feat(server): add CredentialValidator trait for server-side auth

[Greg Lamberson (glamberson)]

Closes #1154

Summary

Add a CredentialValidator trait that lets servers validate client
credentials during connection setup, after the acceptor extracts them
from ClientInfoPdu (enabled by #1155).

This follows up on the API discussion in #1150: Option
is the wrong type to carry security policy. The trait makes auth an
explicit, application-supplied component rather than an implicit
builder default.

What it does

• CredentialValidator trait with validate(&self, &Credentials) -> Result
• RdpServer::set_credential_validator() to wire it in
• Validation runs in client_accepted() before session start
• No validator configured = no credential check (existing behavior)
• Validator configured but no credentials received = connection rejected

Design

For TLS-only connections, Client Info credentials are the only
credentials the application layer receives (no CredSSP). This trait
gives server implementations a clean hook to validate them against
PAM, LDAP, databases, or any external system.

Not used for CredSSP/Hybrid connections, where authentication happens
during the NTLM challenge-response exchange before ClientInfoPdu.

Example

struct PamValidator;

impl CredentialValidator for PamValidator {
    fn validate(&self, creds: &Credentials) -> Result<bool> {
        pam_authenticate(&creds.username, &creds.password)
    }
}

server.set_credential_validator(Arc::new(PamValidator));

Test plan

• cargo check -p ironrdp-server
• cargo clippy -p ironrdp-server -- -D warnings
• cargo xtask check fmt/lints/tests/typos/locks (all pass)
• Existing tests pass (trait is additive, no behavior change without opt-in)

[Copilot]

Pull request overview

Adds a server-side hook to validate client-supplied credentials (from ClientInfoPdu) during connection setup, enabling external authentication backends (PAM/LDAP/DB) in ironrdp-server.

Changes:

• Introduces a new public CredentialValidator trait.
• Adds an optional validator to RdpServer with a setter API.
• Invokes credential validation in client_accepted before entering the session loop.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.