You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Brad Saxton <bs...@brocku.ca> on 2022/01/19 17:43:32 UTC
Guacamole, MySQL and LDAP groups
So, I have gotten the integration of LDAP, MySQL and Active Directory working (using Guacamole 1.3) but the login process takes a large amount of time (> 2 minutes). This appears to be because Guacamole is doing a large number of LDAP queries for groups that the user logging in belongs to even though there are no Guacamole groups defined with those names.
Am I missing something that could make this process quicker? My configuration is below but I've shortened/simplified the DN structure to be easier to read. Eliminating the ldap-group-base-dn & ldap-group-name-attribute has the login take less than 10 secs but with no group functionality of course.
Thanks in advance for any advice
Brad
guacd-hostname: localhost
guacd-port: 4822
user-mapping: /etc/guacamole/user-mapping.xml
auth-provider: net.sourceforge.guacamole.net.auth.mariadb.MySQLDBAuthenticationProvider
ldap-port: 389
ldap-hostname: myDC.local
ldap-encryption-method: STARTTLS
ldap-search-bind-dn: CN=testacct,OU=Users,DC=local
ldap-search-bind-password: SomePassword
ldap-user-base-dn: OU=Users,DC=local
ldap-username-attribute: uid
ldap-member-attribute: member
ldap-member-attribute-type: dn
ldap-user-search-filter: (memberOf=CN=guacamoleaccess,OU=Security Groups,OU=Security,DC=local)
#
# Security groups I want to use are of the form DN=groupname,OU=Security Groups,DC=local. It should be noted
# that there are other security groups of the form DN=othergroup,OU=otherou,OU=Security Groups,DC=local
# There are a large number of groups in this base DN but only one of them is defined as a Guacamole group
# groupname is used as the name for Guacamole groups
#
ldap-group-base-dn: OU=Security Groups,,DC=local
ldap-group-name-attribute: cn
#
# MySQL properties
#
mysql-driver: mariadb
mysql-hostname: localhost
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole
mysql-password: SomePassword
mysql-auto-create-accounts: true
--
Brad Saxton
Senior System Administrator
Infrastructure Team
Brock University | Information Technology Services
Niagara Region | 1812 Sir Isaac Brock Way | St. Catharines, ON, Canada L2S 3A1
brocku.ca | T 905-688-5550 x4761 | F 905-688-4191
Re: Guacamole, MySQL and LDAP groups
Posted by Brad Saxton <bs...@brocku.ca>.
Nick,
Thanks very much for the heads up about the logging level. That was in fact what the problem was. I had set it to DEBUG when I was trying to get the LDAP stuff working. Turning it off got the login down to less than 5 seconds.
Going to have to keep this in mind for the future.
Brad
--
Brad Saxton
Senior System Administrator
Infrastructure Team
Brock University | Information Technology Services
Niagara Region | 1812 Sir Isaac Brock Way | St. Catharines, ON, Canada L2S 3A1
brocku.ca | T 905-688-5550 x4761 | F 905-688-4191
________________________________
From: Nick Couchman <vn...@apache.org>
Sent: Wednesday, January 19, 2022 12:56
To: user@guacamole.apache.org <us...@guacamole.apache.org>
Subject: Re: Guacamole, MySQL and LDAP groups
On Wed, Jan 19, 2022 at 12:43 PM Brad Saxton <bs...@brocku.ca>> wrote:
So, I have gotten the integration of LDAP, MySQL and Active Directory working (using Guacamole 1.3) but the login process takes a large amount of time (> 2 minutes). This appears to be because Guacamole is doing a large number of LDAP queries for groups that the user logging in belongs to even though there are no Guacamole groups defined with those names.
