rustguac

When enabled, users will be asked for username/password even if credentials are stored.

Leave blank to use the server default (NTLM unless overridden in config.toml [rdp] default_auth_pkg). Kerberos and Negotiate need a domain-joined host with a KDC reachable via DNS; when that isn't set up the RDP connection hangs silently, so NTLM is the safe default.

Optional. Kerberos Key Distribution Center proxy URL.

When enabled, users will be asked for username/password even if credentials are stored.

When enabled, users will be asked for a password even if one is stored.

Use $RUSTGUAC_USERNAME and $RUSTGUAC_PASSWORD in the URL for basic auth (e.g. https://$RUSTGUAC_USERNAME:$RUSTGUAC_PASSWORD@host).

Docker image with xrdp on port 3389. By default the entrypoint should read VDI_USERNAME / VDI_PASSWORD env vars (rustguac derives them from your identity and generates an ephemeral password per connect). For images with a baked-in account, fill in the Container username / password fields below. Container is ephemeral - persists while idle, then removed.

Use these only when the container image has a fixed account (Pattern B in the VDI docs). When set, rustguac uses these creds for the RDP login into the container, and the same container is shared by everyone connecting through this entry (deterministic name from the username). When left blank, rustguac derives a per-operator username and generates a fresh password every connect. Both fields support credential variables (e.g. $corp_username).

When enabled, users can generate a read-only Share URL for active sessions of this entry. Off by default — admins opt in per entry.

On first visit to Connections, if the user has exactly one visible entry and this box is ticked, connect automatically (replaces the current tab — browsers block new-tab popups without a click). Kiosk-style single-purpose accounts.