diff --git a/internal/cmd/commands/proxy/proxy.go b/internal/cmd/commands/proxy/proxy.go
index 2cd02a3ac2..aaf9093349 100644
--- a/internal/cmd/commands/proxy/proxy.go
+++ b/internal/cmd/commands/proxy/proxy.go
@@ -404,6 +404,7 @@ Wait:
 	for {
 		select {
 		case <-c.Context.Done():
+			termInfo.Reason = "Received shutdown signal"
 			timer.Stop()
 			break Wait
 		case <-timer.C:
@@ -412,7 +413,7 @@ Wait:
 		case connsLeft := <-c.connsLeftCh:
 			c.updateConnsLeft(connsLeft)
 			if connsLeft == 0 {
-				termInfo.Reason = "No connections left"
+				termInfo.Reason = "No connections left in session"
 				break Wait
 			}
 		}
diff --git a/internal/gen/controller.swagger.json b/internal/gen/controller.swagger.json
index 1895183ec3..f9958f0328 100644
--- a/internal/gen/controller.swagger.json
+++ b/internal/gen/controller.swagger.json
@@ -3036,16 +3036,20 @@
           "title": "The ID of the user that requested the session"
         },
         "host_set_id": {
-          "type": "string"
+          "type": "string",
+          "title": "The host set id used by the session's target"
         },
         "host_id": {
-          "type": "string"
+          "type": "string",
+          "title": "The host id used by the session"
         },
         "scope_id": {
-          "type": "string"
+          "type": "string",
+          "title": "The scope of the session"
         },
         "endpoint": {
-          "type": "string"
+          "type": "string",
+          "title": "The endpoint of the session"
         },
         "states": {
           "type": "array",
diff --git a/internal/gen/controller/api/resources/sessions/session.pb.go b/internal/gen/controller/api/resources/sessions/session.pb.go
index c38a3f0151..964a3812d5 100644
--- a/internal/gen/controller/api/resources/sessions/session.pb.go
+++ b/internal/gen/controller/api/resources/sessions/session.pb.go
@@ -179,11 +179,15 @@ type Session struct {
 	// The id of the token used to authenticate.
 	AuthTokenId string `protobuf:"bytes,90,opt,name=auth_token_id,proto3" json:"auth_token_id,omitempty"`
 	// The ID of the user that requested the session
-	UserId    string `protobuf:"bytes,100,opt,name=user_id,proto3" json:"user_id,omitempty"`
+	UserId string `protobuf:"bytes,100,opt,name=user_id,proto3" json:"user_id,omitempty"`
+	// The host set id used by the session's target
 	HostSetId string `protobuf:"bytes,110,opt,name=host_set_id,proto3" json:"host_set_id,omitempty"`
-	HostId    string `protobuf:"bytes,120,opt,name=host_id,proto3" json:"host_id,omitempty"`
-	ScopeId   string `protobuf:"bytes,130,opt,name=scope_id,proto3" json:"scope_id,omitempty"`
-	Endpoint  string `protobuf:"bytes,140,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
+	// The host id used by the session
+	HostId string `protobuf:"bytes,120,opt,name=host_id,proto3" json:"host_id,omitempty"`
+	// The scope of the session
+	ScopeId string `protobuf:"bytes,130,opt,name=scope_id,proto3" json:"scope_id,omitempty"`
+	// The endpoint of the session
+	Endpoint string `protobuf:"bytes,140,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
 	// The states of this session in descending from the current state to the
 	// first.
 	States []*SessionState `protobuf:"bytes,150,rep,name=states,proto3" json:"states,omitempty"`
diff --git a/internal/gen/controller/servers/services/session_service.pb.go b/internal/gen/controller/servers/services/session_service.pb.go
index 4d87dc978e..ba28f8bce9 100644
--- a/internal/gen/controller/servers/services/session_service.pb.go
+++ b/internal/gen/controller/servers/services/session_service.pb.go
@@ -269,8 +269,7 @@ type ActivateSessionResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	SessionId string        `protobuf:"bytes,10,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
-	Status    SESSIONSTATUS `protobuf:"varint,20,opt,name=status,proto3,enum=controller.servers.services.v1.SESSIONSTATUS" json:"status,omitempty"`
+	Status SESSIONSTATUS `protobuf:"varint,10,opt,name=status,proto3,enum=controller.servers.services.v1.SESSIONSTATUS" json:"status,omitempty"`
 }
 
