You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by LuKaRo <li...@lrose.de> on 2022/02/10 22:06:41 UTC
`The username must not be blank` when accessing a shared connection
Hi everyone,
when accessing a shared connection via its unique link
(https://example.com/guacamole/#/?key=8VWhtzDNkV9LVMTTsfp2ucf5LZQnxzsLYVp0-a112j_g),
guest users get only a blank page. `/var/log/tomcat9/catalina.out` says:
[2022-02-10 22:47:38] [info] 22:47:38.100 [http-nio-8080-exec-11] DEBUG
o.a.g.rest.RESTExceptionMapper - Client request rejected: The username
must not be blank.
Accessing the same link from a session already logged in to Guacamole
works as expected.
Is this a bug, or am I missing something? I'm expecting the username to
be blank, as the guest user is accessing the shared connection only by
its link and doesn't have a user account on our Guacamole instance. Or
is some generic username required that got lost in the sharing process?
I've just upgraded from 1.3.0 to 1.4.0, the error occurs in both
versions. I'm using tomcat version 9.0.43-2~deb11u3 with nginx/1.18.0 as
a reverse proxy on Debian 11.2, kernel 5.10.0-9-amd64, updated from
Debian 10. Authentication happens through LDAP, connection details are
stored in a MariaDB connected using the MariaDB JDBC Connector v2.7.3.
Any ideas? The full debug log output in catalina.out when opening the
share link is attached below:
Thanks a lot in advance! And thanks for the great effort you all put
into Guacamole. I can't stress that enough, this is a really valuable
software. Keep up the good work!
LuKaRo
[2022-02-10 22:47:37] [info] 22:47:37.992 [http-nio-8080-exec-5] DEBUG
o.a.g.resource.ResourceServlet - Resource not modified: "/app.css"
[2022-02-10 22:47:37] [info] 22:47:37.996 [http-nio-8080-exec-8] DEBUG
o.a.g.resource.ResourceServlet - Resource not modified: "/app.js"
[2022-02-10 22:47:38] [info] 22:47:38.085 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Opening JDBC Connection
[2022-02-10 22:47:38] [info] 22:47:38.085 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Checked out connection 480634150 from
pool.
[2022-02-10 22:47:38] [info] 22:47:38.085 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Testing connection 480634150 ...
[2022-02-10 22:47:38] [info] 22:47:38.086 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Connection 480634150 is GOOD!
[2022-02-10 22:47:38] [info] 22:47:38.086 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Setting autocommit to false on JDBC
Connection [org.mariadb.jdbc.MariaDbConnection@1ca5e526]
[2022-02-10 22:47:38] [info] 22:47:38.086 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.user.UserMapper.selectOne - ==> Preparing: SELECT
guacamole_user.user_id, guacamole_entity.entity_id,
guacamole_entity.name, password_hash, password_salt, password_date,
disabled, expired, access_window_start, access_window_end, valid_from,
valid_until, timezone, full_name, email_address, organization,
organizational_role, MAX(start_date) AS last_active FROM guacamole_user
JOIN guacamole_entity ON guacamole_user.entity_id =
guacamole_entity.entity_id LEFT JOIN guacamole_user_history ON
guacamole_user_history.user_id = guacamole_user.user_id WHERE
guacamole_entity.name = ? AND guacamole_entity.type = 'USER' GROUP BY
guacamole_user.user_id, guacamole_entity.entity_id; SELECT
guacamole_user_attribute.user_id,
guacamole_user_attribute.attribute_name,
guacamole_user_attribute.attribute_value FROM guacamole_user_attribute
JOIN guacamole_user ON guacamole_user.user_id =
guacamole_user_attribute.user_id JOIN guacamole_entity ON
guacamole_user.entity_id = guacamole_entity.entity_id WHERE
guacamole_entity.name = ? AND guacamole_entity.type = 'USER'
[2022-02-10 22:47:38] [info] 22:47:38.086 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.user.UserMapper.selectOne - ==> Parameters: null, null
[2022-02-10 22:47:38] [info] 22:47:38.087 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.user.UserMapper.selectOne - <== Total: 0
[2022-02-10 22:47:38] [info] 22:47:38.087 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Resetting autocommit to true on JDBC
Connection [org.mariadb.jdbc.MariaDbConnection@1ca5e526]
[2022-02-10 22:47:38] [info] 22:47:38.087 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Closing JDBC Connection
[org.mariadb.jdbc.MariaDbConnection@1ca5e526]
[2022-02-10 22:47:38] [info] 22:47:38.087 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Testing connection 480634150 ...
