test(dgw): run injection E2E without debug flags

Keep credential-injection tests focused on public behavior instead of
serializing the removed Kerberos debug option.

Issue: DVLS-14697

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: irvingoujAtDevolution

testsuite/src/dgw_config.rs

@@ -45,9 +45,6 @@ pub struct DgwConfig {
     /// Enable unstable features.
     #[builder(default = false)]
     enable_unstable: bool,
-    /// Enable Kerberos credential injection (also requires `enable_unstable`).
-    #[builder(default = false)]
-    kerberos_credential_injection: bool,
     /// Override the recording path in the gateway config.
     ///
     /// When `None`, the gateway uses its default (`<data_dir>/recordings`).
@@ -87,7 +84,6 @@ impl DgwConfigHandle {
             disable_token_validation,
             verbosity_profile,
             enable_unstable,
-            kerberos_credential_injection,
             recording_path,
             agent_tunnel,
         } = config;
@@ -141,8 +137,7 @@ impl DgwConfigHandle {
     "VerbosityProfile": "{verbosity_profile}",
     "__debug__": {{
         "disable_token_validation": {disable_token_validation},
-        "enable_unstable": {enable_unstable},
-        "kerberos_credential_injection": {kerberos_credential_injection}
+        "enable_unstable": {enable_unstable}
     }}{recording_path_json}{agent_tunnel_json}
 }}"#
         );

testsuite/tests/cli/dgw/cred_injection.rs

@@ -226,12 +226,10 @@ pub(crate) struct GatewayProc {
 }
 
 impl GatewayProc {
-    pub(crate) async fn start(kerberos: bool) -> anyhow::Result<Self> {
+    pub(crate) async fn start() -> anyhow::Result<Self> {
         let config = DgwConfig::builder()
             .disable_token_validation(true)
             .verbosity_profile(VerbosityProfile::DEBUG)
-            .enable_unstable(kerberos)
-            .kerberos_credential_injection(kerberos)
             .build()
             .init()
             .context("init gateway config")?;
@@ -430,7 +428,7 @@ async fn connect_rdp_client(gateway_tcp: u16, association_jwt: &str) -> anyhow::
 #[tokio::test]
 async fn first_rdp_connection_injects_ntlm() -> anyhow::Result<()> {
     let target = FakeRdpTarget::start().await?;
-    let mut gateway = GatewayProc::start(false).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -462,7 +460,7 @@ async fn first_rdp_connection_injects_ntlm() -> anyhow::Result<()> {
 #[tokio::test]
 async fn reconnect_same_jwt_still_injects() -> anyhow::Result<()> {
     let target = FakeRdpTarget::start().await?;
-    let mut gateway = GatewayProc::start(false).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -500,7 +498,7 @@ async fn reconnect_same_jwt_still_injects() -> anyhow::Result<()> {
 #[tokio::test]
 async fn required_missing_fails_closed() -> anyhow::Result<()> {
     let target = FakeRdpTarget::start().await?;
-    let mut gateway = GatewayProc::start(false).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -533,7 +531,7 @@ async fn required_missing_fails_closed() -> anyhow::Result<()> {
 #[tokio::test]
 async fn unprovisioned_rdp_uses_ordinary_forward() -> anyhow::Result<()> {
     let target = FakeRdpTarget::start().await?;
-    let mut gateway = GatewayProc::start(false).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -560,7 +558,7 @@ async fn unprovisioned_rdp_uses_ordinary_forward() -> anyhow::Result<()> {
 #[tokio::test]
 async fn kerberos_reconnect_reuses_generation_until_reprovision() -> anyhow::Result<()> {
     let target = FakeRdpTarget::start().await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -647,7 +645,7 @@ async fn kerberos_reconnect_reuses_generation_until_reprovision() -> anyhow::Res
 #[tokio::test]
 async fn domainless_target_stays_ntlm_even_with_krb_kdc() -> anyhow::Result<()> {
     let target = FakeRdpTarget::start().await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -673,9 +671,9 @@ async fn domainless_target_stays_ntlm_even_with_krb_kdc() -> anyhow::Result<()>
 }
 
