You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by "Molina de la Iglesia, Manuel" <ma...@veolia.com.INVALID> on 2023/07/14 07:02:17 UTC
The AssertionConsumerServices property is not configured for relying party trust
Hello,
After trying to configure an OpenID integration without success, I moved to
SAML.
My idp will be a local ADFS, at the moment the login page redirects to the
ADFS login, but after enter credentials I get the following error message:
" The AssertionConsumerServices property is not configured for relying
party trust"
I'm using a non claim aware relying party. Is that right? In case of a
claims-aware relying party, where could I find the XML file and where
should I specify the path of the certificate?
Thanks
*Manel Molina*
*manuel.molina-de-la-iglesia@veolia.com
<ma...@veolia.com>*
*Dirección de Ciberseguridad*
Ciutat de L’Aigua (D38)
Paseo de la Zona Franca, 48
08038 Barcelona / España
www.veolia.com
<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect2.fireeye.com%2Fv1%2Furl%3Fk%3D31323334-501d5122-31356fd6-454445555731-a8425f343e5c4fad%26q%3D1%26e%3D30530535-2971-48a4-8441-12c02ea4dc09%26u%3Dhttps%253A%252F%252Feur01.safelinks.protection.outlook.com%252F%253Furl%253Dhttp%25253A%25252F%25252Fwww.veolia.com%25252F%2526data%253D05%25257C01%25257Csergi.carmona%252540agbar.es%25257C4c93dad3808642dd7ec308da3ccb99ab%25257Cf4a12867922d4b9dbb859ee7898512a0%25257C0%25257C0%25257C637889142388029142%25257CUnknown%25257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%25253D%25257C3000%25257C%25257C%25257C%2526sdata%253DJJM7r2MgHUaiuJD%25252Bk2xlr3opNEFsJkp%25252Byh2MJq0XRS0%25253D%2526reserved%253D0&data=05%7C01%7Coriol.val%40agbar.es%7C8a3587bd93134628cf9908da4d2baf8e%7Cf4a12867922d4b9dbb859ee7898512a0%7C0%7C0%7C637907147446774859%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5Vjff2WWXgkB77AldZ5g116HPKmbRv1h5PRjQjH9k0o%3D&reserved=0>
Re: Using a PATCH request to remove logged users
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Jul 25, 2023 at 3:29 PM Gabriel Huerta Araujo
<hu...@globalhitss.com> wrote:
>
>
> >> Because that endpoint has not been implemented in the Guacamole Client code. The Token REST service only has two endpoints:
> >> * POST that takes credentials and produces a token, assuming the authentication succeeds.
> >> * DELETE with a single token that invalidates the token.
>
> Ok, I have to extend DirectoryResource to manage LoggedUsers? Something that looks like ActiveConnectionDirectoryResource class?
I don't think DirectoryResource is what you need to extend or change -
since the tokens are managed through TokenRESTService, I suspect
that's where you'll need to add the code.
>
> If yes, some link which clarifies how to do this stuff?
Nothing specific, no, but if you have a look at the REST API code, you
should see roughly how to do it.
That said, why do you need to do this with a PATCH call? The PATCH
seems like it is better-suited for doing multiple types of operations
(add/remove/update) for multiple objects in a single shot. All you're
trying to do is remove one or more tokens. It seems like you could
either:
* Write a REST API client to loop through tokens and use the existing
DELETE endpoint to delete them one at a time.
* Update the TokenRESTService class with a DELETE endpoint that takes
an array of tokens instead of a single token.
The first accomplishes removal of multiple tokens without any
modification to the Guacamole REST code, the second will allow you to
do a single REST call, if, for some reason, there's value in doing it
all in one shot.
-Nick
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
RE: Using a PATCH request to remove logged users
Posted by Gabriel Huerta Araujo <hu...@globalhitss.com>.
>> Because that endpoint has not been implemented in the Guacamole Client code. The Token REST service only has two endpoints:
>> * POST that takes credentials and produces a token, assuming the authentication succeeds.
>> * DELETE with a single token that invalidates the token.
Ok, I have to extend DirectoryResource to manage LoggedUsers? Something that looks like ActiveConnectionDirectoryResource class?
If yes, some link which clarifies how to do this stuff?
