user restriction to 1 RDP only

[alphablue <zz...@hotmail.com>]

Hi,
I have a lab with 5 computers. I created a connection group "Lab" of type
organizational and set its "Maximum number of connections per user = 1" and
checked session affinity. I then added all 5 computers to this connection
group and for each computer connect I set "Maximum number of connections =1"
and "Maximum number of connections per user=1". Now users cannot login the
same PC that is being used; However, a user can login more than 1 PC at the
same time even though I set the group connection to max 1 connection per
user. Can someone please advise of what I did wrong? Did I miss something?

Regards,

AB



--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: user restriction to 1 RDP only

[alphablue <zz...@hotmail.com>]

Thank you for sharing this knowledge Mike. I did not know this is how
guacamole processes these values, but now I know and I appreciate it.



--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: user restriction to 1 RDP only

[Mike Jumper <mj...@apache.org>]

On Wed, May 20, 2020 at 6:00 PM Nick Couchman <vn...@apache.org> wrote:

> On Tue, May 19, 2020 at 11:13 AM alphablue <zz...@hotmail.com> wrote:
>
>> Hi,
>> I have a lab with 5 computers. I created a connection group "Lab" of type
>> organizational and set its "Maximum number of connections per user = 1"
>> and
>> checked session affinity. I then added all 5 computers to this connection
>> group and for each computer connect I set "Maximum number of connections
>> =1"
>> and "Maximum number of connections per user=1". Now users cannot login the
>> same PC that is being used; However, a user can login more than 1 PC at
>> the
>> same time even though I set the group connection to max 1 connection per
>> user. Can someone please advise of what I did wrong? Did I miss something?
>>
>>
> So, this is what I think *should* work, though I've yet to try it myself:
> - Create a connection group of type "Balancing"
> - Create 5 connections and place them in the connect group.
> - Set max connections per user to 1 for the connection group.
> - Set max connections for each connection to 1.
> - Set session affinity for the connection group
> - Make sure the users have permissions to access the connection group
> - Make sure the users do *NOT* have permissions to the connections within
> the group
> - The users should connect to the group, not the individual connections.
>
> This should limit each user to a maximum of 1 session for the entire
> connection group, which is, I believe, what you want, and should make it
> such that the users do not need to see or worry about the underlying
> connections - they just access the top-level group.
>
> If you are trying to set the max connections per user at the top-level
> group, but allow the users to choose which underlying connection they
> connect to by giving them access to the individual connections, I don't
> think this will accomplish what you're trying to do - I do not believe the
> parameters for max connection and max connections per user do not apply
> hierarchically to the underlying connections.  Someone correct me if I'm
> wrong...
>

You're correct - the restrictions specified on a connection group apply
only to attempts to connect to that group, not to attempts to connect
directly to connections *within* the group. They affect only the behavior
of the balancing group itself when it is fulfilling a request to connect.

If "Maximum number of connections per user" is set to 1 for a particular
connection, then any particular user will only be able to have one
connection open for that connection at any given time. They will still be
able to use other connections, and other users will be able to try to use
*that* connection.

If "Maximum number of connections per user" is set to 1 for a particular
connection group, then any particular user will only be able to have one
connection open for that connection group at any given time. They will
still be able to use other connections, including connections within that
group (unless they don't have permission to directly access those
connections), and other users will be able to try to use that connection
group.

- Mike

Re: user restriction to 1 RDP only

[alphablue <zz...@hotmail.com>]

You are amazing vnick! My problem was I had enabled the users to have
permission within the group. Now the user logs in directly to the available
computer picked by guacamole which is even better (less clicks for the
user). Thank you again 




--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: user restriction to 1 RDP only

[Nick Couchman <vn...@apache.org>]

On Tue, May 19, 2020 at 11:13 AM alphablue <zz...@hotmail.com> wrote:

> Hi,
> I have a lab with 5 computers. I created a connection group "Lab" of type
> organizational and set its "Maximum number of connections per user = 1" and
> checked session affinity. I then added all 5 computers to this connection
> group and for each computer connect I set "Maximum number of connections
> =1"
> and "Maximum number of connections per user=1". Now users cannot login the
> same PC that is being used; However, a user can login more than 1 PC at the
> same time even though I set the group connection to max 1 connection per
> user. Can someone please advise of what I did wrong? Did I miss something?
>
>
So, this is what I think *should* work, though I've yet to try it myself:
- Create a connection group of type "Balancing"
- Create 5 connections and place them in the connect group.
- Set max connections per user to 1 for the connection group.
- Set max connections for each connection to 1.
- Set session affinity for the connection group
- Make sure the users have permissions to access the connection group
- Make sure the users do *NOT* have permissions to the connections within
the group
- The users should connect to the group, not the individual connections.

This should limit each user to a maximum of 1 session for the entire
connection group, which is, I believe, what you want, and should make it
such that the users do not need to see or worry about the underlying
connections - they just access the top-level group.

If you are trying to set the max connections per user at the top-level
group, but allow the users to choose which underlying connection they
connect to by giving them access to the individual connections, I don't
think this will accomplish what you're trying to do - I do not believe the
parameters for max connection and max connections per user do not apply
hierarchically to the underlying connections.  Someone correct me if I'm
wrong...

-Nick