 #[tokio::test]
-async fn kerberos_opt_out_uses_ntlm_for_domain_user() -> anyhow::Result<()> {
+async fn kerberos_injection_does_not_need_debug_flags() -> anyhow::Result<()> {
     let target = FakeRdpTarget::start().await?;
-    let mut gateway = GatewayProc::start(false).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -692,8 +690,8 @@ async fn kerberos_opt_out_uses_ntlm_for_domain_user() -> anyhow::Result<()> {
     let _client = connect_rdp_client(gateway.config.tcp_port(), &token).await?;
     let logs = gateway.logs.wait_contains(INJECT_LOG).await?;
     assert!(
-        logs.contains("kerberos=false"),
-        "Kerberos injection opt-out must NTLM even with a domain username; logs:\n{logs}"
+        logs.contains("kerberos=true"),
+        "Kerberos injection must run without debug flags; logs:\n{logs}"
     );
 
     let _ = gateway.process.start_kill();

testsuite/tests/cli/dgw/cred_injection_kdc.rs

@@ -972,7 +972,7 @@ async fn kerberos_injection_completes_credssp_against_mock_kdc() -> anyhow::Resu
     install_crypto_provider();
     let kdc = MockKdc::start().await?;
     let rdp = MockRdp::start_kerberos(kdc.url()).await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -1021,7 +1021,7 @@ async fn kerberos_client_and_target_legs_complete_credssp() -> anyhow::Result<()
     install_crypto_provider();
     let kdc = MockKdc::start().await?;
     let rdp = MockRdp::start_kerberos(kdc.url()).await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -1111,7 +1111,7 @@ async fn kerberos_wrong_target_password_fails_closed() -> anyhow::Result<()> {
     install_crypto_provider();
     let kdc = MockKdc::start().await?;
     let rdp = MockRdp::start_kerberos(kdc.url()).await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -1219,7 +1219,7 @@ async fn kerberos_kdc_down_fails_closed() -> anyhow::Result<()> {
     let kdc = RefusingKdc::start().await?;
     let rdp_kdc = MockKdc::start().await?;
     let rdp = MockRdp::start_kerberos(rdp_kdc.url()).await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -1277,7 +1277,7 @@ async fn kerberos_kdc_down_fails_closed() -> anyhow::Result<()> {
 #[tokio::test]
 async fn kerberos_missing_krb_kdc_fails_closed() -> anyhow::Result<()> {
     let rdp = FakeClosedTarget::start().await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -1309,7 +1309,7 @@ async fn kerberos_missing_krb_kdc_fails_closed() -> anyhow::Result<()> {
 async fn ntlm_injection_completes_credssp_both_legs() -> anyhow::Result<()> {
     install_crypto_provider();
     let rdp = MockRdp::start_ntlm().await?;
-    let mut gateway = GatewayProc::start(false).await?;
+    let mut gateway = GatewayProc::start().await?;
 
     let jti = next_id();
     let jet_aid = next_id();
@@ -1514,7 +1514,7 @@ async fn ironrdp_agent_rdcleanpath_ntlm_injection() -> anyhow::Result<()> {
     };
     install_crypto_provider();
     let rdp = MockRdp::start_ntlm().await?;
-    let mut gateway = GatewayProc::start(false).await?;
+    let mut gateway = GatewayProc::start().await?;
     let endpoint = ironrdp_agent_endpoint();
     let mut daemon = start_ironrdp_daemon(&bin, &endpoint).await?;
 
@@ -1573,7 +1573,7 @@ async fn ironrdp_agent_rdcleanpath_kerberos_injection() -> anyhow::Result<()> {
     install_crypto_provider();
     let kdc = MockKdc::start().await?;
     let rdp = MockRdp::start_kerberos(kdc.url()).await?;
-    let mut gateway = GatewayProc::start(true).await?;
+    let mut gateway = GatewayProc::start().await?;
     let endpoint = ironrdp_agent_endpoint();
     let mut daemon = start_ironrdp_daemon(&bin, &endpoint).await?;