-- Gabriel
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: Using a PATCH request to remove logged users
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Jul 24, 2023 at 10:59 PM Gabriel Huerta Araujo
<hu...@globalhitss.com> wrote:
>
> I am trying to make a PATCH request in order to remove n tokens, as active connection does
>
> {headers: {…}, method: 'PATCH', url: 'api/tokens', data: Array(1)}
> data: Array(1)
> 0: {op: 'remove', path: '/9090FE7421EBADE951915BC458254C09CE021E3A5E8D37C377B5E4B476B40EDF'}
> length: 1
> [[Prototype]]:
> Array(0)
> headers:
> {Guacamole-Token: '9090FE7421EBADE951915BC458254C09CE021E3A5E8D37C377B5E4B476B40EDF'}
> method: "PATCH"
> url: "api/tokens"
>
> But it throws a 405 error (NOT ALLOWED).
>
> Why active connections are posible remove them like that, but no logged users?
Because that endpoint has not been implemented in the Guacamole Client
code. The Token REST service only has two endpoints:
* POST that takes credentials and produces a token, assuming the
authentication succeeds.
* DELETE with a single token that invalidates the token.
-Nick
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Using a PATCH request to remove logged users
Posted by Gabriel Huerta Araujo <hu...@globalhitss.com>.
I am trying to make a PATCH request in order to remove n tokens, as active connection does
{headers: {…}, method: 'PATCH', url: 'api/tokens', data: Array(1)}
data: Array(1)
0: {op: 'remove', path: '/9090FE7421EBADE951915BC458254C09CE021E3A5E8D37C377B5E4B476B40EDF'}
length: 1
[[Prototype]]:
Array(0)
headers:
{Guacamole-Token: '9090FE7421EBADE951915BC458254C09CE021E3A5E8D37C377B5E4B476B40EDF'}
method: "PATCH"
url: "api/tokens"
But it throws a 405 error (NOT ALLOWED).
Why active connections are posible remove them like that, but no logged users?
-Gabriel
Adding a page for managing logged users
Posted by Gabriel Huerta Araujo <hu...@globalhitss.com.INVALID>.
Hi
I am trying to create a page which I can see all logged users
I copycat all js files used for activeConnections
In fact, it looks similar to guacSettingsSession Angular module
angular.module('settings').directive('guacSettingsSessions', [function guacSettingsSessions() {
return {
// Element only
restrict: 'E',
replace: true,
scope: {
},
templateUrl: 'app/settings/templates/settingsSessions.html',
controller: ['$scope', '$injector', function settingsSessionsController($scope, $injector) {
// Required types
var ActiveConnectionWrapper = $injector.get('ActiveConnectionWrapper');
var ClientIdentifier = $injector.get('ClientIdentifier');
var ConnectionGroup = $injector.get('ConnectionGroup');
var SortOrder = $injector.get('SortOrder');
This is my logged users module:
angular.module('settings').directive('guacSettingsLogged', [function guacSettingsLogged() {
return {
// Element only
restrict: 'E',
replace: true,
scope: {
},
templateUrl: 'app/settings/templates/settingsLogged.html',
controller: ['$scope', '$injector', function settingsLoggedController($scope, $injector) {
// Required types
var LoggedUserWrapper = $injector.get('LoggedUserWrapper');
var SortOrder = $injector.get('SortOrder');
// Required services
var $filter = $injector.get('$filter');
var $translate = $injector.get('$translate');
var $q = $injector.get('$q');
var loggedUserService = $injector.get('loggedUserService');
var authenticationService = $injector.get('authenticationService');
var dataSourceService = $injector.get('dataSourceService');
var guacNotification = $injector.get('guacNotification');
var requestService = $injector.get('requestService');
Problem I have is when I run application, I only see menú option, but page similar to active Guacamole sessions page is not presented. I get below error:
Uncaught Error: Module parse failed: Unexpected token (355:0)
You may need an appropriate loader to handle this file type, currently no loaders are configured to process this file. See https://webpack.js.org/concepts#loaders
| };
|
> ]);
|
at Object.<anonymous> (guacamole.b4820a34a9f9a6b79d4a.js:43575:11)
at f (guacamole.b4820a34a9f9a6b79d4a.js:80:30)
at f (guacamole.b4820a34a9f9a6b79d4a.js:11718:9)
at guacamole.b4820a34a9f9a6b79d4a.js:211:31
at Array.forEach (<anonymous>)
at Object.<anonymous> (guacamole.b4820a34a9f9a6b79d4a.js:211:16)
at f (guacamole.b4820a34a9f9a6b79d4a.js:80:30)
at a (guacamole.b4820a34a9f9a6b79d4a.js:46:23)
at guacamole.b4820a34a9f9a6b79d4a.js:153:18
at guacamole.b4820a34a9f9a6b79d4a.js:1:10
