You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by anoop yadav <an...@gmail.com> on 2024/01/18 06:02:07 UTC
Token Management
I am trying to build a Web app where users can create multiple Ubuntu
instances and use them through my web app. The domain for my web app is
example-app.com which is written in reactjs. I have hosted guacamole
clients on separate subdomains lab.example-app.com.
In the reactjs app, I am using the Iframe (Not sure if there is any other
way) to show lab.example-app.com (guacamole client app), since I don't want
the user to do another login on the guacamole app. I am planning to use a
token. My current logic is as follows:
1. When the user creates an account (the backend is in Django-python) I
make a rest API request to create an account, get a token from guacamole
and save it to the web app database.
2. When the user creates an Ubuntu instance, using the rest API I create a
connection and associate the user with it. I save a URL like
lab.example-app.com/guacamole/#/client/<CONNECTION>?token=<TOKEN>
Everything works fine, the user can access multiple connections but since
the token has a lifetime, and after that time the URL is not working.
How do I manage the token so that it doesn't expire?
Re: Odp: RE: Re: Re: Re: REST API - Create URL connection (Permission Denied)
Posted by Michael Jumper <mj...@apache.org>.
On 2/14/24 04:33, i.noska@wp.pl wrote:
> Hello,
>
> Any idea how to solve the issue with URL? Thanks.
>
> DEBUG o.a.g.rest.RESTExceptionMapper - Unexpected error
> in REST endpoint.
> Feb 10 15:24:36 server[104645]:
> java.lang.NullPointerException: null
>
> "POST /guacamole/api/session/data/mysql/connections
> HTTP/1.1" 500 203
>
Open up browser dev tools and compare what your script is sending to the
JSON that the browser sends for the same operation and look for
differences. You may be missing some properties.
- Mike
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Odp: RE: Re: Re: Re: REST API - Create URL connection (Permission Denied)
Posted by "i.noska@wp.pl" <i....@wp.pl>.
Hello, Any idea how to solve the issue with URL? Thanks. DEBUG o.a.g.rest.RESTExceptionMapper - Unexpected error in REST endpoint. Feb 10 15:24:36 server[104645]: java.lang.NullPointerException: null "POST /guacamole/api/session/data/mysql/connections HTTP/1.1" 500 203 -- Regards Marcin -------------------------------------------------------------------- Dnia 13 lutego 2024 16:29 i.noska@wp.pl <i.noska@wp.pl> napisał(a): Hi Russell, Nick, Team, Could you help to solve this issue? Probably the URL is incorrect. Thank you in advance. I added some "echo" lines to see output: ------------------------------------------ echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" This is my result now: ----------------------- TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D RESPONSE: {"message":"Unexpected internal error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"} IDENTIFIER: null Client Identifier: Error creating connection. Is is correct now? It looks like the "RESPONSE" curl URL is invalid?! The "permission denied" disappeared, but another error appeared. -- Best regards Marcin ------------------------------------------------- Dnia 11 lutego 2024 22:53 i.noska@wp.pl <i.noska@wp.pl> napisał(a): Hi Russell, I have a .NET application that already uses bash scripts and I would like to maintain this standard if possible. I checked provided GITHUB repo and I see that some updates were very long ago and the Readme.md file is empty - no documentation. Thank you for your help. -- Marcin --------------------------------------------------------------------------- Dnia 11 lutego 2024 00:17 Russell Sayers <russell.sayers@gmail.com> napisał(a): Hi MK, Is Python an option for you? I’ve used this API wrapper in the past: github.com https://github.com/pschmitt/guacapy Russ On Sun, Feb 11, 2024 at 01:38 i.noska@wp.pl < i.noska@wp.pl > wrote: I forgot to add the logs: DEBUG o.a.g.rest.RESTExceptionMapper - Unexpected error in REST endpoint. Feb 10 15:24:36 server[104645]: java.lang.NullPointerException: null "POST /guacamole/api/session/data/mysql/connections HTTP/1.1" 500 203 ----------- Regards MK ---------------------------- Dnia 10 lutego 2024 15:27 i.noska@wp.pl < i.noska@wp.pl > napisał(a): Hi Nick, Thank you for your response! I modified the script according to your information. ---------------------- SCRIPT ---------------------- #!/bin/bash # Obtain the Guacamole authentication token TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Define the API endpoint for creating connections in Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " # Define the connection data in JSON format CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' # Make a POST request to create a new connection using the Guacamole API RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Guacamole-Token: $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) # Extract the connection identifier from the response IDENTIFIER=$(echo "$RESPONSE" | jq -r '.identifier') if [ "$IDENTIFIER" != "null" ]; then # Construct the base64url-encoded client identifier CLIENT_IDENTIFIER=$(echo -n "{\"id\":\"$IDENTIFIER\",\"type\":\"c\",\"dataSource\":\"mysql\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=') URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CLIENT_IDENTIFIER " echo "Client Identifier: $CLIENT_IDENTIFIER" echo "URL: $URL" else echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" echo "Error creating connection." fi ---------------------- SCRIPT END ---------------------- I added some "echo" lines to see output: ------------------------------------------ echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" This is my result now: ----------------------- TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D RESPONSE: {"message":"Unexpected internal error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"} IDENTIFIER: null Client Identifier: Error creating connection. Is is correct now? It looks like the "RESPONSE" curl URL is invalid?! The "permission denied" disappeared, but another error appeared. ------------------------------------- Thank you for your help. -- MK Dnia 09 lutego 2024 16:47 Nick Couchman < vnick@apache.org > napisał(a): On Fri, Feb 9, 2024 at 6:46 AM i.noska@wp.pl < i.noska@wp.pl > wrote: Hello, I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to login to GUI, create users, connection, etc. I installed database (MySQL) as well (to manage users, connection) with all needed *.jar files according to doc guacamole.apache.org https://guacamole.apache.org/doc/gug/jdbc-auth.html After that, I'm able to login as ""guacadmin" user to GUI and manage connections etc. Now, I want to create URL to direct connection to my VM, but I found errors like below: ------------------------------ SCRIPT ------------------------------------- #!/bin/bash TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Endpoint API Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) I don't think you're using the correct header, here for the Guacamole authentication token - you should be passing a header called "Guacamole-Token" with the Guacamole authorization token. Guacamole does not generally use the "Authorization" header. CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier') if [ "$CONNECTION_ID" != "null" ]; then URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN " echo "Connection ID: $CONNECTION_ID" echo "URL: $URL" else echo "Error creating connection." fi Two issues, here: * We've removed the ?token= parameter in recent versions in favor of a model that prefers/uses a header, instead, so you should leave off the token= part of this. * Your path for the connection (/client/$CONNECTION_ID) won't work - the client identifier is not the same as the connection ID, but is, instead, a base 64 encoding of the type of connection (connection or connection group), the data source (pgsql, mysql, etc.), and the connection identifier. See: github.com https://github.com/apache/guacamole-client/blob/22fe53fde50fd139cb86091912e1ae50d348add8/guacamole/src/main/frontend/src/app/navigation/types/ClientIdentifier.js#L40-L71 -Nick
RE: Re: Re: Re: REST API - Create URL connection (Permission Denied)
Posted by "i.noska@wp.pl" <i....@wp.pl>.
