Permissions Required to Read LDAP Configuration

[Benjamin Long <be...@sscsince73.com>]

Hello folks,

Here is my situation. We're setting up a new authentication system using
FreeIPA. So far, so good.

I've been able to configure Guacamole (using the official docker container)
to use LDAP as its user and configuration store. The configuration is in
the cn=guacconfig subtree.

Here's where I'm a little confused

When I use ldap-search-bind-dn to configure a bind user, I thought this was
the login used to pull the configuration from cn=guacconfig. So I have a
bind user set up that has access to this subtree.

However, my users do not have access to this subtree, and I would rather
they not. I don't want them to be able to run ldapsearch with their
credentials and get the login credentials for the remote systems.

When I log into Guacamole as my user, I don't see any connections unless I
give my user search and read access to cn=guacconfig.

Am I missing something, or is this expected behavior?

--
Benjamin Long
Chief Information Officer
Security Service Company
1-484-575-8116

Re: Permissions Required to Read LDAP Configuration

[Nick Couchman <vn...@apache.org>]

On Tue, Nov 5, 2024 at 1:45 PM Benjamin Long <be...@sscsince73.com>
wrote:

> Hello folks,
>
> Here is my situation. We're setting up a new authentication system using
> FreeIPA. So far, so good.
>
> I've been able to configure Guacamole (using the official docker
> container) to use LDAP as its user and configuration store. The
> configuration is in the cn=guacconfig subtree.
>
> Here's where I'm a little confused
>
> When I use ldap-search-bind-dn to configure a bind user, I thought this
> was the login used to pull the configuration from cn=guacconfig. So I have
> a bind user set up that has access to this subtree.
>
>
No, the ldap-search-bind-dn user is *ONLY* used to locate the user who is
logging in to Guacamole. After that user is located, the search DN is
disconnected (un-bound), and a new bind is performed using the DN of the
user who has just been located, and that user's password. Thus, the access
control for Guacamole when using LDAP to store connection configurations
uses LDAP's built-in security.


> However, my users do not have access to this subtree, and I would rather
> they not. I don't want them to be able to run ldapsearch with their
> credentials and get the login credentials for the remote systems.
>
> When I log into Guacamole as my user, I don't see any connections unless I
> give my user search and read access to cn=guacconfig.
>
> Am I missing something, or is this expected behavior?
>
>
This is expected. I can understand, if you're storing credentials directly
in your LDAP configurations, that you might not want users reading those
credentials. At the moment, there's no way around this.

-Nick

>

AW: Permissions Required to Read LDAP Configuration

["Druve, Matthias" <ma...@tu-berlin.de.INVALID>]

Hey Benjamin, 

sorry for the late response but I had to recreate my patch by decompiling my compiled extension because I lost the patch file. : /
I used this patch for the LDAP 1.4.0 extension.

It is closing the user LDAP connection after the login and using the bind connection for everything else afterward.
I had to modify it because I'm just one admin in our university with access to use the LDAP for using the user credentials for authentication in my services.
So, myself (non-bind user) even couldn't see available LDAP groups and assign these in guacamole. With this patch it is possible.
Because I don't know much about Java, its GC and security implications about these changes, maybe double check if there is a risk.

You maybe ask why LDAP version 1.4.0. 
It was the released version at this time, and I was glad that I understood enough to make that change.
We also have only one LDAP, so using 1.5.x which is in my understanding was updated for using multiple LDAPs wasn't necessary at all, and I guess it makes the patch more difficult.

By the way the logger.info stuff can be removed or commented to disable the spam on your catalina.out, when you successfully tested it.

Perhaps the patch helps and fixes your problem.

Greetings
Matthias

---
Matthias Druve

Systemadministrator
Technische Universität Berlin

________________________________________
Von: Benjamin Long <be...@sscsince73.com>
Gesendet: Dienstag, 5. November 2024 19:44
An: user@guacamole.apache.org
Betreff: Permissions Required to Read LDAP Configuration

Hello folks,

Here is my situation. We're setting up a new authentication system using FreeIPA. So far, so good.

I've been able to configure Guacamole (using the official docker container) to use LDAP as its user and configuration store. The configuration is in the cn=guacconfig subtree.

Here's where I'm a little confused

When I use ldap-search-bind-dn to configure a bind user, I thought this was the login used to pull the configuration from cn=guacconfig. So I have a bind user set up that has access to this subtree.

However, my users do not have access to this subtree, and I would rather they not. I don't want them to be able to run ldapsearch with their credentials and get the login credentials for the remote systems.

When I log into Guacamole as my user, I don't see any connections unless I give my user search and read access to cn=guacconfig.

Am I missing something, or is this expected behavior?

--
Benjamin Long
Chief Information Officer
Security Service Company
1-484-575-8116