Granting admin to a certain LDAP group

[Remush <m....@gmail.com>]

Hey everyone!

After reading the whole LDAP guacamole manual I'm still a bit lost about
the ldap configuration.

I have successfully made it so if the user is in the LDAP he is registered
to the DB and can login, but he has no access to anything.

I want to grant one LDAP group called ,network-managers, admin access in
the guacamole.

Is there a way to make it with guacamole.properties ? Do I need to make it
manually?

Re: Granting admin to a certain LDAP group

[Giuseppe <pe...@gmail.com>]

this is my ldap configuration

ldap-hostname: ldap.xxx.xxx
ldap-port: 389
ldap-search-bind-dn: xxx
ldap-search-bind-password: xxx
ldap-user-base-dn: ou=people,dc=xxx,dc=xx
ldap-user-search-filter: (objectClass=person)
ldap-username-attribute: uid
ldap-user-attributes: cn, givenName, sn, mail
ldap-group-base-dn: ou=groups,dc=xx,dc=xx
ldap-group-search-filter: (objectClass=groupOfNames)
ldap-max-search-results: 10000

on web interface connect with guacadmin user go to options->groups search
for network-managers and give it all permission and save.
After that every user in network-manager group has admin permission


Il giorno mar 19 dic 2023 alle ore 19:12 Remush <m....@gmail.com> ha
scritto:

> I'm sorry if I'm being rude but that's a bit general.
> I mean I understand that I have to configure it in the
> guacamole.properties but I'm confused on how.
>
> And I completely don't understand the interface part? What interface? What
> acls? Isn't it configured in the postgresql?
>

Re: Granting admin to a certain LDAP group

[Nick Couchman <vn...@apache.org>]

On Tue, Dec 19, 2023 at 1:13 PM Remush <m....@gmail.com> wrote:

> I'm sorry if I'm being rude but that's a bit general.
> I mean I understand that I have to configure it in the
> guacamole.properties but I'm confused on how.
>

Here are a few things to check:
* In order to get the LDAP extension to even look up groups in LDAP, you
need to at least configure the ldap-group-base-dn in guacamole.properties,
and set it to a location in your LDAP tree that contains the groups you
want to be available. If this property is not present in the configuration,
groups will not be looked up at all.
* You can also use "ldap-group-search-filter" to filter out what groups
you'd like to have pulled in to Guacamole. This is useful if you have a
very large LDAP tree but don't want it all in Guacamole.
* Make sure that the configuration of the LDAP extension matches your LDAP
server configuration. Things like ldap-member-attribute and
ldap-member-attribute-type may need to be adjusted depending on your LDAP
server to make sure that it properly recognizes membership of users in
groups.
* You will only be able to see LDAP users and groups in the Guacamole UI
when you log in with an LDAP user account - the default guacadmin account
from the DB extension will not be able to see the LDAP data.


>
> And I completely don't understand the interface part? What interface? What
> acls? Isn't it configured in the postgresql?
>

Once you have the group membership being pulled in correctly, you can
configure the group permissions in the Guacamole UI, assigning permissions
to a group of users.

-Nick

Re: Granting admin to a certain LDAP group

[Remush <m....@gmail.com>]

I'm sorry if I'm being rude but that's a bit general.
I mean I understand that I have to configure it in the guacamole.properties
but I'm confused on how.

And I completely don't understand the interface part? What interface? What
acls? Isn't it configured in the postgresql?

Re: Granting admin to a certain LDAP group

[Giuseppe Giardina <pe...@gmail.com>]

HI,
you have to configure the parameters regarding the ldap groups in the 
propertiers file and then from the interface you can configure the acls 
for all the groups you want (admin, access to certain endpoint etc )

Il 19/12/2023 18:55, Remush ha scritto:
> Hey everyone!
>
> After reading the whole LDAP guacamole manual I'm still a bit lost 
> about the ldap configuration.
>
> I have successfully made it so if the user is in the LDAP he is 
> registered to the DB and can login, but he has no access to anything.
>
> I want to grant one LDAP group called ,network-managers, admin access 
> in the guacamole.
>
> Is there a way to make it with guacamole.properties ? Do I need to 
> make it manually?
>
-- 
Proteggimi dal sapere quel che non ho bisogno di sapere. Proteggimi anche dal sapere che bisognerebbe sapere quello che non so. Proteggimi dal sapere quello che ho deciso di non sapere. Le cose che ho deciso di non sapere... Signore
Proteggimi dalle conseguenze della succitata preghiera. [Douglas Adams]


---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org