Hi Russell, Nick, Team, Could you help to solve this issue? Probably the URL is incorrect. Thank you in advance. I added some "echo" lines to see output: ------------------------------------------ echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" This is my result now: ----------------------- TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D RESPONSE: {"message":"Unexpected internal error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"} IDENTIFIER: null Client Identifier: Error creating connection. Is is correct now? It looks like the "RESPONSE" curl URL is invalid?! The "permission denied" disappeared, but another error appeared. -- Best regards Marcin ------------------------------------------------- Dnia 11 lutego 2024 22:53 i.noska@wp.pl <i.noska@wp.pl> napisał(a): Hi Russell, I have a .NET application that already uses bash scripts and I would like to maintain this standard if possible. I checked provided GITHUB repo and I see that some updates were very long ago and the Readme.md file is empty - no documentation. Thank you for your help. -- Marcin --------------------------------------------------------------------------- Dnia 11 lutego 2024 00:17 Russell Sayers <russell.sayers@gmail.com> napisał(a): Hi MK, Is Python an option for you? I’ve used this API wrapper in the past: github.com https://github.com/pschmitt/guacapy Russ On Sun, Feb 11, 2024 at 01:38 i.noska@wp.pl < i.noska@wp.pl > wrote: I forgot to add the logs: DEBUG o.a.g.rest.RESTExceptionMapper - Unexpected error in REST endpoint. Feb 10 15:24:36 server[104645]: java.lang.NullPointerException: null "POST /guacamole/api/session/data/mysql/connections HTTP/1.1" 500 203 ----------- Regards MK ---------------------------- Dnia 10 lutego 2024 15:27 i.noska@wp.pl < i.noska@wp.pl > napisał(a): Hi Nick, Thank you for your response! I modified the script according to your information. ---------------------- SCRIPT ---------------------- #!/bin/bash # Obtain the Guacamole authentication token TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Define the API endpoint for creating connections in Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " # Define the connection data in JSON format CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' # Make a POST request to create a new connection using the Guacamole API RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Guacamole-Token: $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) # Extract the connection identifier from the response IDENTIFIER=$(echo "$RESPONSE" | jq -r '.identifier') if [ "$IDENTIFIER" != "null" ]; then # Construct the base64url-encoded client identifier CLIENT_IDENTIFIER=$(echo -n "{\"id\":\"$IDENTIFIER\",\"type\":\"c\",\"dataSource\":\"mysql\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=') URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CLIENT_IDENTIFIER " echo "Client Identifier: $CLIENT_IDENTIFIER" echo "URL: $URL" else echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" echo "Error creating connection." fi ---------------------- SCRIPT END ---------------------- I added some "echo" lines to see output: ------------------------------------------ echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" This is my result now: ----------------------- TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D RESPONSE: {"message":"Unexpected internal error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"} IDENTIFIER: null Client Identifier: Error creating connection. Is is correct now? It looks like the "RESPONSE" curl URL is invalid?! The "permission denied" disappeared, but another error appeared. ------------------------------------- Thank you for your help. -- MK Dnia 09 lutego 2024 16:47 Nick Couchman < vnick@apache.org > napisał(a): On Fri, Feb 9, 2024 at 6:46 AM i.noska@wp.pl < i.noska@wp.pl > wrote: Hello, I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to login to GUI, create users, connection, etc. I installed database (MySQL) as well (to manage users, connection) with all needed *.jar files according to doc guacamole.apache.org https://guacamole.apache.org/doc/gug/jdbc-auth.html After that, I'm able to login as ""guacadmin" user to GUI and manage connections etc. Now, I want to create URL to direct connection to my VM, but I found errors like below: ------------------------------ SCRIPT ------------------------------------- #!/bin/bash TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Endpoint API Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) I don't think you're using the correct header, here for the Guacamole authentication token - you should be passing a header called "Guacamole-Token" with the Guacamole authorization token. Guacamole does not generally use the "Authorization" header. CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier') if [ "$CONNECTION_ID" != "null" ]; then URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN " echo "Connection ID: $CONNECTION_ID" echo "URL: $URL" else echo "Error creating connection." fi Two issues, here: * We've removed the ?token= parameter in recent versions in favor of a model that prefers/uses a header, instead, so you should leave off the token= part of this. * Your path for the connection (/client/$CONNECTION_ID) won't work - the client identifier is not the same as the connection ID, but is, instead, a base 64 encoding of the type of connection (connection or connection group), the data source (pgsql, mysql, etc.), and the connection identifier. See: github.com https://github.com/apache/guacamole-client/blob/22fe53fde50fd139cb86091912e1ae50d348add8/guacamole/src/main/frontend/src/app/navigation/types/ClientIdentifier.js#L40-L71 -Nick
Odp: Re: Re: Re: REST API - Create URL connection (Permission Denied)
Posted by "i.noska@wp.pl" <i....@wp.pl>.