 func (x *ActivateSessionResponse) Reset() {
@@ -305,13 +304,6 @@ func (*ActivateSessionResponse) Descriptor() ([]byte, []int) {
 	return file_controller_servers_services_v1_session_service_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *ActivateSessionResponse) GetSessionId() string {
-	if x != nil {
-		return x.SessionId
-	}
-	return ""
-}
-
 func (x *ActivateSessionResponse) GetStatus() SESSIONSTATUS {
 	if x != nil {
 		return x.Status
@@ -429,6 +421,132 @@ func (x *AuthorizeConnectionResponse) GetConnectionsLeft() int32 {
 	return 0
 }
 
+type ConnectSessionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ConnectionId       string `protobuf:"bytes,10,opt,name=connection_id,json=connectionId,proto3" json:"connection_id,omitempty"`
+	ClientTcpAddress   string `protobuf:"bytes,20,opt,name=client_tcp_address,json=clientTcpAddress,proto3" json:"client_tcp_address,omitempty"`
+	ClientTcpPort      uint32 `protobuf:"varint,30,opt,name=client_tcp_port,json=clientTcpPort,proto3" json:"client_tcp_port,omitempty"`
+	EndpointTcpAddress string `protobuf:"bytes,40,opt,name=endpoint_tcp_address,json=endpointTcpAddress,proto3" json:"endpoint_tcp_address,omitempty"`
+	EndpointTcpPort    uint32 `protobuf:"varint,50,opt,name=endpoint_tcp_port,json=endpointTcpPort,proto3" json:"endpoint_tcp_port,omitempty"`
+}
+
+func (x *ConnectSessionRequest) Reset() {
+	*x = ConnectSessionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnectSessionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnectSessionRequest) ProtoMessage() {}
+
+func (x *ConnectSessionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnectSessionRequest.ProtoReflect.Descriptor instead.
+func (*ConnectSessionRequest) Descriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_session_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ConnectSessionRequest) GetConnectionId() string {
+	if x != nil {
+		return x.ConnectionId
+	}
+	return ""
+}
+
+func (x *ConnectSessionRequest) GetClientTcpAddress() string {
+	if x != nil {
+		return x.ClientTcpAddress
+	}
+	return ""
+}
+
+func (x *ConnectSessionRequest) GetClientTcpPort() uint32 {
+	if x != nil {
+		return x.ClientTcpPort
+	}
+	return 0
+}
+
+func (x *ConnectSessionRequest) GetEndpointTcpAddress() string {
+	if x != nil {
+		return x.EndpointTcpAddress
+	}
+	return ""
+}
+
+func (x *ConnectSessionRequest) GetEndpointTcpPort() uint32 {
+	if x != nil {
+		return x.EndpointTcpPort
+	}
+	return 0
+}
+
+type ConnectSessionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Status CONNECTIONSTATUS `protobuf:"varint,10,opt,name=status,proto3,enum=controller.servers.services.v1.CONNECTIONSTATUS" json:"status,omitempty"`
+}
+
+func (x *ConnectSessionResponse) Reset() {
+	*x = ConnectSessionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnectSessionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnectSessionResponse) ProtoMessage() {}
+
+func (x *ConnectSessionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnectSessionResponse.ProtoReflect.Descriptor instead.
+func (*ConnectSessionResponse) Descriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_session_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *ConnectSessionResponse) GetStatus() CONNECTIONSTATUS {
+	if x != nil {
+		return x.Status
+	}
+	return CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED
+}
+
 var File_controller_servers_services_v1_session_service_proto protoreflect.FileDescriptor
 
