Pulling groups from LDAP after OIDC login

[Ionel GARDAIS <io...@tech-advantage.com>]

Hi, 

I've setup guacamole with both LDAP and OIDC login. 
On their own, both works fine : 
- users can authenticate with LDAP and their groups are matched with DB groups 
- when OIDC is enable, users are redirected to the SSO login page and accepted by Guacamole 

However, OIDC plugin does not use the group array provided in the claim. 

Is there a way that, after OIDC login succeeded, an LDAP search will be triggered to fetch the user's groups ? 
(LDAP is set to use a proxy search user so their is no need to know the user's LDAP password for this) 

Alternatively, should it be better to get the groups from the OIDC claim ? 
This solution, albeit interesting, would lead to trust the OIDC provided groups, possibly allowing any users to be part of any groups. 

Thanks, 
Ionel 

--
232 avenue Napoleon BONAPARTE 92500 RUEIL MALMAISON
Capital EUR 219 300,00 - RCS Nanterre B 408 832 301 - TVA FR 09 408 832 301

Re: Pulling groups from LDAP after OIDC login

[Nick Couchman <vn...@apache.org>]

On Mon, May 25, 2020 at 3:47 AM Ionel GARDAIS <
ionel.gardais@tech-advantage.com> wrote:

> Hi,
>
> I've setup guacamole with both LDAP and OIDC login.
> On their own, both works fine :
> - users can authenticate with LDAP and their groups are matched with DB
> groups
> - when OIDC is enable, users are redirected to the SSO login page and
> accepted by Guacamole
>
> However, OIDC plugin does not use the group array provided in the claim.
>

Yeah, this is not currently implemented, but there are some JIRA issues out
there for allowing each of the SSO modules to do this, and at least one
change in the works (in the CAS module, i think).


>
> Is there a way that, after OIDC login succeeded, an LDAP search will be
> triggered to fetch the user's groups ?
> (LDAP is set to use a proxy search user so their is no need to know the
> user's LDAP password for this)
>
>
No, this will not work when using an SSO module and LDAP together, because
the the LDAP module does its search for group membership as the user
logging in to Guacamole (not the search bind DN).  Since SSO does not
usually provide the user's password back to the calling web page, the LDAP
bind as the user will fail and the group search will not be done.  The LDAP
extension is specifically designed to work this way as it leverages the
security built-in to LDAP by making sure that all LDAP queries (minus the
initial user search) are restricted to the permissions of the user logging
in.


> Alternatively, should it be better to get the groups from the OIDC claim ?
> This solution, albeit interesting, would lead to trust the OIDC provided
> groups, possibly allowing any users to be part of any groups.
>
>
Unfortunately not at this point - getting the OIDC module (and CAS and
upcoming SAML module) to release group members is the way to go, and it
just needs to be implemented.

-Nick