Hi Russell, I have a .NET application that already uses bash scripts and I would like to maintain this standard if possible. I checked provided GITHUB repo and I see that some updates were very long ago and the Readme.md file is empty - no documentation. Thank you for your help. -- Marcin --------------------------------------------------------------------------- Dnia 11 lutego 2024 00:17 Russell Sayers <russell.sayers@gmail.com> napisał(a): Hi MK, Is Python an option for you? I’ve used this API wrapper in the past: github.com https://github.com/pschmitt/guacapy Russ On Sun, Feb 11, 2024 at 01:38 i.noska@wp.pl < i.noska@wp.pl > wrote: I forgot to add the logs: DEBUG o.a.g.rest.RESTExceptionMapper - Unexpected error in REST endpoint. Feb 10 15:24:36 server[104645]: java.lang.NullPointerException: null "POST /guacamole/api/session/data/mysql/connections HTTP/1.1" 500 203 ----------- Regards MK ---------------------------- Dnia 10 lutego 2024 15:27 i.noska@wp.pl < i.noska@wp.pl > napisał(a): Hi Nick, Thank you for your response! I modified the script according to your information. ---------------------- SCRIPT ---------------------- #!/bin/bash # Obtain the Guacamole authentication token TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Define the API endpoint for creating connections in Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " # Define the connection data in JSON format CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' # Make a POST request to create a new connection using the Guacamole API RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Guacamole-Token: $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) # Extract the connection identifier from the response IDENTIFIER=$(echo "$RESPONSE" | jq -r '.identifier') if [ "$IDENTIFIER" != "null" ]; then # Construct the base64url-encoded client identifier CLIENT_IDENTIFIER=$(echo -n "{\"id\":\"$IDENTIFIER\",\"type\":\"c\",\"dataSource\":\"mysql\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=') URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CLIENT_IDENTIFIER " echo "Client Identifier: $CLIENT_IDENTIFIER" echo "URL: $URL" else echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" echo "Error creating connection." fi ---------------------- SCRIPT END ---------------------- I added some "echo" lines to see output: ------------------------------------------ echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" This is my result now: ----------------------- TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D RESPONSE: {"message":"Unexpected internal error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"} IDENTIFIER: null Client Identifier: Error creating connection. Is is correct now? It looks like the "RESPONSE" curl URL is invalid?! The "permission denied" disappeared, but another error appeared. ------------------------------------- Thank you for your help. -- MK Dnia 09 lutego 2024 16:47 Nick Couchman < vnick@apache.org > napisał(a): On Fri, Feb 9, 2024 at 6:46 AM i.noska@wp.pl < i.noska@wp.pl > wrote: Hello, I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to login to GUI, create users, connection, etc. I installed database (MySQL) as well (to manage users, connection) with all needed *.jar files according to doc guacamole.apache.org https://guacamole.apache.org/doc/gug/jdbc-auth.html After that, I'm able to login as ""guacadmin" user to GUI and manage connections etc. Now, I want to create URL to direct connection to my VM, but I found errors like below: ------------------------------ SCRIPT ------------------------------------- #!/bin/bash TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Endpoint API Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) I don't think you're using the correct header, here for the Guacamole authentication token - you should be passing a header called "Guacamole-Token" with the Guacamole authorization token. Guacamole does not generally use the "Authorization" header. CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier') if [ "$CONNECTION_ID" != "null" ]; then URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN " echo "Connection ID: $CONNECTION_ID" echo "URL: $URL" else echo "Error creating connection." fi Two issues, here: * We've removed the ?token= parameter in recent versions in favor of a model that prefers/uses a header, instead, so you should leave off the token= part of this. * Your path for the connection (/client/$CONNECTION_ID) won't work - the client identifier is not the same as the connection ID, but is, instead, a base 64 encoding of the type of connection (connection or connection group), the data source (pgsql, mysql, etc.), and the connection identifier. See: github.com https://github.com/apache/guacamole-client/blob/22fe53fde50fd139cb86091912e1ae50d348add8/guacamole/src/main/frontend/src/app/navigation/types/ClientIdentifier.js#L40-L71 -Nick
Re: Re: Re: REST API - Create URL connection (Permission Denied)
Posted by Russell Sayers <ru...@gmail.com>.
Hi MK,
Is Python an option for you? I’ve used this API wrapper in the past:
https://github.com/pschmitt/guacapy
Russ
On Sun, Feb 11, 2024 at 01:38 i.noska@wp.pl <i....@wp.pl> wrote:
> I forgot to add the logs:
>
> DEBUG o.a.g.rest.RESTExceptionMapper - Unexpected error in REST endpoint.