[2022-02-10 22:47:38] [info] 22:47:38.087 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Connection 480634150 is GOOD!
[2022-02-10 22:47:38] [info] 22:47:38.087 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Returned connection 480634150 to pool.
[2022-02-10 22:47:38] [info] 22:47:38.088 [http-nio-8080-exec-11] INFO
o.a.g.r.auth.AuthenticationService - User "" successfully authenticated
from 10.99.16.13.
[2022-02-10 22:47:38] [info] 22:47:38.088 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Opening JDBC Connection
[2022-02-10 22:47:38] [info] 22:47:38.088 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Checked out connection 1801136537 from
pool.
[2022-02-10 22:47:38] [info] 22:47:38.088 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Testing connection 1801136537 ...
[2022-02-10 22:47:38] [info] 22:47:38.088 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Connection 1801136537 is GOOD!
[2022-02-10 22:47:38] [info] 22:47:38.089 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Setting autocommit to false on JDBC
Connection [org.mariadb.jdbc.MariaDbConnection@6b5b2999]
[2022-02-10 22:47:38] [info] 22:47:38.089 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.user.UserMapper.selectOne - ==> Preparing: SELECT
guacamole_user.user_id, guacamole_entity.entity_id,
guacamole_entity.name, password_hash, password_salt, password_date,
disabled, expired, access_window_start, access_window_end, valid_from,
valid_until, timezone, full_name, email_address, organization,
organizational_role, MAX(start_date) AS last_active FROM guacamole_user
JOIN guacamole_entity ON guacamole_user.entity_id =
guacamole_entity.entity_id LEFT JOIN guacamole_user_history ON
guacamole_user_history.user_id = guacamole_user.user_id WHERE
guacamole_entity.name = ? AND guacamole_entity.type = 'USER' GROUP BY
guacamole_user.user_id, guacamole_entity.entity_id; SELECT
guacamole_user_attribute.user_id,
guacamole_user_attribute.attribute_name,
guacamole_user_attribute.attribute_value FROM guacamole_user_attribute
JOIN guacamole_user ON guacamole_user.user_id =
guacamole_user_attribute.user_id JOIN guacamole_entity ON
guacamole_user.entity_id = guacamole_entity.entity_id WHERE
guacamole_entity.name = ? AND guacamole_entity.type = 'USER'
[2022-02-10 22:47:38] [info] 22:47:38.089 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.user.UserMapper.selectOne - ==> Parameters: (String), (String)
[2022-02-10 22:47:38] [info] 22:47:38.090 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.user.UserMapper.selectOne - <== Total: 0
[2022-02-10 22:47:38] [info] 22:47:38.090 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Resetting autocommit to true on JDBC
Connection [org.mariadb.jdbc.MariaDbConnection@6b5b2999]
[2022-02-10 22:47:38] [info] 22:47:38.090 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Closing JDBC Connection
[org.mariadb.jdbc.MariaDbConnection@6b5b2999]
[2022-02-10 22:47:38] [info] 22:47:38.091 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Testing connection 1801136537 ...
[2022-02-10 22:47:38] [info] 22:47:38.091 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Connection 1801136537 is GOOD!
[2022-02-10 22:47:38] [info] 22:47:38.091 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Returned connection 1801136537 to pool.
