Disable database authentication but keep connection info there

[Ben Menadue <be...@nci.org.au>]

Hi,

I have Guacamole set up for LDAP authentication with Postgres storing connection info. To do this, I need equivalent user entities in the database, with usernames matching LDAP. That’s working fine. However, I can’t work out how to stop it also attempting to authenticate against the database users.

For example, suppose I have an LDAP user “ben” with password “abc123” and a database user “ben" with password “def456” (the schema appears to require a password to be set). I can then login as “ben” using either of the passwords!!

How do I make it _only_ try to authenticate users against the LDAP directory, and ignore whatever password is in the database? The best I’ve been able to come up with so far is to set a random password in the database, which is still a significant security hole.

Thanks,
Ben

Re: Disable database authentication but keep connection info there

[Nick Couchman <vn...@apache.org>]

On Thu, Jan 17, 2019 at 11:16 PM Ben Menadue <be...@nci.org.au> wrote:

> Hi,
>
> I have Guacamole set up for LDAP authentication with Postgres storing
> connection info. To do this, I need equivalent user entities in the
> database, with usernames matching LDAP. That’s working fine. However, I
> can’t work out how to stop it also attempting to authenticate against the
> database users.
>
> For example, suppose I have an LDAP user “ben” with password “abc123” and
> a database user “ben" with password “def456” (the schema appears to require
> a password to be set). I can then login as “ben” using either of the
> passwords!!
>
> How do I make it _only_ try to authenticate users against the LDAP
> directory, and ignore whatever password is in the database? The best I’ve
> been able to come up with so far is to set a random password in the
> database, which is still a significant security hole.
>
>
How is assigning random passwords within the database a security hole?
This is exactly what Guacamole does if you create a user within web
interface and do not specify a password - a random value is generated for
you.  It's exactly what I would suggest doing - make sure it is complex
enough that it won't be easily guessed or cracked, assign all of the user
entries in the DB their own random value, and make sure not to allow users
to change their own passwords.

-Nick