fix: enrich empty rdp.login.success user from RDG 302 (0.5.15)

RCM 1149 often leaves Param1/Param2 empty through RD Gateway; backfill details.user from matching RDG success within 5 minutes, and still close empty-user sessions on RDG end.
2026-07-14 10:45:56 +10:00
parent d95b93992d
commit 52125a5a98
7 changed files with 252 additions and 6 deletions
@@ -266,3 +266,113 @@ def test_ip_mismatch_does_not_close_login(db_session, rdg_settings, rdg_hosts):

    assert close_workstation_session_for_rdg_end(db_session, end) is None
    assert event_session_terminated(login, db=db_session) is False
+
+
+def test_empty_rcm1149_user_enriched_from_prior_rdg302(db_session, rdg_settings, rdg_hosts):
+    """COMM-PC class: EventLog 1149 has empty Param1; RDG 302 already has the account."""
+    ws, _gw = rdg_hosts
+    t0 = datetime.now(timezone.utc)
+    user = r"B26\s.shelkovaya"
+    internal_ip = ws.ipv4
+
+    _ingest(
+        db_session,
+        t0,
+        host={"hostname": "K6A-DC3", "os_family": "windows"},
+        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
+        type="rdg.connection.success",
+        category="auth",
+        severity="warning",
+        title="RDG 302",
+        summary="302",
+        details={"user": user, "internal_ip": internal_ip},
+    )
+    login = _ingest(
+        db_session,
+        t0 + timedelta(seconds=3),
+        host={"hostname": ws.hostname, "os_family": "windows", "ipv4": internal_ip},
+        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
+        type="rdp.login.success",
+        category="auth",
+        severity="warning",
+        title="RDP connection (RCM 1149)",
+        summary="RCM 1149 - 192.168.160.40",
+        details={"user": "-", "ip_address": "192.168.160.40", "event_id_windows": 1149},
+    )
+    db_session.refresh(login)
+
+    assert login.details["user"] == user
+    assert login.details.get("user_enriched_from_rdg_event_id")
+    summary = event_to_summary(login, db_session)
+    assert summary.actor_user == user
+
+
+def test_empty_rcm1149_backfilled_when_rdg302_arrives_later(db_session, rdg_settings, rdg_hosts):
+    ws, _gw = rdg_hosts
+    t0 = datetime.now(timezone.utc)
+    user = r"B26\s.shelkovaya"
+    internal_ip = ws.ipv4
+
+    login = _ingest(
+        db_session,
+        t0 + timedelta(seconds=1),
+        host={"hostname": ws.hostname, "os_family": "windows", "ipv4": internal_ip},
+        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
+        type="rdp.login.success",
+        category="auth",
+        severity="info",
+        title="RDP connection (RCM 1149)",
+        summary="RCM 1149 - 1.2.3.4",
+        details={"user": "-", "event_id_windows": 1149},
+    )
+    assert login.details["user"] == "-"
+
+    _ingest(
+        db_session,
+        t0,
+        host={"hostname": "K6A-DC3", "os_family": "windows"},
+        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
+        type="rdg.connection.success",
+        category="auth",
+        severity="info",
+        title="RDG 302",
+        summary="302",
+        details={"user": user, "internal_ip": internal_ip},
+    )
+    db_session.refresh(login)
+    assert login.details["user"] == user
+
+
+def test_empty_user_login_still_closed_by_rdg303(db_session, rdg_settings, rdg_hosts):
+    ws, _gw = rdg_hosts
+    t0 = datetime.now(timezone.utc)
+    user = r"B26\s.shelkovaya"
+    internal_ip = ws.ipv4
+
+    login = _ingest(
+        db_session,
+        t0,
+        host={"hostname": ws.hostname, "os_family": "windows", "ipv4": internal_ip},
+        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
+        type="rdp.login.success",
+        category="auth",
+        severity="info",
+        title="RDP connection (RCM 1149)",
+        summary="RCM 1149",
+        details={"user": "-", "event_id_windows": 1149},
+    )
+    end = _ingest(
+        db_session,
+        t0 + timedelta(minutes=5),
+        host={"hostname": "K6A-DC3", "os_family": "windows"},
+        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
+        type="rdg.connection.disconnected",
+        category="auth",
+        severity="info",
+        title="303",
+        summary="303",
+        details={"user": user, "internal_ip": internal_ip},
+    )
+    db_session.refresh(login)
+    assert login.details.get(SESSION_CLOSED_BY_RDG_AT_KEY) == end.occurred_at.isoformat()
+    assert event_session_terminated(login, db=db_session) is True