SAML user attribute mapping

[ma...@linux-ng.de]

Hi there,

I just managed to get a authentication via SAML (simplesamlphp idp) working for guacamole.

As the documentation is missing some important information, it took quite a bit to get at least basic authentication working.
So - to save others some time - here's what I found:

The AssertionConsumerService (ACS) URL is guacamole base url +'api/ext/saml/callback'
 https://remote.mydomain.de/guacamole/api/ext/saml/callback

And my current guacamole config looks like this (not too much surprises here):

# ~/.guacamole/guacamole.properties
guacd-hostname: localhost
guacd-port: 4822
mysql-username: guacamole
mysql-password: myfinemysqlpassword
mysql-database: guacamole
mysql-hostname: localhost
mysql-port: 3306
mysql-auto-create-accounts: true
saml-entity-id: https://remote.mydomain.de/guacamole
saml-callback-url: https://remote.mydomain.de/guacamole
saml-idp-metadata-url: https://idp.mydomain.de/simplesaml/saml2/idp/metadata.php
saml-strict: false
saml-debug: true
saml-group-attribute: eduPersonAffiliation
extension-priority: saml

After modifying some idp settings basic authentication now works.
Username is also properly displayed and a user is created in the mysql database.

However some values like "full_name" or "email_adress" are NULL.
I couldn't find a description about which SAML attributes should be matched here.
I also could not see any effect of the 'saml-group-attribute' ...

Has someone done that successfully and could give some hints?

Thanx,
 Marcel