them.
For a listener published on the User Access Gateway without an external address, the host name under which the User Access Gateway was reached.

If the listener has an rdp_config_domain configured, the address is built as <server name or address>.<rdp_config_domain>.

File Signing¶

The file is signed with the TLS certificate of the listener, in the format used by rdpsign.exe (detached PKCS #7 signature, SHA-256). The file is served unsigned when:

the listener has no server certificate,
the safe given in safe_id has rdp_file_signing_enabled set to false,
the certificate of the listener is expired, not yet valid, or has no Server Authentication extended key usage,
the address comes from the host name under which the User Access Gateway was reached and that name is not on the list of allowed hosts, or the list is empty.

Retrieve Available Attributes of the RdpConfigModel¶

Request

Method	`GET`
Path	`/api/v2/objspec/rdp_config`

GET /api/v2/objspec/rdp_config

Example Request

curl -s -k -X GET \
  -H 'Authorization: sgfeea6jsaz4mum9su8w6' \
  'https://10.0.214.98/api/v2/objspec/rdp_config'

Generate RDP Configuration¶

Request

Method	`POST`
Path	`/api/v2/safe/rdp_config`
Headers	`Content-Type: application/json`
Body	`RdpConfigModel`

POST /api/v2/safe/rdp_config

Example Request

curl -s -k -X POST \
    -H 'Authorization: <token>' \
    -H 'Content-Type: application/json' \
    -d '{"otp":"80154212ToWXbRN6XMuXLCYwxRtKVE7m","suffix":"ad-user1-windows","safe_id":"5890708312600608769"}' \
    'https://10.33.4.95/api/v2/safe/rdp_config'

Note

The one-time password (otp) required in this request can be generated using the POST /api/v2/secret/otp endpoint. For an .rdp file, the OTP must be issued with listener_id. For more information, refer to the UAG - OTP Generation section.

Response

The response is the content of the fudo-ad-user1-windows.rdp file (Content-Type: application/x-rdp). The signature value is shortened in the example.

full address:s:10.33.4.95:3389
username:s:80154212ToWXbRN6XMuXLCYwxRtKVE7m
prompt for credentials:i:1
password:s:
alternate full address:s:10.33.4.95:3389
signscope:s:Full Address,Alternate Full Address,Prompt For Credentials
signature:s:AQABAAEAAAD9BAAAMIIE+QYJKoZIhvcNAQcCoIIE6jCCBOYCAQExDzANBglghkgBZQME...