2FA does not work correctly w/ SAML

[Jack Wolfard <ja...@gmail.com>]

 Hello,

I have set up SAML and TOTP and can use both on their own just fine (such
as TOTP on top of a MySQL authentication or just SAML). However, when I
enable both, I am unable to get past the authentication screen for TOTP
after logging into SAML. I get redirected to the SAML login again, and the
error I get is that the user was not logged in.

This issue occurs both for users who have TOTP keys setup already and for
those who do not. My SAML provider is Google SSO. When examining the
networking packets, I get a 403 on the token post request to the Guacamole
Server with a response that says to provide a username and password. I have
not made any modifications to TOTP's settings besides enabling it.

Regards,

Jack

Re: 2FA does not work correctly w/ SAML

[Jack Wolfard <ja...@gmail.com>]

Hey Bryce,

To set up SAML, I am using Docker Compose with a Maria DB for MySQL,
guacamole/guacamole:1.4.0
<https://registry.hub.docker.com/r/guacamole/guacamole>, and
guacamole/guacd:1.4.0 <https://registry.hub.docker.com/r/guacamole/guacd>.
Out of the box 1.4.0 does not provide support for SAML, but PR #615 on
apache/guacamole-client
<https://github.com/apache/guacamole-client/pull/615> addresses this issue
by changing the entrypoint script for Docker (/opt/guacamole/bin/start.sh)
to add the functionality. I am using the script from that PR in a custom
image build of guacamole where I have copied over the script to overwrite
the default one of 1.4.0.

To enable SAML in Docker provide the following environment variables:

   - SAML_IDP_METADATA_URL: A local file HREF (or web link) to metadata
   given by SAML provider. Google let me download this from Google Admin for
   instance, and I expose it to Docker using a bind volume mount in the
   compose file.
   - SAML_ENTITY_ID: A unique identifier for this SAML login for your app.
   This is just the URL of my website for me.
   - SAML_CALLBACK_URL: This is the same as my entity ID. However, this is
   where users will get redirected to upon SAML success.
   - SAML_DEBUG=true: Useful for debugging output
   - SAML_STRICT=false: Disable certificate checking and don't enforce
   HTTPS. I'm actively investigating why I am having trouble with SAML not
   accepting HTTPS posts from Google. I think my reverse proxy is an issue,
   but for now since this is just a prototype, I am not worried about
   deployment security hardening.
   - LOGBACK_LEVEL=debug : Useful for debugging output in console

The trickiest part in the setup was on the Google side. For the ACS URL,
provide your base url + api/ext/saml/callback. For instance, default
Guacamole is mounted at the /guacamole endpoint for the Tomcat servlet, so
https://subdomain.test.com/guacamole/api/ext/saml/callback is what is
expected. The entity id can stay the same as what you provide to Docker.

Let me know if you have any other questions.

Good luck,

Jack


On Thu, Feb 10, 2022 at 12:41 PM Bryce Prutsos <bp...@barstow.edu> wrote:

> Hi Jack,
>
>
>
> Could you give me some of the steps you did for the SAML setup I am having
> trouble getting that piece setup.
>
>
>
>
>
> -Bryce
>
>
>
> *From:* Jack Wolfard <ja...@gmail.com>
> *Sent:* Thursday, February 10, 2022 5:48 AM
> *To:* user@guacamole.apache.org
> *Subject:* 2FA does not work correctly w/ SAML
>
>
>
> *CAUTION:This email originated from outside of the organization. Do not
> click links or open attachments unless you recognize the sender and know
> the content is safe.*
>
>
>
> Hello,
>
>
>
> I have set up SAML and TOTP and can use both on their own just fine (such
> as TOTP on top of a MySQL authentication or just SAML). However, when I
> enable both, I am unable to get past the authentication screen for TOTP
> after logging into SAML. I get redirected to the SAML login again, and the
> error I get is that the user was not logged in.
>
>
>
> This issue occurs both for users who have TOTP keys setup already and for
> those who do not. My SAML provider is Google SSO. When examining the
> networking packets, I get a 403 on the token post request to the Guacamole
> Server with a response that says to provide a username and password. I have
> not made any modifications to TOTP's settings besides enabling it.
>
>
>
> Regards,
>
>
>
> Jack
>
>
> *CAUTION:* BCC IT will *never* ask for your password. We may ask for your
> account number, but *never* for your password. Please do your part in
> being aware of and avoiding such scams to collect your personal
> information. Notify BCC IT Helpdesk <https://helpdesk.barstow.edu/new/>at
> 760-252-7279 of any suspicious emails or websites that appear to represent
> BCC.
>

RE: 2FA does not work correctly w/ SAML

[Bryce Prutsos <bp...@barstow.edu>]

Hi Jack,

Could you give me some of the steps you did for the SAML setup I am having trouble getting that piece setup.


-Bryce

From: Jack Wolfard <ja...@gmail.com>
Sent: Thursday, February 10, 2022 5:48 AM
To: user@guacamole.apache.org
Subject: 2FA does not work correctly w/ SAML

CAUTION:This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

Hello,

I have set up SAML and TOTP and can use both on their own just fine (such as TOTP on top of a MySQL authentication or just SAML). However, when I enable both, I am unable to get past the authentication screen for TOTP after logging into SAML. I get redirected to the SAML login again, and the error I get is that the user was not logged in.

This issue occurs both for users who have TOTP keys setup already and for those who do not. My SAML provider is Google SSO. When examining the networking packets, I get a 403 on the token post request to the Guacamole Server with a response that says to provide a username and password. I have not made any modifications to TOTP's settings besides enabling it.

Regards,

Jack


CAUTION: BCC IT will never ask for your password. We may ask for your account number, but never for your password. Please do your part in being aware of and avoiding such scams to collect your personal information. Notify BCC IT Helpdesk <https://helpdesk.barstow.edu/new/> at 760-252-7279 of any suspicious emails or websites that appear to represent BCC.