> Feb 10 15:24:36 server[104645]: java.lang.NullPointerException: null
>
> "POST /guacamole/api/session/data/mysql/connections HTTP/1.1" 500 203
>
> -----------
> Regards
> MK
>
> ----------------------------
>
> Dnia 10 lutego 2024 15:27 i.noska@wp.pl <i....@wp.pl> napisał(a):
>
> Hi Nick,
>
> Thank you for your response!
> I modified the script according to your information.
>
> *---------------------- SCRIPT ----------------------*
> #!/bin/bash
>
> # Obtain the Guacamole authentication token
> TOKEN=$(curl -s -X POST -H "Content-Type:
> application/x-www-form-urlencoded" -d
> "username=guacadmin&password=guacadmin"
> http://localhost:8080/guacamole/api/tokens | jq -r '.authToken')
>
> # Define the API endpoint for creating connections in Guacamole
> API_ENDPOINT="
> http://localhost:8080/guacamole/api/session/data/mysql/connections"
>
> # Define the connection data in JSON format
> CONNECTION_DATA='{
> "name": "Connection name",
> "protocol": "rdp",
> "parameters": {
> "hostname": "10.194.53.45",
> "port": "3389",
> "username": "user",
> "password": "password"
> }
> }'
>
> # Make a POST request to create a new connection using the Guacamole API
> RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H
> "Guacamole-Token: $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT)
>
> # Extract the connection identifier from the response
> IDENTIFIER=$(echo "$RESPONSE" | jq -r '.identifier')
>
> if [ "$IDENTIFIER" != "null" ]; then
> # Construct the base64url-encoded client identifier
> CLIENT_IDENTIFIER=$(echo -n
> "{\"id\":\"$IDENTIFIER\",\"type\":\"c\",\"dataSource\":\"mysql\"}" | base64
> -w0 | tr '+/' '-_' | tr -d '=')
> URL="http://localhost:8080/guacamole/#/client/$CLIENT_IDENTIFIER"
> echo "Client Identifier: $CLIENT_IDENTIFIER"
> echo "URL: $URL"
> else
> echo -e "TOKEN: $TOKEN"
> echo -e "RESPONSE: $RESPONSE"
> echo -e "IDENTIFIER: $IDENTIFIER"
> echo -e "Client Identifier: $CLIENT_IDENTIFIER"
> echo "Error creating connection."
> fi
> ---------------------- SCRIPT END ----------------------
>
> *I added some "echo" lines to see output:*
> *------------------------------------------*
> echo -e "TOKEN: $TOKEN"
> echo -e "RESPONSE: $RESPONSE"
> echo -e "IDENTIFIER: $IDENTIFIER"
> echo -e "Client Identifier: $CLIENT_IDENTIFIER"
>
> *This is my result now:*
> *-----------------------*
> TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D
> RESPONSE: {"message":"Unexpected internal
> error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected
> internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"}
> IDENTIFIER: null
> Client Identifier:
> Error creating connection.
>
> Is is correct now? It looks like the "RESPONSE" curl URL is invalid?!
> The "permission denied" disappeared, but another error appeared.
> *-------------------------------------*
> *Thank you for your help.*
> --
> MK
>
>
>
>
> Dnia 09 lutego 2024 16:47 Nick Couchman <vn...@apache.org> napisał(a):
>
> On Fri, Feb 9, 2024 at 6:46 AM i.noska@wp.pl <i....@wp.pl> wrote:
>
> Hello,
>
> I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to
> login to GUI, create users, connection, etc.
> I installed database (MySQL) as well (to manage users, connection) with
> all needed *.jar files according to doc
> https://guacamole.apache.org/doc/gug/jdbc-auth.html
>
> After that, I'm able to login as ""guacadmin" user to GUI and manage
> connections etc.
>
> Now, I want to create URL to direct connection to my VM, but I found
> errors like below:
>
> ------------------------------ SCRIPT
> -------------------------------------
> #!/bin/bash
>
> TOKEN=$(curl -s -X POST -H "Content-Type:
> application/x-www-form-urlencoded" -d
> "username=guacadmin&password=guacadmin"
> http://localhost:8080/guacamole/api/tokens | jq -r '.authToken')
>
> # Endpoint API Guacamole
> API_ENDPOINT="
> http://localhost:8080/guacamole/api/session/data/mysql/connections"
>
> CONNECTION_DATA='{
> "name": "Connection name",
> "protocol": "rdp",
> "parameters": {
> "hostname": "10.194.53.45",
> "port": "3389",
> "username": "user",
> "password": "password"
> }
> }'
>
> RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H
> "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT)
>
>
> I don't think you're using the correct header, here for the Guacamole
> authentication token - you should be passing a header called
> "Guacamole-Token" with the Guacamole authorization token. Guacamole does
> not generally use the "Authorization" header.
>
>
>
> CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier')
>
> if [ "$CONNECTION_ID" != "null" ]; then
> URL="
> http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN"
> echo "Connection ID: $CONNECTION_ID"
> echo "URL: $URL"
> else
> echo "Error creating connection."
> fi
>
>
> Two issues, here:
> * We've removed the ?token= parameter in recent versions in favor of a
> model that prefers/uses a header, instead, so you should leave off the
> token= part of this.
> * Your path for the connection (/client/$CONNECTION_ID) won't work - the
> client identifier is not the same as the connection ID, but is, instead, a
> base 64 encoding of the type of connection (connection or connection
> group), the data source (pgsql, mysql, etc.), and the connection
> identifier. See:
> https://github.com/apache/guacamole-client/blob/22fe53fde50fd139cb86091912e1ae50d348add8/guacamole/src/main/frontend/src/app/navigation/types/ClientIdentifier.js#L40-L71
>
> -Nick
>
>
>
>
Odp: Re: Re: REST API - Create URL connection (Permission Denied)
Posted by "i.noska@wp.pl" <i....@wp.pl>.