 var file_controller_servers_services_v1_session_service_proto_rawDesc = []byte{
@@ -492,63 +610,91 @@ var file_controller_servers_services_v1_session_service_proto_rawDesc = []byte{
 	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
 	0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41,
-	0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x7f, 0x0a, 0x17, 0x41,
+	0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x60, 0x0a, 0x17, 0x41,
 	0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x45, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
-	0x14, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x45, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53,
+	0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x3b, 0x0a,
+	0x1a, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0xb7, 0x01, 0x0a, 0x1b, 0x41,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12,
+	0x48, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55,
+	0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x6c, 0x65, 0x66, 0x74, 0x18, 0x1e, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x4c, 0x65, 0x66, 0x74, 0x22, 0xf0, 0x01, 0x0a, 0x15, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x23,
+	0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x49, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x63,
+	0x70, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x10, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x54, 0x63, 0x70, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73,
+	0x73, 0x12, 0x26, 0x0a, 0x0f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x63, 0x70, 0x5f,
+	0x70, 0x6f, 0x72, 0x74, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0d, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x54, 0x63, 0x70, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x30, 0x0a, 0x14, 0x65, 0x6e, 0x64,
+	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x74, 0x63, 0x70, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
+	0x73, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x54, 0x63, 0x70, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x65,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x74, 0x63, 0x70, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x32, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x54, 0x63, 0x70, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x62, 0x0a, 0x16, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x48, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41,
+	0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x32, 0xae, 0x04, 0x0a, 0x0e,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x7e,
+	0x0a, 0x0d, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x34, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
+	0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
 	0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54,
-	0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x3b, 0x0a, 0x1a,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0xb7, 0x01, 0x0a, 0x1b, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6f, 0x6e,
-	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x48,
-	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x30,
-	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e,
-	0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
-	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x6c, 0x65, 0x66, 0x74, 0x18, 0x1e, 0x20, 0x01,
-	0x28, 0x05, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x4c,
-	0x65, 0x66, 0x74, 0x32, 0xaa, 0x03, 0x0a, 0x0e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x7e, 0x0a, 0x0d, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
-	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x35, 0x2e,
-	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
-	0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x84, 0x01, 0x0a, 0x0f, 0x41, 0x63, 0x74, 0x69, 0x76,
-	0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x2e, 0x63, 0x6f, 0x6e,
+	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x84,
+	0x01, 0x0a, 0x0f, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x37, 0x2e, 0x63, 0x6f, 0x6e,
 	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e,
 	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69,
-	0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x37, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
+	0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x90, 0x01, 0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3a, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3b, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x81, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x35, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
 	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x90, 0x01,
-	0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65,
-	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x3b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
-	0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x42, 0x51, 0x5a, 0x4f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72,
-	0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x51, 0x5a, 0x4f,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2f, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -563,7 +709,7 @@ func file_controller_servers_services_v1_session_service_proto_rawDescGZIP() []b
 	return file_controller_servers_services_v1_session_service_proto_rawDescData
 }
 