jquery.min.js:2 Uncaught Error: [$injector:modulerr] http://errors.angularjs.org/1.8.2/$injector/modulerr?p0=index&p1=Error%3A%20%5B%24injector%3Amodulerr%5D%20http%3A%2F%2Ferrors.angularjs.org%2F1.8.2%2F%24injector%2Fmodulerr%3Fp0%3Dauth%26p1%3DError%253A%2520%255B%2524injector%253Amodulerr%255D%2520http%253A%252F%252Ferrors.angularjs.org%252F1.8.2%252F%2524injector%252Fmodulerr%253Fp0%253Dstorage%2526p1%253DError%25253A%252520%25255B%252524injector%25253Anomod%25255D%252520http%25253A%25252F%25252Ferrors.angularjs.org%25252F1.8.2%25252F%252524injector%25252Fnomod%25253Fp0%25253Dstorage%25250A%252520%252520%252520%252520at%252520http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A7%25253A168%25250A%252520%252520%252520%252520at%252520http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A26%25253A503%25250A%252520%252520%252520%252520at%252520b%252520(http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A26%25253A25)%25250A%252520%252520%252520%252520at%252520http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A26%25253A277%25250A%252520%252520%252520%252520at%252520http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A43%25253A201%25250A%252520%252520%252520%252520at%252520r%252520(http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A8%25253A76)%25250A%252520%252520%252520%252520at%252520g%252520(http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A43%25253A49)%25250A%252520%252520%252520%252520at%252520http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A43%25253A233%25250A%252520%252520%252520%252520at%252520r%252520(http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A8%25253A76)%25250A%252520%252520%252520%252520at%252520g%252520(http%25253A%25252F%25252F10.93.5.144%25253A8080%25252Fga%25252Fangular.min.js%25253A43%25253A49)%250A%2520%2520%2520%2520at%2520http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A7%253A168%250A%2520%2520%2520%2520at%2520http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A43%253A491%250A%2520%2520%2520%2520at%2520r%2520(http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A8%253A76)%250A%2520%2520%2520%2520at%2520g%2520(http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A43%253A49)%250A%2520%2520%2520%2520at%2520http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A43%253A233%250A%2520%2520%2520%2520at%2520r%2520(http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A8%253A76)%250A%2520%2520%2520%2520at%2520g%2520(http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A43%253A49)%250A%2520%2520%2520%2520at%2520http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A43%253A233%250A%2520%2520%2520%2520at%2520r%2520(http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A8%253A76)%250A%2520%2520%2520%2520at%2520g%2520(http%253A%252F%252F10.93.5.144%253A8080%252Fga%252Fangular.min.js%253A43%253A49)%0A%20%20%20%20at%20http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A7%3A168%0A%20%20%20%20at%20http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A43%3A491%0A%20%20%20%20at%20r%20(http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A8%3A76)%0A%20%20%20%20at%20g%20(http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A43%3A49)%0A%20%20%20%20at%20http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A43%3A233%0A%20%20%20%20at%20r%20(http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A8%3A76)%0A%20%20%20%20at%20g%20(http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A43%3A49)%0A%20%20%20%20at%20fb%20(http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A47%3A153)%0A%20%20%20%20at%20c%20(http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A22%3A57)%0A%20%20%20%20at%20Wc%20(http%3A%2F%2F10.93.5.144%3A8080%2Fga%2Fangular.min.js%3A22%3A370)
at angular.min.js:7:168
at angular.min.js:43:491
at r (angular.min.js:8:76)
at g (angular.min.js:43:49)
at fb (angular.min.js:47:153)
at c (angular.min.js:22:57)
at Wc (angular.min.js:22:370)
at Ee (angular.min.js:21:45)
at HTMLDocument.<anonymous> (angular.min.js:351:117)
at e (jquery.min.js:2:30038)
DevTools failed to load source map: Could not load content for http://10.93.5.144:8080/ga/angular.min.js.map: HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE
If I remove module file which I added, it works
It looks like a syntax error, but I do not find any problem.
What I need to do, in order to get this working?
Gabriel
-----Mensaje original-----
De: Michael Jumper <mj...@apache.org>
Enviado el: viernes, 14 de julio de 2023 10:53 a. m.
Para: user@guacamole.apache.org
Asunto: Re: The AssertionConsumerServices property is not configured for relying party trust
On 7/14/23 00:02, Molina de la Iglesia, Manuel wrote:
> Hello,
>
> After trying to configure an OpenID integration without success, I
> moved to SAML.
