Skip to main content

Remote Access Control (RAC) Provider

The RAC provider allows users to access remote Windows, macOS, and Linux machines via RDP/SSH/VNC. Just like other providers in authentik, the RAC provider is associated with an application that appears on a user's Application Dashboard page.

For instructions on creating a RAC provider, refer to the Create a Remote Access Control (RAC) provider documentation. Alternatively, watch our "Remote Access Control (RAC) in authentik" video on YouTube.

RAC components​

A RAC provider uses several components:

When a user starts the RAC application, it communicates with the authentik server, which then connects to the RAC outpost and sends instructions (based on the endpoint data you defined) on how to connect to the remote machine.

After connecting to the remote machine, the outpost sends a message back to the authentik server (via WebSockets), and the web browser opens the WebSocket connection to the remote machine.

Endpoints​

Unlike other providers, where an application-provider pair is created for each resource you wish to access, RAC works differently. RAC uses a single application connected to one RAC provider. The RAC provider then has an Endpoint object for each remote machine (computer/server) you want to connect to.

The Endpoint object specifies:

Additionally, it is possible to bind policies to Endpoint objects to restrict user access. To connect to a remote machine, users must have access to both the application that the RAC provider is using and the corresponding endpoint.

Connection management​

Launching a RAC application/endpoint from the User interface runs the provider's authorization flow and creates a connection authorization tied to the user's current authentik session. This authorization allows the browser to connect to that endpoint. You can view and delete stored connection authorizations from the Connections tab of the RAC provider.

Delete authorization on disconnect​

The RAC provider's Delete authorization on disconnect setting is disabled by default.

  • When disabled, the connection authorization remains available after a disconnect. The browser can reuse it to reconnect to the same endpoint without repeating the authorization flow, provided that the authorization and the authentik session are still valid. This allows reconnection after a temporary network failure. Launching the application/endpoint again starts a new authorization flow rather than reusing the previous authorization.
  • When enabled, the authorization cannot be reused. After a disconnect, the user must launch the application/endpoint again and complete the provider's authorization flow. This also applies when a temporary network failure interrupts the connection, so enabling the setting can cause repeated authorization prompts on unstable networks. The prompts depend on the stages configured in the authorization flow; reauthorization does not necessarily require logging in to authentik again.

Although the UI describes deletion as happening on disconnect, authentik deletes the stored authorization during connection setup, after requesting a connection from the outpost. The current connection continues, but subsequent reconnect attempts cannot use that authorization. A connection attempt that fails after this deletion also requires a new authorization.

Connection and session expiry​

Connection expiry limits the authorization's lifetime, starting when authentik creates it. The default is hours=8. Reconnecting with the same authorization does not reset this limit. When it expires, authentik disconnects the RAC connection and requires a new authorization, even if the user is still logged in to authentik.

The connection also ends when the user's authentik session expires or the user logs out. Delete authorization on disconnect controls authorization reuse; it does not extend or replace either expiry limit. Connection expiry still applies to the current connection when the setting is enabled.

A connection authorization is separate from the login session on the remote operating system. Deleting the authorization prevents reuse through authentik; it does not itself log the user out of the remote operating system or terminate applications running there. Whether a remote session survives a disconnected RAC connection depends on the protocol and the remote machine's session policies.

RAC Property Mappings​

You can create RAC property mappings via Customization > Property Mappings.

RAC property mappings allow you to configure the following settings:

  • Username: the username for the remote machine
  • Password: the password for the remote machine
  • Ignore server certificate: set whether the validity of the returned RDP server certificate will be ignored
  • Enable wallpaper: enable/disable the desktop wallpaper of the RDP server
  • Enable font-smoothing: enable/disable font-smoothing (anti-aliasing) on the RDP server
  • Enable full window dragging: enable/disable whether the full content of a window is visible while moving it on the RDP server
  • Advanced settings: set connection settings via a Python expression

Connection settings​

The RAC provider utilizes Apache Guacamole for establishing SSH, RDP and VNC connections. RAC supports the use of Apache Guacamole connection configurations.

Connection settings can include username, password, domain, private-key, security, enable-audio, and more.

For a full list of possible connection settings, see the Apache Guacamole connection configuration documentation.

RAC connection settings can be set via several methods and are all merged together when connecting:

  1. Default settings
  2. RAC Provider settings
  3. RAC Endpoint settings
  4. RAC Provider property mapping settings
  5. RAC Endpoint property mapping settings
  6. The connection_settings object in the flow plan

For examples of how to configure connection settings, see the RAC SSH public key authentication and RAC Credentials Prompt documentation.

Capabilities​

The following features are currently supported:

  • Bi-directional clipboard
  • Audio redirection (from remote machine to browser)
  • Resizing