-var file_controller_servers_services_v1_session_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_controller_servers_services_v1_session_service_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_controller_servers_services_v1_session_service_proto_goTypes = []interface{}{
 	(*LookupSessionRequest)(nil),             // 0: controller.servers.services.v1.LookupSessionRequest
 	(*LookupSessionResponse)(nil),            // 1: controller.servers.services.v1.LookupSessionResponse
@@ -571,29 +717,34 @@ var file_controller_servers_services_v1_session_service_proto_goTypes = []interf
 	(*ActivateSessionResponse)(nil),          // 3: controller.servers.services.v1.ActivateSessionResponse
 	(*AuthorizeConnectionRequest)(nil),       // 4: controller.servers.services.v1.AuthorizeConnectionRequest
 	(*AuthorizeConnectionResponse)(nil),      // 5: controller.servers.services.v1.AuthorizeConnectionResponse
-	(*targets.SessionAuthorizationData)(nil), // 6: controller.api.resources.targets.v1.SessionAuthorizationData
-	(*timestamp.Timestamp)(nil),              // 7: google.protobuf.Timestamp
-	(SESSIONSTATUS)(0),                       // 8: controller.servers.services.v1.SESSIONSTATUS
-	(CONNECTIONSTATUS)(0),                    // 9: controller.servers.services.v1.CONNECTIONSTATUS
+	(*ConnectSessionRequest)(nil),            // 6: controller.servers.services.v1.ConnectSessionRequest
+	(*ConnectSessionResponse)(nil),           // 7: controller.servers.services.v1.ConnectSessionResponse
+	(*targets.SessionAuthorizationData)(nil), // 8: controller.api.resources.targets.v1.SessionAuthorizationData
+	(*timestamp.Timestamp)(nil),              // 9: google.protobuf.Timestamp
+	(SESSIONSTATUS)(0),                       // 10: controller.servers.services.v1.SESSIONSTATUS
+	(CONNECTIONSTATUS)(0),                    // 11: controller.servers.services.v1.CONNECTIONSTATUS
 }
 var file_controller_servers_services_v1_session_service_proto_depIdxs = []int32{
-	6, // 0: controller.servers.services.v1.LookupSessionResponse.authorization:type_name -> controller.api.resources.targets.v1.SessionAuthorizationData
-	7, // 1: controller.servers.services.v1.LookupSessionResponse.expiration:type_name -> google.protobuf.Timestamp
-	8, // 2: controller.servers.services.v1.LookupSessionResponse.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
-	8, // 3: controller.servers.services.v1.ActivateSessionRequest.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
-	8, // 4: controller.servers.services.v1.ActivateSessionResponse.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
-	9, // 5: controller.servers.services.v1.AuthorizeConnectionResponse.status:type_name -> controller.servers.services.v1.CONNECTIONSTATUS
-	0, // 6: controller.servers.services.v1.SessionService.LookupSession:input_type -> controller.servers.services.v1.LookupSessionRequest
-	2, // 7: controller.servers.services.v1.SessionService.ActivateSession:input_type -> controller.servers.services.v1.ActivateSessionRequest
-	4, // 8: controller.servers.services.v1.SessionService.AuthorizeConnection:input_type -> controller.servers.services.v1.AuthorizeConnectionRequest
-	1, // 9: controller.servers.services.v1.SessionService.LookupSession:output_type -> controller.servers.services.v1.LookupSessionResponse
-	3, // 10: controller.servers.services.v1.SessionService.ActivateSession:output_type -> controller.servers.services.v1.ActivateSessionResponse
-	5, // 11: controller.servers.services.v1.SessionService.AuthorizeConnection:output_type -> controller.servers.services.v1.AuthorizeConnectionResponse
-	9, // [9:12] is the sub-list for method output_type
-	6, // [6:9] is the sub-list for method input_type
-	6, // [6:6] is the sub-list for extension type_name
-	6, // [6:6] is the sub-list for extension extendee
-	0, // [0:6] is the sub-list for field type_name
+	8,  // 0: controller.servers.services.v1.LookupSessionResponse.authorization:type_name -> controller.api.resources.targets.v1.SessionAuthorizationData
+	9,  // 1: controller.servers.services.v1.LookupSessionResponse.expiration:type_name -> google.protobuf.Timestamp
+	10, // 2: controller.servers.services.v1.LookupSessionResponse.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
+	10, // 3: controller.servers.services.v1.ActivateSessionRequest.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
+	10, // 4: controller.servers.services.v1.ActivateSessionResponse.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
+	11, // 5: controller.servers.services.v1.AuthorizeConnectionResponse.status:type_name -> controller.servers.services.v1.CONNECTIONSTATUS
+	11, // 6: controller.servers.services.v1.ConnectSessionResponse.status:type_name -> controller.servers.services.v1.CONNECTIONSTATUS
+	0,  // 7: controller.servers.services.v1.SessionService.LookupSession:input_type -> controller.servers.services.v1.LookupSessionRequest
+	2,  // 8: controller.servers.services.v1.SessionService.ActivateSession:input_type -> controller.servers.services.v1.ActivateSessionRequest
+	4,  // 9: controller.servers.services.v1.SessionService.AuthorizeConnection:input_type -> controller.servers.services.v1.AuthorizeConnectionRequest
+	6,  // 10: controller.servers.services.v1.SessionService.ConnectSession:input_type -> controller.servers.services.v1.ConnectSessionRequest
+	1,  // 11: controller.servers.services.v1.SessionService.LookupSession:output_type -> controller.servers.services.v1.LookupSessionResponse
+	3,  // 12: controller.servers.services.v1.SessionService.ActivateSession:output_type -> controller.servers.services.v1.ActivateSessionResponse
+	5,  // 13: controller.servers.services.v1.SessionService.AuthorizeConnection:output_type -> controller.servers.services.v1.AuthorizeConnectionResponse
+	7,  // 14: controller.servers.services.v1.SessionService.ConnectSession:output_type -> controller.servers.services.v1.ConnectSessionResponse
+	11, // [11:15] is the sub-list for method output_type
+	7,  // [7:11] is the sub-list for method input_type
+	7,  // [7:7] is the sub-list for extension type_name
+	7,  // [7:7] is the sub-list for extension extendee
+	0,  // [0:7] is the sub-list for field type_name
 }
 
