[jira] [Commented] (GUACAMOLE-1199) User Profile Information Lost after user logon

["Joonas Tuomisto (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/GUACAMOLE-1199?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17245233#comment-17245233 ] 

Joonas Tuomisto commented on GUACAMOLE-1199:
--------------------------------------------

+1 on this.

 

This issue is not related to the LDAP plugin, it appears to be solely caused by the TOTP plugin.

This is reproducible with just the (PostgreSQL) database and TOTP plugins - if you create a user into the local database with full details (name, organization, email) and then log in as the user and complete TOTP enrollment, the user details vanish from the user. 

 

You can reproduce it again by re-filling all of the user details and "resetting" TOTP by clearing the user's data from the guacamole_user_attribute table and then logging in (& completing TOTP enrollment) again.

> User Profile Information Lost after user logon
> ----------------------------------------------
>
>                 Key: GUACAMOLE-1199
>                 URL: https://issues.apache.org/jira/browse/GUACAMOLE-1199
>             Project: Guacamole
>          Issue Type: Bug
>          Components: guacamole
>    Affects Versions: 1.1.0, 1.2.0
>         Environment: Centos 7 (7.8.2003)
> Guacamole 1.2.0
> LDAP
> MariaDB 5.5.65
> TOTP
>            Reporter: Felipe Pereira
>            Priority: Major
>         Attachments: Screenshot from 2020-10-28 10-13-21.png
>
>
> Hi.
> I'm having a problem with user profile info (full_name,email,organization) vanishing after the user's first login. (with TOTP at least).
> Steps to recreate the issue:
>  * Create a user in AD.
>  * Log Out and Log in Guacamole to refresh LDAP users. (very, VERY annoying).
>  * Insert the new user profile info in guacamole (full_name, email, organization) and [save].
>  * On an incognito tab, log in with the new user.
>  * Register TOTP in Google Authenticator and proceed with the login.
>  * The login succeeds (good for the user).
>  * 
>  * POOOF! User Profile info is gone from the database. (very, VERY bad for us).
> Don't really know what to do.
>  
> Other variations of the preceding steps gave me the same result, like creating the user in MySQL first without a password and then creating the user on the AD.
> After the TOTP registration/ first login, the user profile info vanishes, but other fields like "Enable account after:" is still present.
> Appears to affect only the "PROFILE" portion of the user.
>  
> [UPDATE]
> Found where it happens exactly, both in 1.1.0 and 1.2.0.
> PS: My 1.1.0 server is MySQL only.
>  
> Profile info vanishes when the user reaches this TOTP page:
> !Screenshot from 2020-10-28 10-13-21.png!



--
This message was sent by Atlassian Jira
(v8.3.4#803005)