Yes, the RDP story is very painful. To the best of my ability, my goal was to make the post more about the network architecture (esp around the concept of SSH

Yes, the RDP story is very painful. To the best of my ability, my goal was to make the post more about the network architecture (esp around the concept of SSH bastions) and less about the actual OASA product itself. I think there are a number of fungible solutions which would be just as effective (though I think the integration with Okta is a key product feature). What I find interesting and novel is more what we can do to only open ports to authenticated IP addresses, and to address connections between a single source and a single destination. To me, that's where the real power lies.