Clarify usage

README.md

@@ -14,26 +14,11 @@ This allows you to connect with the official Microsoft clients to remote desktop
 These desktops could be, for example, [XRDP](http://www.xrdp.org) desktops running in containers
 on Kubernetes.
 
-## AIM
+# AIM
 RDPGW aims to provide a full open source replacement for MS Remote Desktop Gateway, 
 including access policies.
 
-## Security
+# Security requirements
-
-RDPGW wants to be secure when you set it up from the start. It supports several authentication
-mechanisms such as OpenID Connect, Kerberos and PAM. 
-
-Technically, cookies are encrypted and signed on the client side relying
-on [Gorilla Sessions](https://www.gorillatoolkit.org/pkg/sessions). PAA tokens (gateway access tokens)
-are generated and signed according to the JWT spec by using [jwt-go](https://github.com/dgrijalva/jwt-go)
-signed with a 256 bit HMAC. 
-
-### Multi Factor Authentication (MFA)
-RDPGW provides multi-factor authentication out of the box with OpenID Connect integration. Thus
-you can integrate your remote desktops with Keycloak, Okta, Google, Azure, Apple or Facebook
-if you want.
-
-### Security requirements
 
 Several security requirements are stipulated by the client that is connecting to it and some are
 enforced by the gateway. The client requires that the server's TLS certificate is valid and that
@@ -65,6 +50,26 @@ the server. Next to that the client's ip address needs to match the one it obtai
 using OpenID Connect. Due to proxies and NAT this is not always possible and thus can be disabled. However, this
 is a security risk.
 
+# Configuration
+The configuration is done through a YAML file. The configuration file is read from `rdpgw.yaml` by default.
+At the bottom of this README is an example configuration file. In these sections you will find the most important
+settings.
+
+## Authentication
+
+RDPGW wants to be secure when you set it up from the start. It supports several authentication
+mechanisms such as OpenID Connect, Kerberos and PAM. 
+
+Technically, cookies are encrypted and signed on the client side relying
+on [Gorilla Sessions](https://www.gorillatoolkit.org/pkg/sessions). PAA tokens (gateway access tokens)
+are generated and signed according to the JWT spec by using [jwt-go](https://github.com/dgrijalva/jwt-go)
+signed with a 256 bit HMAC. 
+
+### Multi Factor Authentication (MFA)
+RDPGW provides multi-factor authentication out of the box with OpenID Connect integration. Thus
+you can integrate your remote desktops with Keycloak, Okta, Google, Azure, Apple or Facebook
+if you want.
+
 ### Mixing authentication mechanisms
 
 It is technically possible to mix authentication mechanisms. Currently, you can mix local and Kerberos. If you enable 
@@ -172,11 +177,7 @@ Make sure to run both the gateway and `rdpgw-auth`. The gateway will connect to
 
 The client can then connect to the gateway directly by using a remote desktop client.
 
-## Configuration
+## TLS
-
-By default the configuration is read from `rdpgw.yaml`. At the bottom of this README is an example configuration file.
-
-### TLS
 
 The gateway requires a valid TLS certificate. This means a certificate that is signed by a valid CA that is in the store 
 of your clients. If this is not the case particularly Windows clients will fail to connect. You can either provide a 
@@ -199,6 +200,9 @@ KeyFile: key.pem
 __NOTE__: You can disable TLS on the gateway, but you will then need to make sure a proxy is run in front of it that does
 TLS termination. 
 
+
+## Example configuration file for Open ID Connect
+
 ```yaml
 # web server configuration. 
 Server:
@@ -212,7 +216,7 @@ Server:
   - openid
  # The socket to connect to if using local auth. Ensure rdpgw auth is configured to
  # use the same socket.
- AuthSocket: /tmp/rdpgw-auth.sock
+ # AuthSocket: /tmp/rdpgw-auth.sock
  # Basic auth timeout (in seconds). Useful if you're planning on waiting for MFA
  BasicAuthTimeout: 5
  # The default option 'auto' uses a certificate file if provided and found otherwise
@@ -257,12 +261,13 @@ OpenId:
  ProviderUrl: http://keycloak/auth/realms/test
  ClientId: rdpgw
  ClientSecret: your-secret
-Kerberos:
+# Kerberos:
- Keytab: /etc/keytabs/rdpgw.keytab
+#  Keytab: /etc/keytabs/rdpgw.keytab
- Krb5conf: /etc/krb5.conf
+#  Krb5conf: /etc/krb5.conf
 #  enabled / disabled capabilities
 Caps:
  SmartCardAuth: false
+ # required for openid connect
  TokenAuth: true
  # connection timeout in minutes, 0 is limitless
  IdleTimeout: 10
@@ -272,15 +277,14 @@ Caps:
  EnableDrive: true
  EnableClipboard: true
 Client:
+  # template rdp file to use for clients
+  # rdp file settings and their defaults see here: 
+  # https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files
+  defaults: /etc/rdpgw/default.rdp
   # this is a go string templated with {{ username }} and {{ token }}
   # the example below uses the ASCII field separator to distinguish
   # between user and token 
   UsernameTemplate: "{{ username }}@bla.com\x1f{{ token }}"
-  # rdp file settings see: 
-  # https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files
-  NetworkAutoDetect: 0
-  BandwidthAutoDetect: 1
-  ConnectionType: 6
   # If true puts splits "user@domain.com" into the user and domain component so that
   # domain gets set in the rdp file and the domain name is stripped from the username
   SplitUserDomain: false