GUACAMOLE-2210: Add support for AAD authentication to RDP protocol.

[aleitner]

• Adds Azure AD (Entra ID) authentication for RDP connections using FreeRDP 3's AadSecurity mode
• Uses the OAuth2 device authorization grant (RFC 8628), so no credentials are stored in or entered through Guacamole. The user completes sign-in on a separate device (typically a phone) by scanning a QR code
• HTTP requests use libcurl; token/device-code responses are parsed with WinPR's JSON API

Authentication flow

When security=aad is set on an RDP connection:

1. FreeRDP begins the AAD handshake and invokes the GetAccessToken callback with the requested scope and a Proof-of-Possession key confirmation (req_cnf).
2. guacd requests a device code from Azure AD using the configured application (client) ID and scope, receiving a user code and a verification URI.
3. guacd opens a pipe stream to the connection owner carrying the user code and verification URI as JSON. The web client renders this as a QR code (paired change: apache/guacamole-client#1168).
4. guacd polls the token endpoint (grant_type=urn:ietf:params:oauth:grant-type:device_code) while the user authenticates on their own device, forwarding req_cnf so Azure issues a Proof-of-Possession token. Polling honors the server-provided interval and slow_down, and stops if the connection closes or the code expires.
5. When the flow completes, the pipe stream is closed (dismissing the prompt) and the access token is handed to FreeRDP, which finishes the AAD-authenticated RDP session.

Configuration

New RDP parameters:

• aad-client-id (required for AAD) is the Azure AD application (client) ID to authenticate as. The app must have public client flows enabled so it can use the device code grant.
• aad-scope (optional) is the OAuth2 scope to request. If omitted, the scope FreeRDP derives for the target host is used.
• aad-tenant-id (optional) is the Azure AD tenant, defaulting to organizations.

Notes

• The entire feature is gated on HAVE_FREERDP_AAD_SUPPORT (FreeRDP built with AAD) and the presence of libcurl. If either is unavailable it compiles out cleanly, and non-AAD RDP is unaffected.
• Adds a unit test for the percent-decoding helper.

Paired with apache/guacamole-client#1168

[aleitner]

Didn't realize we don't have curl. This would require adding curl as a dependency

[necouchman]

Looks like the build is failing with an error about the switch() statement and one of the enums.

[aleitner]

Looks like the build is failing with an error about the switch() statement and one of the enums.

Ahh whoops! I was testing with only freerdp3 as that's when AAD support was implemented. Just added a case to the switch for freerdp2 so that it errors if AAD is selected

[mike-jumper]

Are we going to need to continually update this value to avoid being re-flagged as unsupported due to the claimed version being old?

[mike-jumper]

Not sure if this is an insane idea ... but we could calculate the expected current Chrome release from the current date based on their published major release cadence ...

[aleitner]

Microsoft's endpoints don't appear to validate browser version freshness currently. On the other hand we could fetch the latest stable major version from Google's VersionHistory API:
https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions

[aleitner]

Made the changes to get the latest chrome version!

[mike-jumper]

Unfortunately, phoning Google from within guacd is going to be a privacy issue. I don't think we can go this route.

[necouchman]

A few comments/changes. Also, generally:

• It seems like there might be a couple of opportunities for reusing code by creating a couple of new functions?
• Some of the documentation within the code is a bit sparse and could use a little more building out.

[aleitner]

Also fixed two runtime issues from changes Microsoft made to the AAD login flow. The credential POST field name needs to be flowToken (camelCase) per $Config.sFTName, and for AVD sessions Microsoft now serves a /common/rdp/set device-binding page that the browser auto-submits before the OAuth redirect, which we replicate with a second POST

[aleitner]

This has been reworked from the original login-page automation to the OAuth2 device authorization grant (RFC 8628), so the user signs in on a separate device via a QR code and no credentials pass through Guacamole.