 func init() { file_controller_servers_services_v1_session_service_proto_init() }
@@ -675,6 +826,30 @@ func file_controller_servers_services_v1_session_service_proto_init() {
 				return nil
 			}
 		}
+		file_controller_servers_services_v1_session_service_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnectSessionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_servers_services_v1_session_service_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnectSessionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -682,7 +857,7 @@ func file_controller_servers_services_v1_session_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_servers_services_v1_session_service_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -715,6 +890,8 @@ type SessionServiceClient interface {
 	ActivateSession(ctx context.Context, in *ActivateSessionRequest, opts ...grpc.CallOption) (*ActivateSessionResponse, error)
 	// AuthorizeConnection allows a worker to activate a session on a controller.
 	AuthorizeConnection(ctx context.Context, in *AuthorizeConnectionRequest, opts ...grpc.CallOption) (*AuthorizeConnectionResponse, error)
+	// ConnectSession updates a connection and causes a state transition
+	ConnectSession(ctx context.Context, in *ConnectSessionRequest, opts ...grpc.CallOption) (*ConnectSessionResponse, error)
 }
 
 type sessionServiceClient struct {
@@ -752,6 +929,15 @@ func (c *sessionServiceClient) AuthorizeConnection(ctx context.Context, in *Auth
 	return out, nil
 }
 
+func (c *sessionServiceClient) ConnectSession(ctx context.Context, in *ConnectSessionRequest, opts ...grpc.CallOption) (*ConnectSessionResponse, error) {
+	out := new(ConnectSessionResponse)
+	err := c.cc.Invoke(ctx, "/controller.servers.services.v1.SessionService/ConnectSession", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // SessionServiceServer is the server API for SessionService service.
 type SessionServiceServer interface {
 	// GetSession allows a worker to retrieve session information from the
@@ -761,6 +947,8 @@ type SessionServiceServer interface {
 	ActivateSession(context.Context, *ActivateSessionRequest) (*ActivateSessionResponse, error)
 	// AuthorizeConnection allows a worker to activate a session on a controller.
 	AuthorizeConnection(context.Context, *AuthorizeConnectionRequest) (*AuthorizeConnectionResponse, error)
+	// ConnectSession updates a connection and causes a state transition
+	ConnectSession(context.Context, *ConnectSessionRequest) (*ConnectSessionResponse, error)
 }
 
 // UnimplementedSessionServiceServer can be embedded to have forward compatible implementations.
@@ -776,6 +964,9 @@ func (*UnimplementedSessionServiceServer) ActivateSession(context.Context, *Acti
 func (*UnimplementedSessionServiceServer) AuthorizeConnection(context.Context, *AuthorizeConnectionRequest) (*AuthorizeConnectionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method AuthorizeConnection not implemented")
 }
+func (*UnimplementedSessionServiceServer) ConnectSession(context.Context, *ConnectSessionRequest) (*ConnectSessionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ConnectSession not implemented")
+}
 
 func RegisterSessionServiceServer(s *grpc.Server, srv SessionServiceServer) {
 	s.RegisterService(&_SessionService_serviceDesc, srv)
@@ -835,6 +1026,24 @@ func _SessionService_AuthorizeConnection_Handler(srv interface{}, ctx context.Co
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SessionService_ConnectSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ConnectSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SessionServiceServer).ConnectSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.servers.services.v1.SessionService/ConnectSession",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SessionServiceServer).ConnectSession(ctx, req.(*ConnectSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _SessionService_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "controller.servers.services.v1.SessionService",
 	HandlerType: (*SessionServiceServer)(nil),
@@ -851,6 +1060,10 @@ var _SessionService_serviceDesc = grpc.ServiceDesc{
 			MethodName: "AuthorizeConnection",
 			Handler:    _SessionService_AuthorizeConnection_Handler,
 		},
+		{
+			MethodName: "ConnectSession",
+			Handler:    _SessionService_ConnectSession_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "controller/servers/services/v1/session_service.proto",
diff --git a/internal/proto/local/controller/servers/services/v1/session_service.proto b/internal/proto/local/controller/servers/services/v1/session_service.proto
index 689fb18ca3..4b8cdfa4c8 100644
--- a/internal/proto/local/controller/servers/services/v1/session_service.proto
+++ b/internal/proto/local/controller/servers/services/v1/session_service.proto
@@ -19,6 +19,9 @@ service SessionService {
 
