You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Peter Kronfuss <pe...@bitrotator.net.INVALID> on 2025/05/06 10:56:59 UTC
Username is case sensitive and allows TOTP bypass
Hi there!
We are using Guacamole 1.5.5 and I have also tested it on 1.6.0 with the
same result.
We are using the guacamole-auth-jdbc-postgresql-1.6.0.jar extension, as
well as guacamole-auth-ldap-1.6.0.jar and guacamole-auth-totp-1.6.0.jar
to get TOTP 2 factor authentication.
In guacamole.properties we have enabled automatic account creation.
postgresql-auto-create-accounts: true
Users are authenticated against LDAP, which works fine, but the username
is written to the database as it was entered in the username input field
on the login screen.
So if someone logs in as user abc who is authenticated against LDAP, the
user will get the initial TOTP QRCode to scan with their phone, so
2-factor authentication will be set up for that user.
But if the same user tries to connect with user aBc, they will be
correctly authenticated against LDAP, but will see an initial TOTP
QRCode again and can set up a new, different second factor. So basically
the user is able to bypass the 2-factor authentication. I can see that
there are actually two users abc, aBc in the database.
Can we somehow force the database authentication to be case-insensitive?
Regards,
Peter
Re: Username is case sensitive and allows TOTP bypass
Posted by Nick Couchman <vn...@apache.org>.
On Tue, May 6, 2025 at 8:04 AM Peter Kronfuss <pe...@bitrotator.net.invalid>
wrote:
> sorry, there is a typo in the sql-batch (copy&paste error):
>
> CREATE COLLATION public.case_insensitive (provider = icu, locale =
> 'und-u-ks-level2', deterministic = false);
> ALTER TABLE guacamole_entity ALTER COLUMN name TYPE varchar(128) COLLATE
> "case_insensitive";
>
>
>
> Am 2025-05-06 13:59, schrieb Peter Kronfuss:
>
> Hi there again!
>
> I may have found a workaround, but I am not sure if it has any side
> effects.
>
> I have changed the collation of the name column in the guacamole_entity
> table to be case-insensitive, so that logging in with different usernames
> will result in the same entry.
>
> Maybe someone can check this solution and give me some feedback.
>
> CREATE COLLATION public.case_insensitive (provider = icu, locale =
> 'und-u-ks-level2', deterministic = false);
>
>
> ALTER TABLE guacamole_entity ALTER COLUMN name TYPE varying(128) COLLATE
> "case_insensitive";
>
> Regards,
> Peter
>
> Peter,
Thanks for posting back a work-around to this issue. First, to address the
actual issue you raise, yes, the JDBC module, when used with PostgreSQL,
evaluates string comparisons in a case-sensitive manner, which can make
things like integration with LDAP (or SAML, OpenID, etc.) a challenge,
since most other systems do not consider usernames to be case-sensitive. In
addition to the challenge that you've highlighted with the TOTP module,
this also manifests in things like assigning permissions to users - a user
could log in with a username John_Doe and be assigned privileges in the
database, and, subsequently log in as john_doe and not have those
privileges.
Aside from the work-around that you've mentioned, we've actually addressed
this issue in the upcoming 1.6.0 release with the introduction of a
property in guacamole.properties that allows you to toggle case-sensitivity
for users, groups, or both. See the release notes and draft documentation:
https://guacamole.apache.org/releases/1.6.0/
https://issues.apache.org/jira/browse/GUACAMOLE-1239
https://guacamole.apache.org/doc/1.6.0/gug/configuring-guacamole.html#standard-configuration-options-guacamole-properties
-Nick
>
Re: Username is case sensitive and allows TOTP bypass
Posted by Peter Kronfuss <pe...@bitrotator.net.INVALID>.
sorry, there is a typo in the sql-batch (copy&paste error):
CREATE COLLATION public.case_insensitive (provider = icu, locale =
'und-u-ks-level2', deterministic = false);
ALTER TABLE guacamole_entity ALTER COLUMN name TYPE varchar(128) COLLATE
"case_insensitive";
Am 2025-05-06 13:59, schrieb Peter Kronfuss:
> Hi there again!
>
> I may have found a workaround, but I am not sure if it has any side effects.
>
> I have changed the collation of the name column in the guacamole_entity table to be case-insensitive, so that logging in with different usernames will result in the same entry.
>
> Maybe someone can check this solution and give me some feedback.
>
> CREATE COLLATION public.case_insensitive (provider = icu, locale = 'und-u-ks-level2', deterministic = false);
>
> ALTER TABLE guacamole_entity ALTER COLUMN name TYPE varying(128) COLLATE "case_insensitive";
>
> Regards,
> Peter
>
> [...]
Re: Username is case sensitive and allows TOTP bypass
Posted by Peter Kronfuss <pe...@bitrotator.net.INVALID>.
Hi there again!
I may have found a workaround, but I am not sure if it has any side
effects.
I have changed the collation of the name column in the guacamole_entity
table to be case-insensitive, so that logging in with different
usernames will result in the same entry.
Maybe someone can check this solution and give me some feedback.
CREATE COLLATION public.case_insensitive (provider = icu, locale =
'und-u-ks-level2', deterministic = false);
ALTER TABLE guacamole_entity ALTER COLUMN name TYPE varying(128) COLLATE
"case_insensitive";
Regards,
Peter
At 2025-05-06 12:56, Peter Kronfuss wrote:
> Hi there!
>
> We are using Guacamole 1.5.5 and I have also tested it on 1.6.0 with the same result.
>
> We are using the guacamole-auth-jdbc-postgresql-1.6.0.jar extension, as well as guacamole-auth-ldap-1.6.0.jar and guacamole-auth-totp-1.6.0.jar to get TOTP 2 factor authentication.
>
> In guacamole.properties we have enabled automatic account creation.
>
> postgresql-auto-create-accounts: true
>
> Users are authenticated against LDAP, which works fine, but the username is written to the database as it was entered in the username input field on the login screen.
>
> So if someone logs in as user abc who is authenticated against LDAP, the user will get the initial TOTP QRCode to scan with their phone, so 2-factor authentication will be set up for that user.
>
> But if the same user tries to connect with user aBc, they will be correctly authenticated against LDAP, but will see an initial TOTP QRCode again and can set up a new, different second factor. So basically the user is able to bypass the 2-factor authentication. I can see that there are actually two users abc, aBc in the database.
>
> Can we somehow force the database authentication to be case-insensitive?
>
> Regards,
> Peter