I forgot to add the logs: DEBUG o.a.g.rest.RESTExceptionMapper - Unexpected error in REST endpoint. Feb 10 15:24:36 server[104645]: java.lang.NullPointerException: null "POST /guacamole/api/session/data/mysql/connections HTTP/1.1" 500 203 ----------- Regards MK ---------------------------- Dnia 10 lutego 2024 15:27 i.noska@wp.pl <i.noska@wp.pl> napisał(a): Hi Nick, Thank you for your response! I modified the script according to your information. ---------------------- SCRIPT ---------------------- #!/bin/bash # Obtain the Guacamole authentication token TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Define the API endpoint for creating connections in Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " # Define the connection data in JSON format CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' # Make a POST request to create a new connection using the Guacamole API RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Guacamole-Token: $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) # Extract the connection identifier from the response IDENTIFIER=$(echo "$RESPONSE" | jq -r '.identifier') if [ "$IDENTIFIER" != "null" ]; then # Construct the base64url-encoded client identifier CLIENT_IDENTIFIER=$(echo -n "{\"id\":\"$IDENTIFIER\",\"type\":\"c\",\"dataSource\":\"mysql\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=') URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CLIENT_IDENTIFIER " echo "Client Identifier: $CLIENT_IDENTIFIER" echo "URL: $URL" else echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" echo "Error creating connection." fi ---------------------- SCRIPT END ---------------------- I added some "echo" lines to see output: ------------------------------------------ echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" This is my result now: ----------------------- TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D RESPONSE: {"message":"Unexpected internal error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"} IDENTIFIER: null Client Identifier: Error creating connection. Is is correct now? It looks like the "RESPONSE" curl URL is invalid?! The "permission denied" disappeared, but another error appeared. ------------------------------------- Thank you for your help. -- MK Dnia 09 lutego 2024 16:47 Nick Couchman <vnick@apache.org> napisał(a): On Fri, Feb 9, 2024 at 6:46 AM i.noska@wp.pl < i.noska@wp.pl > wrote: Hello, I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to login to GUI, create users, connection, etc. I installed database (MySQL) as well (to manage users, connection) with all needed *.jar files according to doc guacamole.apache.org https://guacamole.apache.org/doc/gug/jdbc-auth.html After that, I'm able to login as ""guacadmin" user to GUI and manage connections etc. Now, I want to create URL to direct connection to my VM, but I found errors like below: ------------------------------ SCRIPT ------------------------------------- #!/bin/bash TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Endpoint API Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) I don't think you're using the correct header, here for the Guacamole authentication token - you should be passing a header called "Guacamole-Token" with the Guacamole authorization token. Guacamole does not generally use the "Authorization" header. CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier') if [ "$CONNECTION_ID" != "null" ]; then URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN " echo "Connection ID: $CONNECTION_ID" echo "URL: $URL" else echo "Error creating connection." fi Two issues, here: * We've removed the ?token= parameter in recent versions in favor of a model that prefers/uses a header, instead, so you should leave off the token= part of this. * Your path for the connection (/client/$CONNECTION_ID) won't work - the client identifier is not the same as the connection ID, but is, instead, a base 64 encoding of the type of connection (connection or connection group), the data source (pgsql, mysql, etc.), and the connection identifier. See: github.com https://github.com/apache/guacamole-client/blob/22fe53fde50fd139cb86091912e1ae50d348add8/guacamole/src/main/frontend/src/app/navigation/types/ClientIdentifier.js#L40-L71 -Nick
Re: Re: REST API - Create URL connection (Permission Denied)
Posted by "i.noska@wp.pl" <i....@wp.pl>.
Hi Nick, Thank you for your response! I modified the script according to your information. ---------------------- SCRIPT ---------------------- #!/bin/bash # Obtain the Guacamole authentication token TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Define the API endpoint for creating connections in Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " # Define the connection data in JSON format CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' # Make a POST request to create a new connection using the Guacamole API RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Guacamole-Token: $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) # Extract the connection identifier from the response IDENTIFIER=$(echo "$RESPONSE" | jq -r '.identifier') if [ "$IDENTIFIER" != "null" ]; then # Construct the base64url-encoded client identifier CLIENT_IDENTIFIER=$(echo -n "{\"id\":\"$IDENTIFIER\",\"type\":\"c\",\"dataSource\":\"mysql\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=') URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CLIENT_IDENTIFIER " echo "Client Identifier: $CLIENT_IDENTIFIER" echo "URL: $URL" else echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" echo "Error creating connection." fi ---------------------- SCRIPT END ---------------------- I added some "echo" lines to see output: ------------------------------------------ echo -e "TOKEN: $TOKEN" echo -e "RESPONSE: $RESPONSE" echo -e "IDENTIFIER: $IDENTIFIER" echo -e "Client Identifier: $CLIENT_IDENTIFIER" This is my result now: ----------------------- TOKEN: C789F89578D3D7F7956307C26FD24410DEF12D4403495A9E2FBA43E31F92557D RESPONSE: {"message":"Unexpected internal error","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Unexpected internal error"}},"statusCode":null,"expected":null,"type":"INTERNAL_ERROR"} IDENTIFIER: null Client Identifier: Error creating connection. Is is correct now? It looks like the "RESPONSE" curl URL is invalid?! The "permission denied" disappeared, but another error appeared. ------------------------------------- Thank you for your help. -- MK Dnia 09 lutego 2024 16:47 Nick Couchman <vnick@apache.org> napisał(a): On Fri, Feb 9, 2024 at 6:46 AM i.noska@wp.pl < i.noska@wp.pl > wrote: Hello, I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to login to GUI, create users, connection, etc. I installed database (MySQL) as well (to manage users, connection) with all needed *.jar files according to doc guacamole.apache.org https://guacamole.apache.org/doc/gug/jdbc-auth.html After that, I'm able to login as ""guacadmin" user to GUI and manage connections etc. Now, I want to create URL to direct connection to my VM, but I found errors like below: ------------------------------ SCRIPT ------------------------------------- #!/bin/bash TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Endpoint API Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) I don't think you're using the correct header, here for the Guacamole authentication token - you should be passing a header called "Guacamole-Token" with the Guacamole authorization token. Guacamole does not generally use the "Authorization" header. CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier') if [ "$CONNECTION_ID" != "null" ]; then URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN " echo "Connection ID: $CONNECTION_ID" echo "URL: $URL" else echo "Error creating connection." fi Two issues, here: * We've removed the ?token= parameter in recent versions in favor of a model that prefers/uses a header, instead, so you should leave off the token= part of this. * Your path for the connection (/client/$CONNECTION_ID) won't work - the client identifier is not the same as the connection ID, but is, instead, a base 64 encoding of the type of connection (connection or connection group), the data source (pgsql, mysql, etc.), and the connection identifier. See: github.com https://github.com/apache/guacamole-client/blob/22fe53fde50fd139cb86091912e1ae50d348add8/guacamole/src/main/frontend/src/app/navigation/types/ClientIdentifier.js#L40-L71 -Nick
Re: REST API - Create URL connection (Permission Denied)
Posted by Nick Couchman <vn...@apache.org>.
On Fri, Feb 9, 2024 at 6:46 AM i.noska@wp.pl <i....@wp.pl> wrote:
> Hello,
>
> I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to
> login to GUI, create users, connection, etc.
> I installed database (MySQL) as well (to manage users, connection) with
> all needed *.jar files according to doc
> https://guacamole.apache.org/doc/gug/jdbc-auth.html
>
> After that, I'm able to login as ""guacadmin" user to GUI and manage
> connections etc.
>
> Now, I want to create URL to direct connection to my VM, but I found
> errors like below:
>
> ------------------------------ SCRIPT
> -------------------------------------
> #!/bin/bash
>
> TOKEN=$(curl -s -X POST -H "Content-Type:
> application/x-www-form-urlencoded" -d
> "username=guacadmin&password=guacadmin"
> http://localhost:8080/guacamole/api/tokens | jq -r '.authToken')
>
> # Endpoint API Guacamole
> API_ENDPOINT="
> http://localhost:8080/guacamole/api/session/data/mysql/connections"
>
> CONNECTION_DATA='{
> "name": "Connection name",
> "protocol": "rdp",
> "parameters": {
> "hostname": "10.194.53.45",
> "port": "3389",
> "username": "user",
> "password": "password"
> }
> }'
>
> RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H
> "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT)
>
>
I don't think you're using the correct header, here for the Guacamole
authentication token - you should be passing a header called
"Guacamole-Token" with the Guacamole authorization token. Guacamole does
not generally use the "Authorization" header.
> CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier')
>
> if [ "$CONNECTION_ID" != "null" ]; then
> URL="
> http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN"
> echo "Connection ID: $CONNECTION_ID"
> echo "URL: $URL"
> else
> echo "Error creating connection."
> fi
>
>
Two issues, here:
* We've removed the ?token= parameter in recent versions in favor of a
model that prefers/uses a header, instead, so you should leave off the
token= part of this.
* Your path for the connection (/client/$CONNECTION_ID) won't work - the
client identifier is not the same as the connection ID, but is, instead, a
base 64 encoding of the type of connection (connection or connection
group), the data source (pgsql, mysql, etc.), and the connection
identifier. See:
https://github.com/apache/guacamole-client/blob/22fe53fde50fd139cb86091912e1ae50d348add8/guacamole/src/main/frontend/src/app/navigation/types/ClientIdentifier.js#L40-L71
-Nick
>
REST API - Create URL connection (Permission Denied)
Posted by "i.noska@wp.pl" <i....@wp.pl>.
