- Shipped
- August 25, 2026 at 2:48 PM UTC
- Author
- Kamo
- Commit
- 83222a5
"The requested connection does not exist. Please check the connection name and try again." on a KamoDesktop reconnect was not a missing connection. It was the SSO token's own expiry. `expires` in a guacamole-auth-json token is not the redemption window of the URL, which is how it was being used here (5 minutes). The extension keeps the decoded token as the LIVE backing store for the session's connection directory and re-checks `expires` on every read: **************** hands back an empty SimpleDirectory once System.currentTimeMillis() > expires (confirmed in the 1.5.5 bytecode). The Guacamole session stays authenticated, so the browser is never sent back to a login screen — it just starts getting "Requested tunnel destination does not exist" on every tunnel request, which the client renders as CLIENT.ERROR_TUNNEL_204, the message above. An already-open tunnel survives, so this only ever bit on RECONNECT: a network blip, a laptop sleeping, a tab reload, a guacd restart, or opening a second desktop icon more than five minutes after the first. Reproduced end to end against the live gateway — connections present at t+0, session still authenticated and connection list empty a few seconds past `expires`. The window now covers a working session (8h, KAMO_GUAC_SESSION_TTL_MINUTES), with a 60-minute floor matching Guacamole's own api-session-timeout that is enforced in code, not just documented, so a configmap cannot reintroduce it. Anti-replay for a leaked link comes from the god / dev-machine-provision gate on the minting endpoint and from Guacamole's inactivity timeout — not from a short `expires`. singleUse is not an option: it deletes the connection from the token on first connect, which breaks reconnects outright.