You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Jesus Malena <je...@gmail.com> on 2024/04/02 04:28:49 UTC
How to use saml-strict?
Hi all,
Currently I'm working on setting up Guacamole with SAML. I have gone ahead
and was able to get things working with Okta. My settings are as follows
(removing private data):
saml-idp-metadata-url:
https://mytestidp.okta.com/app/th!$isn0Tm&@pp/sso/saml/metadata
saml-entity-id: https://guactest.mytestserver.com/
saml-callback-url: https://guactest.mytestserver.com/
saml-debug: false
saml-strict: false
saml-group-attribute: groups
skip-if-unavailable: saml
As you can see, saml-strict is set to false. I want to set saml-strict to
true, but when I do my connections break with the following error:
guacamole | 17:39:37.776 [http-nio-8080-exec-3] WARN
o.a.g.a.s.a.AssertionConsumerServiceResource - Authentication attempted
with an invalid SAML response: SAML response did not pass validation: The
response was received at
http://guactest.mytestserver.com/api/ext/saml/callback instead of
https://guactest.mytestserver.com/api/ext/saml/callback
So I know what this means, so I've gone ahead and on the Okta side enabled
assertion encryption. Enabling this in Okta opens up additional settings
that include a certificate I need to provide from the SP side to encrypt
the assertion. This is where I'm not sure of what to do next. The
instructions here:
https://guacamole.apache.org/doc/gug/saml-auth.html
doesn't provide much help except just enabling this feature which should be
done in production. What exactly is required to enable this in production?
I know how to create a certificate on the SP side, but where would I need
to put the private key and the certificate on the SP side so that when the
assertion is signed with the certificate on the iDP side, the SP side can
decrypt it? I have looked everywhere online for instructions on how to set
this up to true and what to do on the SP side, but nothing at all. Even the
video by the founder of those OSS product, Mike Jumper:
https://www.youtube.com/watch?v=hZYarUlNdmM
doesn't provide help in this regard as it is solely targeted at getting
Guacamole up and running with SQL auth and behind a proxy like NginX.
Thanks in advance for looking at my request and providing any guidance.
Jesus
Re: How to use saml-strict?
Posted by Mike <mi...@yahoo.com.INVALID>.
anyone successfully get saml-strict working running everything in docker?
On Tuesday, April 2, 2024 at 09:49:04 AM EDT, Nick Couchman <vn...@apache.org> wrote:
On Tue, Apr 2, 2024 at 9:03 AM Jesus Malena <je...@gmail.com> wrote:
Hi Nick,
Thanks for the quick response. I should have added my NginX configuration here as well so that this information would be more complete. Below is my NginX config.
# HTTPS server
upstream guacservice {
server 127.0.0.1:8080;
}
server {
listen 443 ssl http2;
server_name guactest.mytestserver.com;
server_tokens off;
access_log /var/log/nginx/ssl_access.log main;
ssl_certificate ssl/guactest_mytestserver_com.pem;
ssl_certificate_key ssl/guactest_mytestserver_com.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:!aNULL:!MD5:!DSS;
ssl_prefer_server_ciphers on;
gzip on;
gzip_types text/javascript;
gzip_proxied no-cache no-store private expired auth;
gzip_min_length 1000;
location / {
add_header Front-End-Https on;
add_header Strict-Transport-Security "max-age=16000000; includeSubDomains; always;";
proxy_pass http://guacservice;
proxy_hide_header X-Powered-By;
proxy_set_header X-NginX-Proxy true;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $http_true_client_ip;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cookie_path ~(.*) "$1; secure; SameSite=None";
proxy_redirect default;
proxy_redirect http://$host https://$host;
proxy_redirect http://hostname https://$host;
}
location = /404.html {}
location = /50x.html {}
}
server {
listen 80;
server_name _;
server_tokens off;
location / {
rewrite ^(.*) https://$http_host$1 redirect;
}
location /nginx_status {
stub_status on; access_log off;
allow 127.0.0.1;
deny all;
}
}
There are some settings which you have suggested which I do not have which deal with websockets so I will have to look into those and implement them once I validate from the documentation. I will also have to go over some of my settings in this section and update some of these accordingly, like the proxy_set_header Host $http_host to just proxy_set_header Host $host as this is cleaner based on NginX documentation, but the X-Forwarded-Proto one is one that I do have set. There may be some additional cleanup that may need to be done on the above configuration, but this above configuration does work. If you see any glaring configuration issues above please let me know.