[2022-02-10 22:47:38] [info] 22:47:38.095 [http-nio-8080-exec-11] DEBUG
o.m.g.t.TransactionalMethodInterceptor - [Intercepted method: public
java.util.Set<java.lang.String>
org.apache.guacamole.auth.jdbc.base.EntityService.retrieveEffectiveGroups(org.apache.guacamole.auth.jdbc.base.ModeledPermissions<?
extends
org.apache.guacamole.auth.jdbc.base.EntityModel>,java.util.Collection<java.lang.String>)]
- SqlSession not set for thread: 46, creating a new one
[2022-02-10 22:47:38] [info] 22:47:38.095 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Opening JDBC Connection
[2022-02-10 22:47:38] [info] 22:47:38.096 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Checked out connection 1801136537 from
pool.
[2022-02-10 22:47:38] [info] 22:47:38.096 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Testing connection 1801136537 ...
[2022-02-10 22:47:38] [info] 22:47:38.096 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Connection 1801136537 is GOOD!
[2022-02-10 22:47:38] [info] 22:47:38.096 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Setting autocommit to false on JDBC
Connection [org.mariadb.jdbc.MariaDbConnection@6b5b2999]
[2022-02-10 22:47:38] [info] 22:47:38.096 [http-nio-8080-exec-11] DEBUG
o.a.g.a.mysql.conf.MySQLEnvironment - Database recognized as MySQL 10.5.12.
[2022-02-10 22:47:38] [info] 22:47:38.097 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.b.E.selectEffectiveGroupIdentifiers - ==> Preparing: WITH
RECURSIVE related_entity(entity_id) AS ( SELECT
guacamole_user_group.entity_id FROM guacamole_user_group JOIN
guacamole_user_group_member ON guacamole_user_group.user_group_id =
guacamole_user_group_member.user_group_id WHERE
guacamole_user_group_member.member_entity_id = ? AND
guacamole_user_group.disabled = false UNION SELECT
guacamole_user_group.entity_id FROM related_entity JOIN
guacamole_user_group_member ON related_entity.entity_id =
guacamole_user_group_member.member_entity_id JOIN guacamole_user_group
ON guacamole_user_group.user_group_id =
guacamole_user_group_member.user_group_id WHERE
guacamole_user_group.disabled = false ) SELECT name FROM related_entity
JOIN guacamole_entity ON related_entity.entity_id =
guacamole_entity.entity_id WHERE guacamole_entity.type = 'USER_GROUP';
[2022-02-10 22:47:38] [info] 22:47:38.097 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.b.E.selectEffectiveGroupIdentifiers - ==> Parameters: null
[2022-02-10 22:47:38] [info] 22:47:38.098 [http-nio-8080-exec-11] DEBUG
o.a.g.a.j.b.E.selectEffectiveGroupIdentifiers - <== Total: 0
[2022-02-10 22:47:38] [info] 22:47:38.098 [http-nio-8080-exec-11] DEBUG
o.m.g.t.TransactionalMethodInterceptor - [Intercepted method: public
java.util.Set<java.lang.String>
org.apache.guacamole.auth.jdbc.base.EntityService.retrieveEffectiveGroups(org.apache.guacamole.auth.jdbc.base.ModeledPermissions<?
extends
org.apache.guacamole.auth.jdbc.base.EntityModel>,java.util.Collection<java.lang.String>)]
- SqlSession of thread: 46 committing
[2022-02-10 22:47:38] [info] 22:47:38.098 [http-nio-8080-exec-11] DEBUG
o.m.g.t.TransactionalMethodInterceptor - [Intercepted method: public
java.util.Set<java.lang.String>
org.apache.guacamole.auth.jdbc.base.EntityService.retrieveEffectiveGroups(org.apache.guacamole.auth.jdbc.base.ModeledPermissions<?
extends
org.apache.guacamole.auth.jdbc.base.EntityModel>,java.util.Collection<java.lang.String>)]
- SqlSession of thread: 46 terminated its life-cycle, closing it
[2022-02-10 22:47:38] [info] 22:47:38.098 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Resetting autocommit to true on JDBC
Connection [org.mariadb.jdbc.MariaDbConnection@6b5b2999]
[2022-02-10 22:47:38] [info] 22:47:38.098 [http-nio-8080-exec-11] DEBUG
o.a.i.t.jdbc.JdbcTransaction - Closing JDBC Connection
[org.mariadb.jdbc.MariaDbConnection@6b5b2999]
[2022-02-10 22:47:38] [info] 22:47:38.098 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Testing connection 1801136537 ...