 	// AuthorizeConnection allows a worker to activate a session on a controller.
 	rpc AuthorizeConnection(AuthorizeConnectionRequest) returns (AuthorizeConnectionResponse) {}
+
+	// ConnectSession updates a connection and causes a state transition
+	rpc ConnectSession(ConnectSessionRequest) returns (ConnectSessionResponse) {}
 }
 
 message LookupSessionRequest {
@@ -47,17 +50,28 @@ message ActivateSessionRequest {
 	controller.servers.services.v1.SESSIONSTATUS status = 50;
 }
 
-message ActivateSessionResponse{
-	string session_id = 10;
-	controller.servers.services.v1.SESSIONSTATUS status = 20;
+message ActivateSessionResponse {
+	controller.servers.services.v1.SESSIONSTATUS status = 10;
 }
 
-message AuthorizeConnectionRequest{
+message AuthorizeConnectionRequest {
 	string session_id = 10;
 }
 
-message AuthorizeConnectionResponse{
+message AuthorizeConnectionResponse {
 	string connection_id = 10;
 	controller.servers.services.v1.CONNECTIONSTATUS status = 20;
 	int32 connections_left = 30;
+}
+
+message ConnectSessionRequest {
+	string connection_id = 10;
+	string client_tcp_address = 20;
+	uint32 client_tcp_port = 30;
+	string endpoint_tcp_address = 40;
+	uint32 endpoint_tcp_port = 50;
+}
+
+message ConnectSessionResponse {
+	controller.servers.services.v1.CONNECTIONSTATUS status = 10;
 }
\ No newline at end of file
diff --git a/internal/servers/controller/handlers/workers/worker_service.go b/internal/servers/controller/handlers/workers/worker_service.go
index e9f12db79d..76b99f75cc 100644
--- a/internal/servers/controller/handlers/workers/worker_service.go
+++ b/internal/servers/controller/handlers/workers/worker_service.go
@@ -198,8 +198,7 @@ func (ws *workerServiceServer) ActivateSession(ctx context.Context, req *pbs.Act
 	}
 
 	return &pbs.ActivateSessionResponse{
-		SessionId: sessionInfo.GetPublicId(),
-		Status:    sessionStates[0].Status.ProtoVal(),
+		Status: sessionStates[0].Status.ProtoVal(),
 	}, nil
 }
 
@@ -231,5 +230,36 @@ func (ws *workerServiceServer) AuthorizeConnection(ctx context.Context, req *pbs
 		ret.ConnectionsLeft -= int32(authzSummary.CurrentConnectionCount)
 	}
 
+	ws.logger.Trace("authorized connection", "session_id", req.GetSessionId(), "connection_id", ret.ConnectionId)
+
+	return ret, nil
+}
+
+func (ws *workerServiceServer) ConnectSession(ctx context.Context, req *pbs.ConnectSessionRequest) (*pbs.ConnectSessionResponse, error) {
+	ws.logger.Trace("got connection established information from worker", "connection_id", req.GetConnectionId())
+
+	sessRepo, err := ws.sessionRepoFn()
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "error getting session repo: %v", err)
+	}
+
+	connectionInfo, connStates, err := sessRepo.ConnectSession(ctx, session.ConnectWith{
+		ConnectionId:       req.GetConnectionId(),
+		ClientTcpAddress:   req.GetClientTcpAddress(),
+		ClientTcpPort:      req.GetClientTcpPort(),
+		EndpointTcpAddress: req.GetEndpointTcpAddress(),
+		EndpointTcpPort:    req.GetEndpointTcpPort(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	if connectionInfo == nil {
+		return nil, status.Error(codes.Internal, "Invalid authorize connection response.")
+	}
+
+	ret := &pbs.ConnectSessionResponse{
+		Status: connStates[0].Status.ProtoVal(),
+	}
+
 	return ret, nil
 }
diff --git a/internal/servers/worker/handler.go b/internal/servers/worker/handler.go
index 865adbb18e..2a59ab8cfa 100644
--- a/internal/servers/worker/handler.go
+++ b/internal/servers/worker/handler.go
@@ -2,7 +2,9 @@ package worker
 