I would say just add the additional headers that I mentioned - it is a more complete list than is in the manual (manual needs some updating in that respect).
-Nick
Re: How to use saml-strict?
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Apr 2, 2024 at 9:03 AM Jesus Malena <je...@gmail.com> wrote:
> Hi Nick,
>
> Thanks for the quick response. I should have added my NginX configuration
> here as well so that this information would be more complete. Below is my
> NginX config.
>
> # HTTPS server
>
> upstream guacservice {
> server 127.0.0.1:8080;
> }
>
> server {
> listen 443 ssl http2;
> server_name guactest.mytestserver.com;
> server_tokens off;
>
> access_log /var/log/nginx/ssl_access.log main;
>
> ssl_certificate ssl/guactest_mytestserver_com.pem;
> ssl_certificate_key ssl/guactest_mytestserver_com.pem;
> ssl_session_timeout 5m;
>
> ssl_protocols TLSv1.2 TLSv1.3;
> ssl_ciphers
> ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:!aNULL:!MD5:!DSS;
>
> ssl_prefer_server_ciphers on;
> gzip on;
> gzip_types text/javascript;
> gzip_proxied no-cache no-store private expired auth;
> gzip_min_length 1000;
>
> location / {
> add_header Front-End-Https on;
> add_header Strict-Transport-Security "max-age=16000000;
> includeSubDomains; always;";
> proxy_pass http://guacservice;
> proxy_hide_header X-Powered-By;
> proxy_set_header X-NginX-Proxy true;
> proxy_set_header Host $http_host;
> proxy_set_header X-Real-IP $http_true_client_ip;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
> proxy_set_header X-Forwarded-Proto $scheme;
> proxy_cookie_path ~(.*) "$1; secure; SameSite=None";
>
> proxy_redirect default;
> proxy_redirect http://$host https://$host;
> proxy_redirect http://hostname https://$host;
> }
> location = /404.html {}
> location = /50x.html {}
> }
>
> server {
> listen 80;
> server_name _;
> server_tokens off;
>
> location / {
> rewrite ^(.*) https://$http_host$1 redirect;
> }
>
> location /nginx_status {
> stub_status on; access_log off;
> allow 127.0.0.1;
> deny all;
> }
> }
>
> There are some settings which you have suggested which I do not have
> which deal with websockets so I will have to look into those and implement
> them once I validate from the documentation. I will also have to go over
> some of my settings in this section and update some of these accordingly,
> like the proxy_set_header Host $http_host to just proxy_set_header Host
> $host as this is cleaner based on NginX documentation, but the
> X-Forwarded-Proto one is one that I do have set. There may be some
> additional cleanup that may need to be done on the above configuration, but
> this above configuration does work. If you see any glaring configuration
> issues above please let me know.
>
>
I would say just add the additional headers that I mentioned - it is a more
complete list than is in the manual (manual needs some updating in that
respect).
-Nick
>
Re: How to use saml-strict?
Posted by Jesus Malena <je...@gmail.com>.
Hi Nick,
Thanks for the quick response. I should have added my NginX configuration
here as well so that this information would be more complete. Below is my
NginX config.
# HTTPS server
upstream guacservice {
server 127.0.0.1:8080;
}
server {
listen 443 ssl http2;
server_name guactest.mytestserver.com;
server_tokens off;
access_log /var/log/nginx/ssl_access.log main;
ssl_certificate ssl/guactest_mytestserver_com.pem;
ssl_certificate_key ssl/guactest_mytestserver_com.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:!aNULL:!MD5:!DSS;
ssl_prefer_server_ciphers on;
gzip on;
gzip_types text/javascript;
gzip_proxied no-cache no-store private expired auth;
gzip_min_length 1000;
location / {
add_header Front-End-Https on;
add_header Strict-Transport-Security "max-age=16000000;
includeSubDomains; always;";
proxy_pass http://guacservice;
proxy_hide_header X-Powered-By;
proxy_set_header X-NginX-Proxy true;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $http_true_client_ip;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cookie_path ~(.*) "$1; secure; SameSite=None";
proxy_redirect default;
proxy_redirect http://$host https://$host;
proxy_redirect http://hostname https://$host;
}
location = /404.html {}
location = /50x.html {}
}
server {
listen 80;
server_name _;
server_tokens off;
location / {
rewrite ^(.*) https://$http_host$1 redirect;
}
location /nginx_status {
stub_status on; access_log off;
allow 127.0.0.1;
deny all;
}
}
There are some settings which you have suggested which I do not have
which deal with websockets so I will have to look into those and implement
them once I validate from the documentation. I will also have to go over
some of my settings in this section and update some of these accordingly,
like the proxy_set_header Host $http_host to just proxy_set_header Host
$host as this is cleaner based on NginX documentation, but the
X-Forwarded-Proto one is one that I do have set. There may be some
additional cleanup that may need to be done on the above configuration, but
this above configuration does work. If you see any glaring configuration
issues above please let me know.