Hello, I've installed Apache Guacamole v.1.5.4 on Linux CentOS 8.5 - I'm able to login to GUI, create users, connection, etc. I installed database (MySQL) as well (to manage users, connection) with all needed *.jar files according to doc guacamole.apache.org https://guacamole.apache.org/doc/gug/jdbc-auth.html After that, I'm able to login as ""guacadmin" user to GUI and manage connections etc. Now, I want to create URL to direct connection to my VM, but I found errors like below: ------------------------------ SCRIPT ------------------------------------- #!/bin/bash TOKEN=$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=guacadmin&password=guacadmin" localhost:8080 http://localhost:8080/guacamole/api/tokens | jq -r '.authToken') # Endpoint API Guacamole API_ENDPOINT=" localhost:8080 http://localhost:8080/guacamole/api/session/data/mysql/connections " CONNECTION_DATA='{ "name": "Connection name", "protocol": "rdp", "parameters": { "hostname": "10.194.53.45", "port": "3389", "username": "user", "password": "password" } }' RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$CONNECTION_DATA" $API_ENDPOINT) CONNECTION_ID=$(echo $RESPONSE | jq -r '.identifier') if [ "$CONNECTION_ID" != "null" ]; then URL=" localhost:8080 http://localhost:8080/guacamole/#/client/$CONNECTION_ID?token=$TOKEN " echo "Connection ID: $CONNECTION_ID" echo "URL: $URL" else echo "Error creating connection." fi ------------------------------ OUTPUT ------------------------------------ Response: {"message":"Permission Denied.","translatableMessage":{"key":"APP.TEXT_UNTRANSLATED","variables":{"MESSAGE":"Permission Denied."}},"statusCode":null,"expected":null,"type":"PERMISSION_DENIED"} Error creating connection. ------------------------------ OUTPUT END ------------------------------- ---------------------------------- L O G S ---------------------------------- Apache Tomcat & system messages: 0:0:0:0:0:0:0:1 - - [09/Feb/2024:12:32:36 +0100] "GET /guacamole/api/session/data/mysql/users/self HTTP/1.1" 403 192 0:0:0:0:0:0:0:1 - - [09/Feb/2024:12:32:36 +0100] "GET /guacamole/api/session/data/mysql/users/self HTTP/1.1" 403 192 Feb 9 12:32:36 server[90877]: 12:32:36.207 [http-nio-8080-exec-7] DEBUG o.a.i.t.jdbc.JdbcTransaction - Committing JDBC Connection [com.mysql.cj.jdbc.ConnectionImpl@7c9de5c2] Feb 9 12:32:36 server[90877]: 12:32:36.212 [http-nio-8080-exec-7] DEBUG o.a.i.t.jdbc.JdbcTransaction - Resetting autocommit to true on JDBC Connection [com.mysql.cj.jdbc.ConnectionImpl@7c9de5c2] Feb 9 12:32:36 server[90877]: 12:32:36.213 [http-nio-8080-exec-7] DEBUG o.a.i.t.jdbc.JdbcTransaction - Closing JDBC Connection [com.mysql.cj.jdbc.ConnectionImpl@7c9de5c2] Feb 9 12:32:36 server[90877]: 12:32:36.213 [http-nio-8080-exec-7] DEBUG o.a.i.d.pooled.PooledDataSource - Testing connection 2090722754 ... Feb 9 12:32:36 server[90877]: 12:32:36.214 [http-nio-8080-exec-7] DEBUG o.a.i.d.pooled.PooledDataSource - Connection 2090722754 is GOOD! Feb 9 12:32:36 server[90877]: 12:32:36.214 [http-nio-8080-exec-7] DEBUG o.a.i.d.pooled.PooledDataSource - Returned connection 2090722754 to pool. Feb 9 12:32:36 server[90877]: 12:32:36.214 [http-nio-8080-exec-7] DEBUG o.a.g.r.auth.AuthenticationService - Login was successful for user "guacadmin". Feb 9 12:32:36 server[90877]: 12:32:36.230 [http-nio-8080-exec-8] DEBUG o.a.g.rest.RESTExceptionMapper - Client request rejected: Permission Denied. ---------------------------------- L O G S END ---------------------------------- MESSAGE: DEBUG o.a.g.rest.RESTExceptionMapper - Client request rejected: Permission Denied. -------------- DATABASE INFO (Permission) ------------------------------------ mysql> SELECT * FROM guacamole_entity JOIN guacamole_user_permission ON guacamole_entity.entity_id = guacamole_user_permission.entity_id WHERE guacamole_entity.name = 'guacadmin'; +-----------+-----------+------+-----------+------------------+------------+ | entity_id | name | type | entity_id | affected_user_id | permission | +-----------+-----------+------+-----------+------------------+------------+ | 1 | guacadmin | USER | 1 | 1 | READ | | 1 | guacadmin | USER | 1 | 1 | UPDATE | | 1 | guacadmin | USER | 1 | 1 | ADMINISTER | | 1 | guacadmin | USER | 1 | 2 | READ | | 1 | guacadmin | USER | 1 | 2 | UPDATE | | 1 | guacadmin | USER | 1 | 2 | DELETE | | 1 | guacadmin | USER | 1 | 2 | ADMINISTER | +-----------+-----------+------+-----------+------------------+------------+ I want to be able to dynamically create a URL after clicking on it, which will open the VM window in browser (without having to enter parameters, username or password). -- THANK YOU FOR HELP! Best Regards, Marcin
Dnia 18 stycznia 2024 12:41 Nick Couchman <vnick@apache.org> napisał(a):
On Thu, Jan 18, 2024 at 1:03 AM anoop yadav < anoophky@gmail.com > wrote: I am trying to build a Web app where users can create multiple Ubuntu instances and use them through my web app. The domain for my web app is example-app.com example-app.com which is written in reactjs. I have hosted guacamole clients on separate subdomains lab.example-app.com lab.example-app.com . In the reactjs app, I am using the Iframe (Not sure if there is any other way) to show lab.example-app.com lab.example-app.com (guacamole client app), since I don't want the user to do another login on the guacamole app. I am planning to use a token. My current logic is as follows: 1. When the user creates an account (the backend is in Django-python) I make a rest API request to create an account, get a token from guacamole and save it to the web app database. 2. When the user creates an Ubuntu instance, using the rest API I create a connection and associate the user with it. I save a URL like lab.example-app.com lab.example-app.com/guacamole/#/client/ <CONNECTION>?token=<TOKEN> Everything works fine, the user can access multiple connections but since the token has a lifetime, and after that time the URL is not working. To be clear, the token does not have a lifetime, it has an *idle lifetime* - that is, it times out after a certain period of inactivity. As long as the Guacamole instance is being used - for an active connection, for example - the token will remain valid. How do I manage the token so that it doesn't expire? You can set the api-session-timeout property in guacamole.properties to adjust the *idle lifetime* of the token - see guacamole.apache.org https://guacamole.apache.org/doc/gug/configuring-guacamole.html#guacamole-properties . That said, I don't think you really want it to never expire - at least, from a security perspective, I would not recommend that, even if you're doing some other cleanup of the tokens from your web application. You may want to extend it such that it more closely fits in with your use case, but setting it to either never expire (which isn't really possible) or even a very long idle time just adds security risk to the application. -Nick
Re: Token Management
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Jan 18, 2024 at 7:08 AM anoop yadav <an...@gmail.com> wrote:
> Thanks for pointing that out, I will update the logic to update the user
> token when the user tries to connect to the Ubuntu instance rather than
> during account creation (I can also add the check if the last token was
> generated within 60 min so don't generate a new token etc), but I have a
> question if the user already has a previous connection active on a
> different instance with previous token and he connects to a new instance on
> a new tab and get the new token will his previous connection get
> disconnected automatically? (If he refreshes the page he will get the new
> token from the web app, but will his previous connection get force
> disconnected).
