User-mapping.xml variable injection

[sciUser <sh...@securitycentric.net>]

Hello,

Will this work, taking the user-mapping.xml and adding arguments to pass
connections parameters to it on the fly.

arg=$1 #Lab Name
arg=$2 #IP Address
arg=$3 #Password
<user-mapping>
<authorize>
<connection name="$1">
    <protocol>rdp</protocol>
    $2
        administrator
        $3
    3389
        true
        rdp
</connection>
 </authorize>
</user-mapping>




--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

Re: User-mapping.xml variable injection

[Nick Couchman <vn...@apache.org>]

On Fri, Jan 11, 2019 at 2:42 AM sciUser <sh...@securitycentric.net>
wrote:

> Hello,
>
> Will this work, taking the user-mapping.xml and adding arguments to pass
> connections parameters to it on the fly.
>
> arg=$1 #Lab Name
> arg=$2 #IP Address
> arg=$3 #Password
> <user-mapping>
> <authorize>
> <connection name="$1">
>     <protocol>rdp</protocol>
>     $2
>         administrator
>         $3
>     3389
>         true
>         rdp
> </connection>
>  </authorize>
> </user-mapping>
>
>
>
Guacamole Client supports the use of parameter tokens (
http://guacamole.apache.org/doc/gug/configuring-guacamole.html#parameter-tokens
) in order to pass certain information through to the connection at the
time the connection is established.  However, I do not believe that these
tokens work with the basic file authentication, so you'd need to use one of
the available authentication extensions in order to use those.

-Nick