On Tue, Apr 2, 2024 at 4:08 AM Nick Couchman <vn...@apache.org> wrote:
> On Tue, Apr 2, 2024 at 12:29 AM Jesus Malena <je...@gmail.com>
> wrote:
>
>> Hi all,
>>
>> Currently I'm working on setting up Guacamole with SAML. I have gone
>> ahead and was able to get things working with Okta. My settings are as
>> follows (removing private data):
>>
>> saml-idp-metadata-url:
>> https://mytestidp.okta.com/app/th!$isn0Tm&@pp/sso/saml/metadata
>> saml-entity-id: https://guactest.mytestserver.com/
>> saml-callback-url: https://guactest.mytestserver.com/
>> saml-debug: false
>> saml-strict: false
>> saml-group-attribute: groups
>> skip-if-unavailable: saml
>>
>> As you can see, saml-strict is set to false. I want to set saml-strict to
>> true, but when I do my connections break with the following error:
>>
>> guacamole | 17:39:37.776 [http-nio-8080-exec-3] WARN
>> o.a.g.a.s.a.AssertionConsumerServiceResource - Authentication attempted
>> with an invalid SAML response: SAML response did not pass validation: The
>> response was received at
>> http://guactest.mytestserver.com/api/ext/saml/callback instead of
>> https://guactest.mytestserver.com/api/ext/saml/callback
>>
>>
> This is likely because you need a couple of extra proxy headers set.
> Depending on what software you're using to proxy Guacamole through https,
> this will vary a bit. For example, Nginx should have the following:
>
> proxy_set_header Host $host;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
> proxy_set_header X-Forwarded-Host $host;
> proxy_set_header X-Forwarded-Server $host;
> proxy_set_header X-Forwarded-Proto $scheme;
> proxy_set_header Upgrade $http_upgrade;
> proxy_set_header Connection $http_connection;
>
> I would imagine your particular issue is because the X-Forwarded-Proto
> header is not being set.
>
> -Nick
>
>>
Re: How to use saml-strict?
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Apr 2, 2024 at 12:29 AM Jesus Malena <je...@gmail.com> wrote:
> Hi all,
>
> Currently I'm working on setting up Guacamole with SAML. I have gone ahead
> and was able to get things working with Okta. My settings are as follows
> (removing private data):
>
> saml-idp-metadata-url:
> https://mytestidp.okta.com/app/th!$isn0Tm&@pp/sso/saml/metadata
> saml-entity-id: https://guactest.mytestserver.com/
> saml-callback-url: https://guactest.mytestserver.com/
> saml-debug: false
> saml-strict: false
> saml-group-attribute: groups
> skip-if-unavailable: saml
>
> As you can see, saml-strict is set to false. I want to set saml-strict to
> true, but when I do my connections break with the following error:
>
> guacamole | 17:39:37.776 [http-nio-8080-exec-3] WARN
> o.a.g.a.s.a.AssertionConsumerServiceResource - Authentication attempted
> with an invalid SAML response: SAML response did not pass validation: The
> response was received at
> http://guactest.mytestserver.com/api/ext/saml/callback instead of
> https://guactest.mytestserver.com/api/ext/saml/callback
>
>
This is likely because you need a couple of extra proxy headers set.
Depending on what software you're using to proxy Guacamole through https,
this will vary a bit. For example, Nginx should have the following:
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
I would imagine your particular issue is because the X-Forwarded-Proto
header is not being set.
-Nick
>