feat(credssp): use the KdcResolution enum instead of KDC url

[Rostyslav-Romanets]

This PR adds the KdcResolution enum, which specifies how Kerberos should resolve the KDC, either by using IAKERB proxy or by connecting directly to an external KDC specified by URL.

THis PR is part of integration of the IAKERB extension in sspi-rs and updates the codebase to use the updated public API of sspi-rs.

Related PRs

• picky-rs: feat(picky-krb): add IAKerb proxy message encoding/decoding picky-rs#531
• sspi-rs: feat(kerberos): add support for IAKerb extension for Kerberos client sspi-rs#751

[Copilot]

Copilot review overview

🟡 Changes recommended

Local path overrides break clean checkouts, and the testsuite imports an incompatible KdcResolution type.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1 · 1

Open (3)

• Remove invalid local Cargo overrides and regenerate the lockfile · New
• Mark the publicly re-exported sspi dependency as public · New
• Import the correct KdcResolution enum for the connector field · New

What changed in this PR

Updates CredSSP Kerberos configuration for sspi 0.22 and IAKERB-based KDC resolution.

Changes:

• Adds KdcResolution and Kerberos configuration constructors.
• Migrates client, web, and test code to the new API.
• Updates sspi, picky, and related dependencies.

File	Description
Cargo.toml	Adds local dependency overrides.
Cargo.lock	Updates the resolved dependency graph.
ffi/​Cargo.toml	Upgrades sspi.
crates/​ironrdp/​Cargo.toml	Upgrades example dependency on sspi.
crates/​ironrdp-web/​src/​session.rs	Uses URL-based KDC resolution.
crates/​ironrdp-testsuite-extra/​tests/​client/​config.rs	Updates the KDC URL assertion.
crates/​ironrdp-mstsgu/​Cargo.toml	Upgrades sspi and picky.
crates/​ironrdp-connector/​src/​credssp.rs	Adds KDC strategies and conversion to sspi.
crates/​ironrdp-connector/​Cargo.toml	Upgrades authentication dependencies.
crates/​ironrdp-client/​src/​config.rs	Maps configuration properties to KDC resolution.
crates/​ironrdp-acceptor/​src/​credssp.rs	Propagates request length errors.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Benoît Cortier (CBenoit)]

Thank you for adding this. I’ll review the picky-rs/sspi-rs PRs first.

[Copilot]

Copilot review overview

🔵 Needs a closer look

IAKERB configuration can retain a conflicting legacy KDC proxy property, and the local dependency patches remain nonportable.

Review effort: Balanced
Findings: None

Resolved since last review (3)

• Remove invalid local Cargo overrides and regenerate the lockfile
• Mark the publicly re-exported sspi dependency as public
• Import the correct KdcResolution enum for the connector field

Previously missed (1)

In code that hasn't changed since last review

Clear stale kdcproxyname when mirroring explicit Kerberos config

crates/​ironrdp-client/​src/​config.rs:1347

When cfg selects IAKerb, an existing kdcproxyname loaded from the property set survives because only kdcproxyurl is cleared. The built config uses IAKERB, but its public properties() still advertises the old proxy; feeding those properties into another builder then selects KdcUrl instead. Clear kdcproxyname whenever an explicit Kerberos config is mirrored so the two representations cannot conflict.