[2022-02-10 22:47:38] [info] 22:47:38.099 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Connection 1801136537 is GOOD!
[2022-02-10 22:47:38] [info] 22:47:38.099 [http-nio-8080-exec-11] DEBUG
o.a.i.d.pooled.PooledDataSource - Returned connection 1801136537 to pool.
[2022-02-10 22:47:38] [info] 22:47:38.099 [http-nio-8080-exec-11] DEBUG
o.m.g.t.TransactionalMethodInterceptor - [Intercepted method: public
InternalType
org.apache.guacamole.auth.jdbc.base.ModeledDirectoryObjectService.createObject(org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser,ExternalType)
throws org.apache.guacamole.GuacamoleException] - SqlSession not set for
thread: 46, creating a new one
[2022-02-10 22:47:38] [info] 22:47:38.099 [http-nio-8080-exec-11] DEBUG
o.m.g.t.TransactionalMethodInterceptor - [Intercepted method: public
InternalType
org.apache.guacamole.auth.jdbc.base.ModeledDirectoryObjectService.createObject(org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser,ExternalType)
throws org.apache.guacamole.GuacamoleException] - SqlSession of thread:
46 rolling back
[2022-02-10 22:47:38] [info] 22:47:38.100 [http-nio-8080-exec-11] DEBUG
o.m.g.t.TransactionalMethodInterceptor - [Intercepted method: public
InternalType
org.apache.guacamole.auth.jdbc.base.ModeledDirectoryObjectService.createObject(org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser,ExternalType)
throws org.apache.guacamole.GuacamoleException] - SqlSession of thread:
46 terminated its life-cycle, closing it
[2022-02-10 22:47:38] [info] 22:47:38.100 [http-nio-8080-exec-11] DEBUG
o.a.g.rest.RESTExceptionMapper - Client request rejected: The username
must not be blank.
[2022-02-10 22:47:38] [info] 22:47:38.117 [http-nio-8080-exec-10] DEBUG
o.a.g.resource.ResourceServlet - Resource not modified:
"/translations/en.json"
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: `The username must not be blank` when accessing a shared connection
Posted by Nick Couchman <vn...@apache.org>.
On Sat, Feb 12, 2022 at 7:18 PM LuKaRo <li...@lrose.de> wrote:
> Hi Nick,
>
> thanks for getting back to me. No, I've not customized anything, I'm
> building both the client and the server from the sources published at:
>
> 1.
> http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/1.4.0/source/guacamole-server-1.4.0.tar.gz
> 2.
> http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/1.4.0/source/guacamole-client-1.4.0.tar.gz
>
> I've written an ansible role that installs the server:
>
> 1. Decompress the tarball
> 2. ./configure
> 3. make
> 4. make install
> 5. ldconfig
> 6. Install a systemd unit file
>
> And the client:
>
> 1. Decompress the tarball
> 2. set JAVA_HOME="/usr/lib/jvm/default-java" and
> OPENSSL_CONF="/etc/ssl/"
> 3. mvn package
> 4. copy target/guacamole-1.4.0.war to
> /var/lib/tomcat9/webapps/guacamole.war
> 5. copy
> extensions/guacamole-auth-ldap/target/guacamole-auth-ldap-1.4.0.jar and
> guacamole-auth-jdbc-mysql-1.4.0.jar to /etc/guacamole/extensions/
> 6. download
> https://downloads.mariadb.com/Connectors/java/connector-java-2.7.3/mariadb-java-client-2.7.3.jar
> to /etc/guacamole/lib/
>
> And then installs configuration:
>
> 1. /etc/tomcat9/server.xml
> 2. guacamole.properties
> 3. user-mapping.xml (empty)
> 4. logback.xml
> 5. guacd.conf
>
>
Okay, just a few things that I've noticed with your config files. I'm not
certain that any of these are responsible for the issue you're seeing, but
it's worth correcting things until we figure it out...
