Boundary Desktop Client

Boundary Desktop Client is a graphical client application for macOS, Windows, and Linux. All Boundary editions can use the same version of the Desktop Client.

With the Desktop Client, you can:

• Sign in to a Boundary cluster using an auth method.
• Search the targets you are authorized to access.
• Start a session and copy the local proxy address and port that Boundary assigns to it.
• View the credentials that Boundary brokers for a session.
• Open an integrated shell to an SSH target, or launch your preferred client for an RDP target.
• Monitor active sessions and end them.
• Pause and resume the Boundary Client Agent that enables transparent sessions.

How does Desktop Client work?

The first time you open the Desktop Client, you enter the URL of the Boundary controller you want to use. The app uses that URL to connect to the Boundary API, then prompts you to authenticate with one of the auth methods that the scope defines.

After you authenticate, the Desktop Client lists the targets for which you have both authorize-session and read permissions, indicating you have access to those targets. When you connect to a target, the controller authorizes a session and starts a local proxy listener for that session. The Desktop Client displays the address and port of the listener so that you can point your own tooling at it, such as an SSH client, a remote desktop client, or a database client. Boundary forwards the traffic from the local listener through a worker (or multiple workers in multi-hop configurations) to the target, so you never need direct network access to the target.

Why use the Desktop Client??

The Desktop Client supports the following goals:

• Simplify connection. You browse and search targets in a list, then select Connect. You do not need to know a target ID or construct a boundary connect command.

• Use the tooling you already have. The Desktop Client exposes each session as a local address and port that you can copy. Any client that can connect to this local port works with Boundary. When a target brokers credentials from a credential store, the Desktop Client shows those credentials with the session details, so that you can copy them for the duration of the session.

• Use the built-in SSH client. For SSH targets, the session detail page includes a Shell tab that opens a terminal inside the Desktop Client. You can work on the target directly and automatically use injected application credentials without opening a separate terminal application.

• Reach targets by aliases. When you run the Boundary Client Agent alongside the Desktop Client, you can connect to a target using its alias, and Boundary establishes the session transparently. If there are brokered credentials for the target, the Desktop Client will notify you so you can access them.

• Keep one view of your sessions. The Sessions screen lists your sessions and their status. You can end any session from the same screen.

Tour of the app

The Desktop Client opens on a sign-in flow, then presents a left navigation bar with three navigation links: Targets, Sessions, and Settings.

Cluster URL and authentication

The Welcome to Boundary screen asks for the cluster URL of your Boundary controller. Your administrator provides this URL.

After you enter the URL, the Desktop Client prompts you to choose an auth method and sign in. Password and LDAP auth methods require a username and password in the app. OIDC auth methods open your browser so that you can complete the sign-in flow with your identity provider, then return you to the app.

If your organization uses more than one scope, you select the scope you want to work in before the Desktop Client lists its targets.

Targets

The Targets screen lists every target in the scope that your roles authorize you to access. Each entry shows the target name, description, type, aliases, any active sessions, and the project scope it belongs to. Use the search field to narrow the list by name.

Select a target to open its detail page, which shows the target's address, type, and any aliases that point to it. You can copy an alias to use it with the Client Agent or the CLI.

To start a session, select Connect. If the target has more than one host, the Desktop Client lists the hosts first so that you can choose which one to connect to.

Sessions

The Sessions screen lists the sessions you started, with a status of Active, Pending, Canceling, or Terminated.

A session's detail page shows the local proxy address and port that Boundary assigned to it. You can copy that value as a plain address and port, as an ssh command, or as an RDP address, depending on the target type. The detail page organizes the rest of the session information into the following tabs:

• Details shows the session metadata, the target and host it connects to, and any credentials that Boundary brokered for it. You can view brokered credentials as formatted fields or as the raw API response.
• Shell opens a terminal inside the app for SSH targets, so that you can work on the target without leaving the Desktop Client.

Select End session to cancel a session before it expires. For RDP targets, select Open to launch the remote desktop client that you set in Settings.

Settings

The Settings screen groups your preferences into the following cards.

Get started

Install the Desktop Client as a standalone application or with the Boundary installer, which also installs the Boundary CLI and the Boundary Client Agent. Refer to Install Boundary clients for instructions.

More information

Refer to the following topics for more information:

• What is Boundary?
• Connect to targets
• Boundary Client Agent