Groups and Connections

[xj04 <je...@live.com>]

Hello,

I am currently using version 1.0 and have it successfully integrated with
Active Directory (am able to login and see other AD users). I am trying to
setup a group with connections in it for users to access. However unless I
set the permissions in the group to "Administer system" users cannot see any
connections. Obviously I don't want every user to have admin right in
Guacamole. I figure that there is something I am doing wrong or missing.
Right now it's just a single group. I've tried nested groups as well
thinking maybe that would allow me to get around that but it seems
permissions are inherited from the top level group.

Any ideas on how I can get all users in a group to see a connection without
being an admin in Guacamole? Otherwise I may just have to do it user by
user. 

I've scoured the internet and read all the documentation on this but had no
luck



--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: Groups and Connections

[xj04 <je...@live.com>]

Doing some more research it looks like this may be a known issue

http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/Group-permissions-not-applied-tp5425.html





--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: Groups and Connections

[xj04 <je...@live.com>]

mjumper wrote
> On Tue, Jun 25, 2019 at 2:37 PM xj04 <

> jeffdorough@

> > wrote:
> 
>> Hello,
>>
>> I am currently using version 1.0 and have it successfully integrated with
>> Active Directory (am able to login and see other AD users). I am trying
>> to
>> setup a group with connections in it for users to access. However unless
>> I
>> set the permissions in the group to "Administer system" users cannot see
>> any
>> connections. Obviously I don't want every user to have admin right in
>> Guacamole. I figure that there is something I am doing wrong or missing.
>> Right now it's just a single group. I've tried nested groups as well
>> thinking maybe that would allow me to get around that but it seems
>> permissions are inherited from the top level group.
>>
>> Any ideas on how I can get all users in a group to see a connection
>> without
>> being an admin in Guacamole? Otherwise I may just have to do it user by
>> user.
> 
> 
> I think you may be confusing connection groups with user groups.
> 
> Ignoring balancing, connection groups are simply a way to organize
> connections, similar to a folder/directory. If you want to grant a user
> access to a connection group and the connections within it, you need to
> grant the user access to the connection group AND the connections within
> it. Access to the connection group alone does not imply access to its
> contents.
> 
> User groups have the behavior you're looking for. If you have a set of
> connections that you want a user group to have access to, you can grant
> that group access to those connections just as you would grant a user
> access. Any users that are members of that group will then inherit that
> access.
> 
> - Mike

  Thanks for the response! I don't think I may have relayed things correctly
though. So under *Settings* I go to *Groups.* In there I have a group called
"USERS". Opening that gets me a page that says *Edit Group*. Inside I have
an Active Directory User under Member Users as a test. Under *All
Connections* I have selected everything in the connection group list
including the folder names and the servers (except for the Domain
Controllers).

  When I go to login as that user I am unable to see any connections. If I
go back to the group (as an admin) and select the "Administer System"
permission in the "User" group all connections show up for the test user.
Including groups that I did not give the user access to (Domain
Controllers).

Thanks again for responding and helping me with this. I really appreciate
it.




--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: Groups and Connections

[Mike Jumper <mj...@apache.org>]

On Tue, Jun 25, 2019 at 2:37 PM xj04 <je...@live.com> wrote:

> Hello,
>
> I am currently using version 1.0 and have it successfully integrated with
> Active Directory (am able to login and see other AD users). I am trying to
> setup a group with connections in it for users to access. However unless I
> set the permissions in the group to "Administer system" users cannot see
> any
> connections. Obviously I don't want every user to have admin right in
> Guacamole. I figure that there is something I am doing wrong or missing.
> Right now it's just a single group. I've tried nested groups as well
> thinking maybe that would allow me to get around that but it seems
> permissions are inherited from the top level group.
>
> Any ideas on how I can get all users in a group to see a connection without
> being an admin in Guacamole? Otherwise I may just have to do it user by
> user.


I think you may be confusing connection groups with user groups.

Ignoring balancing, connection groups are simply a way to organize
connections, similar to a folder/directory. If you want to grant a user
access to a connection group and the connections within it, you need to
grant the user access to the connection group AND the connections within
it. Access to the connection group alone does not imply access to its
contents.

User groups have the behavior you're looking for. If you have a set of
connections that you want a user group to have access to, you can grant
that group access to those connections just as you would grant a user
access. Any users that are members of that group will then inherit that
access.

- Mike