* In your guacamole.properties file, your ldap-user-search-filter line is
invalid. The ${GUAC_USERNAME} token is only valid in connection properties,
and has no meaning in the guacamole.properties file. I would not think this
would cause the behavior you're seeing, but it might interfere with your
ability to authenticate LDAP users successfully, and, if nothing else,
won't be of any value at all to you.
* In your nginx vhost configuration file for proxying Guacamole, you're
attempting to do a rewrite of the URLs there such that any URL at / will be
redirected to /guacamole. This is the line I more suspect could be causing
odd issues, and I'd suggest removing it entirely, or at least long enough
to verify that it isn't causing any issues. While I've no doubt that valid
rewrite rules can be generated and configured to do this, I'd highly
recommend, instead, just renaming the guacamole.war file to ROOT.war so
that Tomcat is hosting Guacamole at its root and then just proxy the /
location in nginx. This is what I do in my Guacamole installations since
Guacamole is the only thing running on those servers, and it works quite
well.
* If you're using JDBC + LDAP, you don't need user-mapping.xml - just
delete it entirely.
-Nick
Re: `The username must not be blank` when accessing a shared connection
Posted by LuKaRo <li...@lrose.de>.
Hi Nick,
thanks for getting back to me. No, I've not customized anything, I'm
building both the client and the server from the sources published at:
1. http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/1.4.0/source/guacamole-server-1.4.0.tar.gz
2. http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/1.4.0/source/guacamole-client-1.4.0.tar.gz
I've written an ansible role that installs the server:
1. Decompress the tarball
2. ./configure
3. make
4. make install
5. ldconfig
6. Install a systemd unit file
And the client:
1. Decompress the tarball
2. set JAVA_HOME="/usr/lib/jvm/default-java" and OPENSSL_CONF="/etc/ssl/"
3. mvn package
4. copy target/guacamole-1.4.0.war to
/var/lib/tomcat9/webapps/guacamole.war
5. copy
extensions/guacamole-auth-ldap/target/guacamole-auth-ldap-1.4.0.jar
and guacamole-auth-jdbc-mysql-1.4.0.jar to /etc/guacamole/extensions/
6. download
https://downloads.mariadb.com/Connectors/java/connector-java-2.7.3/mariadb-java-client-2.7.3.jar
to /etc/guacamole/lib/
And then installs configuration:
1. /etc/tomcat9/server.xml
2. guacamole.properties
3. user-mapping.xml (empty)
4. logback.xml
5. guacd.conf
But the code is unmodified. I've attached all configuration files. Any
ideas how I could further diagnose this issue?
Thanks a lot for your help in advance!
Kind regards,
LuKaRo
Re: `The username must not be blank` when accessing a shared connection
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Feb 10, 2022 at 5:07 PM LuKaRo <li...@lrose.de> wrote:
> Hi everyone,
>
> when accessing a shared connection via its unique link
> (
> https://example.com/guacamole/#/?key=8VWhtzDNkV9LVMTTsfp2ucf5LZQnxzsLYVp0-a112j_g),
>
> guest users get only a blank page. `/var/log/tomcat9/catalina.out` says:
>
> [2022-02-10 22:47:38] [info] 22:47:38.100 [http-nio-8080-exec-11] DEBUG
> o.a.g.rest.RESTExceptionMapper - Client request rejected: The username
> must not be blank.
>
> Accessing the same link from a session already logged in to Guacamole
> works as expected.
>
> Is this a bug, or am I missing something? I'm expecting the username to
> be blank, as the guest user is accessing the shared connection only by
> its link and doesn't have a user account on our Guacamole instance. Or
> is some generic username required that got lost in the sharing process?
>
>
Yeah, something is definitely not quite right, here - there is a generic
username that it used for anonymous/shared connections, so the fact that it
is blank definitely indicates that something is not functioning as
expected. Have you customized the code at all, or are you using any custom
authentication modules outside of LDAP and JDBC?
-Nick