 import (
 	"context"
+	"net"
 	"net/http"
+	"strconv"
 
 	"github.com/hashicorp/boundary/globals"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
@@ -38,6 +40,23 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 		}
 		sessionId := r.TLS.ServerName
 
+		clientIp, clientPort, err := net.SplitHostPort(r.RemoteAddr)
+		if err != nil {
+			w.logger.Error("unable to understand remote address", "error", err)
+			wr.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		numPort, err := strconv.Atoi(clientPort)
+		if err != nil {
+			w.logger.Error("unable to understand remote port", "error", err)
+			wr.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		clientAddr := &net.TCPAddr{
+			IP:   net.ParseIP(clientIp),
+			Port: numPort,
+		}
+
 		w.logger.Trace("received TLS connection")
 
 		siRaw, valid := w.sessionInfoMap.Load(sessionId)
@@ -141,7 +160,7 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 
 		switch conn.Subprotocol() {
 		case globals.TcpProxyV1:
-			w.handleTcpProxyV1(connCtx, conn, sessionId, endpoint)
+			w.handleTcpProxyV1(connCtx, clientAddr, conn, si, ci.id, endpoint)
 		default:
 			conn.Close(websocket.StatusProtocolError, "unsupported-protocol")
 			return
diff --git a/internal/servers/worker/session.go b/internal/servers/worker/session.go
index c1f6836809..b0881d9dbf 100644
--- a/internal/servers/worker/session.go
+++ b/internal/servers/worker/session.go
@@ -173,3 +173,28 @@ func (w *Worker) authorizeConnection(ctx context.Context, sessionId string) (*co
 		status: resp.GetStatus(),
 	}, resp.GetConnectionsLeft(), nil
 }
+
+func (w *Worker) connectSession(ctx context.Context, req *pbs.ConnectSessionRequest) (pbs.CONNECTIONSTATUS, error) {
+	rawConn := w.controllerSessionConn.Load()
+	if rawConn == nil {
+		return pbs.CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED, errors.New("could not get a controller client")
+	}
+	conn, ok := rawConn.(pbs.SessionServiceClient)
+	if !ok {
+		return pbs.CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED, errors.New("could not cast atomic controller client to the real thing")
+	}
+	if conn == nil {
+		return pbs.CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED, errors.New("controller client is nil")
+	}
+
+	resp, err := conn.ConnectSession(ctx, req)
+	if err != nil {
+		return pbs.CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED, err
+	}
+
+	if resp.GetStatus() != pbs.CONNECTIONSTATUS_CONNECTIONSTATUS_CONNECTED {
+		return pbs.CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED, fmt.Errorf("unexpected state returned: %v", resp.GetStatus().String())
+	}
+
+	return resp.GetStatus(), nil
+}
diff --git a/internal/servers/worker/tcp_proxy.go b/internal/servers/worker/tcp_proxy.go
index ff4923e063..de02461daa 100644
--- a/internal/servers/worker/tcp_proxy.go
+++ b/internal/servers/worker/tcp_proxy.go
@@ -8,9 +8,15 @@ import (
 	"sync"
 
 	"nhooyr.io/websocket"
+
+	pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 )
 
