You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@guacamole.apache.org by "necouchman (via GitHub)" <gi...@apache.org> on 2025/04/27 01:41:22 UTC
[PR] GUACAMOLE-2057: Add configuration parameters for supporting Kerberos authentication for RDP. [guacamole-server]
necouchman opened a new pull request, #581:
URL: https://github.com/apache/guacamole-server/pull/581
Adds the required parameters to configure the FreeRDP library to force Kerberos and configure a couple of the parameters related to that, if required. I have tested the changes against both servers with NTLM still enabled and against one where NTLM is disabled, and it seems to work, but others should feel free to test.
I do need one bit of help with this - I have not added the detection of the Kerberos support to the `configure.ac` file, yet, as I'm struggling to figure out how to do that. In my mind, it needs 2-3 checks:
* Check if FreeRDP contains support for the `FreeRDP_AuthenticationPackageList` setting. This is probably the biggest thing I'm struggling with, as this setting is part of an `enum` in one of the FreeRDP header files, but I'm having trouble finding any guidance on how to generate an autoconf check for an enum member? Any hints on the best way to do that would be appreciated.
* Check if FreeRDP is built with Kerberos support. There's a flag in the FreeRDP `buildconfig.h` file, within the constant `FREERDP_BUILD_CONFIG` that shows `WITH_KRB5=ON`, but, again, I'm struggling with how to get autoconf to check for this, or identify a sane method or member to use with one of the other autoconf checks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GUACAMOLE-2057: Add configuration parameters for supporting Kerberos authentication for RDP. [guacamole-server]
Posted by "mike-jumper (via GitHub)" <gi...@apache.org>.
mike-jumper commented on code in PR #581:
URL: https://github.com/apache/guacamole-server/pull/581#discussion_r3005620714
##########
src/protocols/rdp/settings.c:
##########
@@ -296,6 +299,28 @@ enum RDP_ARGS_IDX {
*/
IDX_SECURITY,
+ /**
+ * The authentication package to use based on the underlying FreeRDP support
+ * for alternatives to NTML. Currently FreeRDP2 only supports NTLM, while
+ * FreeRDP3 introduces support for Kerberos and continues to support NTLM.
+ * The default is to negotiate between guacd and the remote server.
+ */
+ IDX_AUTH_PKG,
Review Comment:
Should this be part of the `security` parameter, rather than separate?
##########
src/protocols/rdp/settings.c:
##########
@@ -296,6 +299,28 @@ enum RDP_ARGS_IDX {
*/
IDX_SECURITY,
+ /**
+ * The authentication package to use based on the underlying FreeRDP support
+ * for alternatives to NTML. Currently FreeRDP2 only supports NTLM, while
+ * FreeRDP3 introduces support for Kerberos and continues to support NTLM.
+ * The default is to negotiate between guacd and the remote server.
+ */
+ IDX_AUTH_PKG,
+
+ /**
+ * When kerberos authentication is in use, the URL of the KDC server to use
+ * for ticket validation. If not specified, guacd will use the underlying
+ * system's kerberos configuration.
+ */
+ IDX_KDC_URL,
+
+ /**
+ * When kerberos authentication is in use, the path to the kerberos ticket
+ * cache, relative to GUACAMOLE_HOME. If not specified, the default system
+ * cache of the underlying system on which guacd is running will be used.
Review Comment:
It doesn't look to me like the path is evaluated relative to `GUACAMOLE_HOME`, but passed to FreeRDP unaltered (and then interpreted as FreeRDP relative to somewhere?).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GUACAMOLE-2057: Add configuration parameters for supporting Kerberos authentication for RDP. [guacamole-server]
Posted by "jbostoen (via GitHub)" <gi...@apache.org>.
jbostoen commented on code in PR #581:
URL: https://github.com/apache/guacamole-server/pull/581#discussion_r2082543290
##########
src/protocols/rdp/settings.c:
##########
@@ -296,6 +299,28 @@ enum RDP_ARGS_IDX {
*/
IDX_SECURITY,
+ /**
+ * The authentication package to use based on the underlying FreeRDP support
+ * for alternatives to NTML. Currently FreeRDP2 only supports NTLM, while
Review Comment:
Just a typo (NTML > NTLM)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GUACAMOLE-2057: Add configuration parameters for supporting Kerberos authentication for RDP. [guacamole-server]
Posted by "mike-jumper (via GitHub)" <gi...@apache.org>.
mike-jumper commented on code in PR #581:
URL: https://github.com/apache/guacamole-server/pull/581#discussion_r3005618656
##########
src/protocols/rdp/settings.c:
##########
@@ -296,6 +299,28 @@ enum RDP_ARGS_IDX {
*/
IDX_SECURITY,
+ /**
+ * The authentication package to use based on the underlying FreeRDP support
+ * for alternatives to NTML. Currently FreeRDP2 only supports NTLM, while
+ * FreeRDP3 introduces support for Kerberos and continues to support NTLM.
+ * The default is to negotiate between guacd and the remote server.
+ */
+ IDX_AUTH_PKG,
+
+ /**
+ * When kerberos authentication is in use, the URL of the KDC server to use
+ * for ticket validation. If not specified, guacd will use the underlying
+ * system's kerberos configuration.
+ */
+ IDX_KDC_URL,
+
+ /**
+ * When kerberos authentication is in use, the path to the kerberos ticket
+ * cache, relative to GUACAMOLE_HOME. If not specified, the default system
+ * cache of the underlying system on which guacd is running will be used.