>
>
I'm not certain, but I do not believe that there is anything that prevents
a user from getting/using two tokens from the same system, so, no, this
should not result in a disconnect.
-Nick
>
Re: Token Management
Posted by anoop yadav <an...@gmail.com>.
Thanks for pointing that out, I will update the logic to update the user
token when the user tries to connect to the Ubuntu instance rather than
during account creation (I can also add the check if the last token was
generated within 60 min so don't generate a new token etc), but I have a
question if the user already has a previous connection active on a
different instance with previous token and he connects to a new instance on
a new tab and get the new token will his previous connection get
disconnected automatically? (If he refreshes the page he will get the new
token from the web app, but will his previous connection get force
disconnected).
On Thu, Jan 18, 2024 at 5:10 PM Nick Couchman <vn...@apache.org> wrote:
> On Thu, Jan 18, 2024 at 1:03 AM anoop yadav <an...@gmail.com> wrote:
>
>> I am trying to build a Web app where users can create multiple Ubuntu
>> instances and use them through my web app. The domain for my web app is
>> example-app.com which is written in reactjs. I have hosted guacamole
>> clients on separate subdomains lab.example-app.com.
>>
>> In the reactjs app, I am using the Iframe (Not sure if there is any other
>> way) to show lab.example-app.com (guacamole client app), since I don't
>> want the user to do another login on the guacamole app. I am planning to
>> use a token. My current logic is as follows:
>>
>> 1. When the user creates an account (the backend is in Django-python) I
>> make a rest API request to create an account, get a token from guacamole
>> and save it to the web app database.
>> 2. When the user creates an Ubuntu instance, using the rest API I create
>> a connection and associate the user with it. I save a URL like
>> lab.example-app.com/guacamole/#/client/<CONNECTION>?token=<TOKEN>
>>
>>
>> Everything works fine, the user can access multiple connections but since
>> the token has a lifetime, and after that time the URL is not working.
>>
>>
> To be clear, the token does not have a lifetime, it has an *idle lifetime*
> - that is, it times out after a certain period of inactivity. As long as
> the Guacamole instance is being used - for an active connection, for
> example - the token will remain valid.
>
>
>>
>> How do I manage the token so that it doesn't expire?
>>
>
> You can set the api-session-timeout property in guacamole.properties to
> adjust the *idle lifetime* of the token - see
> https://guacamole.apache.org/doc/gug/configuring-guacamole.html#guacamole-properties
> .
>
> That said, I don't think you really want it to never expire - at least,
> from a security perspective, I would not recommend that, even if you're
> doing some other cleanup of the tokens from your web application. You may
> want to extend it such that it more closely fits in with your use case, but
> setting it to either never expire (which isn't really possible) or even a
> very long idle time just adds security risk to the application.
>
> -Nick
>
Re: Token Management
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Jan 18, 2024 at 1:03 AM anoop yadav <an...@gmail.com> wrote:
> I am trying to build a Web app where users can create multiple Ubuntu
> instances and use them through my web app. The domain for my web app is
> example-app.com which is written in reactjs. I have hosted guacamole
> clients on separate subdomains lab.example-app.com.
>
> In the reactjs app, I am using the Iframe (Not sure if there is any other
> way) to show lab.example-app.com (guacamole client app), since I don't
> want the user to do another login on the guacamole app. I am planning to
> use a token. My current logic is as follows:
>
> 1. When the user creates an account (the backend is in Django-python) I
> make a rest API request to create an account, get a token from guacamole
> and save it to the web app database.
> 2. When the user creates an Ubuntu instance, using the rest API I create a
> connection and associate the user with it. I save a URL like
> lab.example-app.com/guacamole/#/client/<CONNECTION>?token=<TOKEN>
>
>
> Everything works fine, the user can access multiple connections but since
> the token has a lifetime, and after that time the URL is not working.
>
>
To be clear, the token does not have a lifetime, it has an *idle lifetime*
- that is, it times out after a certain period of inactivity. As long as
the Guacamole instance is being used - for an active connection, for
example - the token will remain valid.
>
> How do I manage the token so that it doesn't expire?
>
You can set the api-session-timeout property in guacamole.properties to
adjust the *idle lifetime* of the token - see
https://guacamole.apache.org/doc/gug/configuring-guacamole.html#guacamole-properties
.
That said, I don't think you really want it to never expire - at least,
from a security perspective, I would not recommend that, even if you're
doing some other cleanup of the tokens from your web application. You may
want to extend it such that it more closely fits in with your use case, but
setting it to either never expire (which isn't really possible) or even a
very long idle time just adds security risk to the application.
-Nick