-func (w *Worker) handleTcpProxyV1(connCtx context.Context, conn *websocket.Conn, sessionId, endpoint string) {
+func (w *Worker) handleTcpProxyV1(connCtx context.Context, clientAddr *net.TCPAddr, conn *websocket.Conn, si *sessionInfo, connectionId, endpoint string) {
+	si.RLock()
+	sessionId := si.lookupSessionResponse.GetAuthorization().GetSessionId()
+	si.RUnlock()
+
 	sessionUrl, err := url.Parse(endpoint)
 	if err != nil {
 		w.logger.Error("error parsing endpoint information", "error", err, "session_id", sessionId, "endpoint", endpoint)
@@ -25,12 +31,31 @@ func (w *Worker) handleTcpProxyV1(connCtx context.Context, conn *websocket.Conn,
 	remoteConn, err := net.Dial("tcp", sessionUrl.Host)
 	if err != nil {
 		w.logger.Error("error dialing endpoint", "error", err, "endpoint", endpoint)
-		conn.Close(websocket.StatusInternalError, "endpoint-dialing")
+		conn.Close(websocket.StatusInternalError, "endpoint dialing failed")
 		return
 	}
 	// Assert this for better Go 1.11 splice support
 	tcpRemoteConn := remoteConn.(*net.TCPConn)
 
+	endpointAddr := tcpRemoteConn.RemoteAddr().(*net.TCPAddr)
+	connectionInfo := &pbs.ConnectSessionRequest{
+		ConnectionId:       connectionId,
+		ClientTcpAddress:   clientAddr.IP.String(),
+		ClientTcpPort:      uint32(clientAddr.Port),
+		EndpointTcpAddress: endpointAddr.IP.String(),
+		EndpointTcpPort:    uint32(endpointAddr.Port),
+	}
+
+	connStatus, err := w.connectSession(connCtx, connectionInfo)
+	if err != nil {
+		w.logger.Error("error marking connection as connected", "error", err)
+		conn.Close(websocket.StatusInternalError, "failed to mark connection as connected")
+		return
+	}
+	si.Lock()
+	si.connInfoMap[connectionId].status = connStatus
+	si.Unlock()
+
 	// Get a wrapped net.Conn so we can use io.Copy
 	netConn := websocket.NetConn(connCtx, conn, websocket.MessageBinary)
 
@@ -47,4 +72,5 @@ func (w *Worker) handleTcpProxyV1(connCtx context.Context, conn *websocket.Conn,
 		w.logger.Debug("copy from endpoint to client done", "error", err)
 	}()
 	connWg.Wait()
+
 }
diff --git a/internal/session/repository_session_test.go b/internal/session/repository_session_test.go
index 030a5cec54..0df75c481c 100644
--- a/internal/session/repository_session_test.go
+++ b/internal/session/repository_session_test.go
@@ -269,7 +269,7 @@ func TestRepository_CreateSession(t *testing.T) {
 			assert.NotNil(ses.CreateTime)
 			assert.NotNil(ses.States[0].StartTime)
 			assert.Equal(ses.States[0].Status, StatusPending)
-			foundSession, err := repo.LookupSession(context.Background(), ses.PublicId)
+			foundSession, _, err := repo.LookupSession(context.Background(), ses.PublicId)
 			assert.NoError(err)
 
 			// Account for slight offsets in nanos
@@ -1076,7 +1076,7 @@ func TestRepository_DeleteSession(t *testing.T) {
 			}
 			assert.NoError(err)
 			assert.Equal(tt.wantRowsDeleted, deletedRows)
-			foundSession, err := repo.LookupSession(context.Background(), tt.args.session.PublicId)
+			foundSession, _, err := repo.LookupSession(context.Background(), tt.args.session.PublicId)
 			assert.NoError(err)
 			assert.Nil(foundSession)
 
diff --git a/scripts/build.sh b/scripts/build.sh
index 851df88415..7e3713d8f4 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -66,8 +66,8 @@ IFS=$OLDIFS
 # Copy our OS/Arch to the bin/ directory
 DEV_PLATFORM=${DEV_PLATFORM:-"./pkg/$(go env GOOS)_$(go env GOARCH)"}
 for F in $(find ${DEV_PLATFORM} -mindepth 1 -maxdepth 1 -type f); do
-    cp ${F} bin/
-    cp ${F} ${MAIN_GOPATH}/bin/
+    cp -f ${F} bin/
+    cp -f ${F} ${MAIN_GOPATH}/bin/
 done
 
 if [ "${BOUNDARY_DEV_BUILD}x" = "x" ]; then