Review Comment:
It doesn't look to me like the path is evaluated relative to `GUACAMOLE_HOME`, but passed to FreeRDP unaltered (and then interpreted by FreeRDP relative to somewhere?).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GUACAMOLE-2057: Add configuration parameters for supporting Kerberos authentication for RDP. [guacamole-server]
Posted by "corentin-soriano (via GitHub)" <gi...@apache.org>.
corentin-soriano commented on PR #581:
URL: https://github.com/apache/guacamole-server/pull/581#issuecomment-4690136856
> * Check if FreeRDP contains support for the `FreeRDP_AuthenticationPackageList` setting. This is probably the biggest thing I'm struggling with, as this setting is part of an `enum` in one of the FreeRDP header files, but I'm having trouble finding any guidance on how to generate an autoconf check for an enum member? Any hints on the best way to do that would be appreciated.
This test seems to work:
```
if test "x${have_freerdp}" = "xyes"
then
AC_CHECK_DECL([FreeRDP_AuthenticationPackageList],
[AC_DEFINE([HAVE_FREERDP_AUTHENTICATION_PACKAGE_LIST],,
[Defined if FreeRDP_AuthenticationPackageList is available])],,
[#include <freerdp/settings.h>])
fi
```
However, `FreeRDP_AuthenticationPackageList` seems to have been added for version 3.0.0 so I'm not sure if it's necessary to check it.
What needs to be removed are these assignments when not `HAVE_SETTERS_GETTERS` (freerdp 2.x):
```
rdp_settings->AuthenticationPackageList
rdp_settings->KerberosKdcUrl
rdp_settings->KerberosCache
```
```
settings.c: In function ‘guac_rdp_push_settings’:
settings.c:2019:25: error: ‘rdpSettings’ {aka ‘struct rdp_settings’} has no member named ‘AuthenticationPackageList’
2019 | rdp_settings->AuthenticationPackageList = "ntlm,!kerberos";
| ^~
settings.c:2023:25: error: ‘rdpSettings’ {aka ‘struct rdp_settings’} has no member named ‘AuthenticationPackageList’
2023 | rdp_settings->AuthenticationPackageList = "!ntlm,kerberos";
| ^~
settings.c:2027:25: error: ‘rdpSettings’ {aka ‘struct rdp_settings’} has no member named ‘AuthenticationPackageList’
2027 | rdp_settings->AuthenticationPackageList = "ntlm,kerberos";
| ^~
settings.c:2033:19: error: ‘rdpSettings’ {aka ‘struct rdp_settings’} has no member named ‘KerberosKdcUrl’; did you mean ‘KerberosKdc’?
2033 | rdp_settings->KerberosKdcUrl = guac_strdup(guac_settings->kdc_url);
| ^~~~~~~~~~~~~~
| KerberosKdc
settings.c:2036:19: error: ‘rdpSettings’ {aka ‘struct rdp_settings’} has no member named ‘KerberosCache’; did you mean ‘KerberosKdc’?
2036 | rdp_settings->KerberosCache = guac_strdup(guac_settings->kerberos_cache);
| ^~~~~~~~~~~~~
| KerberosKdc
make[4]: *** [Makefile:1370: libguac_client_rdp_la-settings.lo] Error 1
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GUACAMOLE-2057: Add configuration parameters for supporting Kerberos authentication for RDP. [guacamole-server]
Posted by "corentin-soriano (via GitHub)" <gi...@apache.org>.
corentin-soriano commented on code in PR #581:
URL: https://github.com/apache/guacamole-server/pull/581#discussion_r2979700565
##########
src/protocols/rdp/settings.c:
##########
@@ -1695,6 +1746,29 @@ void guac_rdp_push_settings(guac_client* client,
}
+ /* Set the authentication package to use. */
+ switch(guac_settings->auth_pkg) {
+
+ case GUAC_AUTH_PKG_NTLM:
+ freerdp_settings_set_string(rdp_settings, FreeRDP_AuthenticationPackageList, "ntlm,!kerberos");
+ break;
+
+ case GUAC_AUTH_PKG_KERBEROS:
+ freerdp_settings_set_string(rdp_settings, FreeRDP_AuthenticationPackageList, "!ntlm,kerberos");
+ break;
+
+ case GUAC_AUTH_PKG_ANY:
+ freerdp_settings_set_string(rdp_settings, FreeRDP_AuthenticationPackageList, "ntlm,kerberos");
+ break;
+
+ }
+
+ if (guac_settings->kdc_url != NULL)
+ freerdp_settings_set_string(rdp_settings, FreeRDP_KerberosKdcUrl, guac_strdup(guac_settings->kdc_url));
+
+ if (guac_settings->kerberos_cache != NULL)
+ freerdp_settings_set_string(rdp_settings, FreeRDP_KerberosCache, guac_strdup(guac_settings->kerberos_cache));
Review Comment:
The specific Kerberos code should only be enabled with FreeRDP >= 3.x to avoid compilation errors in 2.x.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GUACAMOLE-2057: Add configuration parameters for supporting Kerberos authentication for RDP. [guacamole-server]
Posted by "corentin-soriano (via GitHub)" <gi...@apache.org>.
corentin-soriano commented on code in PR #581:
URL: https://github.com/apache/guacamole-server/pull/581#discussion_r3401717802
##########
src/protocols/rdp/settings.c:
##########
@@ -296,6 +299,28 @@ enum RDP_ARGS_IDX {
*/
IDX_SECURITY,
+ /**
+ * The authentication package to use based on the underlying FreeRDP support
+ * for alternatives to NTML. Currently FreeRDP2 only supports NTLM, while
+ * FreeRDP3 introduces support for Kerberos and continues to support NTLM.
+ * The default is to negotiate between guacd and the remote server.
+ */
+ IDX_AUTH_PKG,
Review Comment:
These are two different parameters. We may need to choose an explicit value for each
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org