>
> My idp will be a local ADFS, at the moment the login page redirects to
> the ADFS login, but after enter credentials I get the following error
> message:
>
> " The AssertionConsumerServices property is not configured for relying
> party trust"
This error is from ADFS?
>
> I'm using a non claim aware relying party. Is that right? In case of a
> claims-aware relying party, where could I find the XML file and where
> should I specify the path of the certificate?
>
You would normally download the metadata XML file from your IdP - they should provide a link/button for this.
- Mike
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: The AssertionConsumerServices property is not configured for relying party trust
Posted by "Molina de la Iglesia, Manuel" <ma...@veolia.com.INVALID>.
Hello,
Yes, the error is from ADFS.
I know that you have to provide an XML from the ADFS (on the
saml-idp-metadata-url), but the previous error is configuring a non-claims
relying party, because when you set up a claims-aware relying party, you
also need to provide an XML of the application that I don't know where can
I find it.
Just to summarize, I need to know the steps to configure an Apache
Guacamole relying party on the ADFS side.
Thanks
*Manel Molina*
*manuel.molina-de-la-iglesia@veolia.com
<ma...@veolia.com>*
*Dirección de Ciberseguridad*
Ciutat de L’Aigua (D38)
Paseo de la Zona Franca, 48
08038 Barcelona / España
www.veolia.com
<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect2.fireeye.com%2Fv1%2Furl%3Fk%3D31323334-501d5122-31356fd6-454445555731-a8425f343e5c4fad%26q%3D1%26e%3D30530535-2971-48a4-8441-12c02ea4dc09%26u%3Dhttps%253A%252F%252Feur01.safelinks.protection.outlook.com%252F%253Furl%253Dhttp%25253A%25252F%25252Fwww.veolia.com%25252F%2526data%253D05%25257C01%25257Csergi.carmona%252540agbar.es%25257C4c93dad3808642dd7ec308da3ccb99ab%25257Cf4a12867922d4b9dbb859ee7898512a0%25257C0%25257C0%25257C637889142388029142%25257CUnknown%25257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%25253D%25257C3000%25257C%25257C%25257C%2526sdata%253DJJM7r2MgHUaiuJD%25252Bk2xlr3opNEFsJkp%25252Byh2MJq0XRS0%25253D%2526reserved%253D0&data=05%7C01%7Coriol.val%40agbar.es%7C8a3587bd93134628cf9908da4d2baf8e%7Cf4a12867922d4b9dbb859ee7898512a0%7C0%7C0%7C637907147446774859%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5Vjff2WWXgkB77AldZ5g116HPKmbRv1h5PRjQjH9k0o%3D&reserved=0>
El vie, 14 jul 2023 a las 18:53, Michael Jumper (<mj...@apache.org>)
escribió:
> On 7/14/23 00:02, Molina de la Iglesia, Manuel wrote:
> > Hello,
> >
> > After trying to configure an OpenID integration without success, I moved
> > to SAML.
> >
> > My idp will be a local ADFS, at the moment the login page redirects to
> > the ADFS login, but after enter credentials I get the following error
> > message:
> >
> > " The AssertionConsumerServices property is not configured for relying
> > party trust"
>
> This error is from ADFS?
>
> >
> > I'm using a non claim aware relying party. Is that right? In case of a
> > claims-aware relying party, where could I find the XML file and where
> > should I specify the path of the certificate?
> >
> You would normally download the metadata XML file from your IdP - they
> should provide a link/button for this.
>
> - Mike
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
> For additional commands, e-mail: user-help@guacamole.apache.org
>
>
Re: The AssertionConsumerServices property is not configured for relying party trust
Posted by Michael Jumper <mj...@apache.org>.
On 7/14/23 00:02, Molina de la Iglesia, Manuel wrote:
> Hello,
>
> After trying to configure an OpenID integration without success, I moved
> to SAML.
>
> My idp will be a local ADFS, at the moment the login page redirects to
> the ADFS login, but after enter credentials I get the following error
> message:
>
> " The AssertionConsumerServices property is not configured for relying
> party trust"
This error is from ADFS?
>
> I'm using a non claim aware relying party. Is that right? In case of a
> claims-aware relying party, where could I find the XML file and where
> should I specify the path of the certificate?
>
You would normally download the metadata XML file from your IdP - they
should provide a link/button for this.
- Mike
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org