Am I missing something that could make this process quicker? My configuration is below but I've shortened/simplified the DN structure to be easier to read. Eliminating the ldap-group-base-dn & ldap-group-name-attribute has the login take less than 10 secs but with no group functionality of course.
much of it
Thanks in advance for any advice
Brad
guacd-hostname: localhost
guacd-port: 4822
user-mapping: /etc/guacamole/user-mapping.xml
auth-provider: net.sourceforge.guacamole.net.auth.mariadb.MySQLDBAuthenticationProvider
ldap-port: 389
ldap-hostname: myDC.local
ldap-encryption-method: STARTTLS
ldap-search-bind-dn: CN=testacct,OU=Users,DC=local
ldap-search-bind-password: SomePassword
ldap-user-base-dn: OU=Users,DC=local
ldap-username-attribute: uid
ldap-member-attribute: member
ldap-member-attribute-type: dn
ldap-user-search-filter: (memberOf=CN=guacamoleaccess,OU=Security Groups,OU=Security,DC=local)
#
# Security groups I want to use are of the form DN=groupname,OU=Security Groups,DC=local. It should be noted
# that there are other security groups of the form DN=othergroup,OU=otherou,OU=Security Groups,DC=local
# There are a large number of groups in this base DN but only one of them is defined as a Guacamole group
# groupname is used as the name for Guacamole groups
#
ldap-group-base-dn: OU=Security Groups,,DC=local
ldap-group-name-attribute: cn
#
If you update to Guacamole 1.4.0, there is a new "ldap-group-search-filter" that you can use to modify the filter used, which may increase the speed of your logins. Also, make sure that, if you've turned on web application debugging in the past, you turn that back off, as the LDAP library is quite verbose and logs a lot of things to catalina.out that can cause performance issues. Setting logging back to INFO or WARN will help that.
-Nick
Re: Guacamole, MySQL and LDAP groups
Posted by Nick Couchman <vn...@apache.org>.
On Wed, Jan 19, 2022 at 12:43 PM Brad Saxton <bs...@brocku.ca> wrote:
>
> So, I have gotten the integration of LDAP, MySQL and Active Directory
> working (using Guacamole 1.3) but the login process takes a large amount of
> time (> 2 minutes). This appears to be because Guacamole is doing a large
> number of LDAP queries for groups that the user logging in belongs to even
> though there are no Guacamole groups defined with those names.
>
> Am I missing something that could make this process quicker? My
> configuration is below but I've shortened/simplified the DN structure to be
> easier to read. Eliminating the ldap-group-base-dn &
> ldap-group-name-attribute has the login take less than 10 secs but with no
> group functionality of course.
>
> Thanks in advance for any advice
> Brad
>
> guacd-hostname: localhost
> guacd-port: 4822
> user-mapping: /etc/guacamole/user-mapping.xml
> auth-provider:
> net.sourceforge.guacamole.net.auth.mariadb.MySQLDBAuthenticationProvider
>
> ldap-port: 389
> ldap-hostname: myDC.local
> ldap-encryption-method: STARTTLS
> ldap-search-bind-dn: CN=testacct,OU=Users,DC=local
> ldap-search-bind-password: SomePassword
> ldap-user-base-dn: OU=Users,DC=local
> ldap-username-attribute: uid
> ldap-member-attribute: member
> ldap-member-attribute-type: dn
> ldap-user-search-filter: (memberOf=CN=guacamoleaccess,OU=Security
> Groups,OU=Security,DC=local)
> #
> # Security groups I want to use are of the form DN=groupname,OU=Security
> Groups,DC=local. It should be noted
> # that there are other security groups of the form
> DN=othergroup,OU=otherou,OU=Security Groups,DC=local
> # There are a large number of groups in this base DN but only one of them
> is defined as a Guacamole group
> # groupname is used as the name for Guacamole groups
> #
> ldap-group-base-dn: OU=Security Groups,,DC=local
> ldap-group-name-attribute: cn
> #
>
If you update to Guacamole 1.4.0, there is a new "ldap-group-search-filter"
that you can use to modify the filter used, which may increase the speed of
your logins. Also, make sure that, if you've turned on web application
debugging in the past, you turn that back off, as the LDAP library is quite
verbose and logs a lot of things to catalina.out that can cause performance
issues. Setting logging back to INFO or WARN will help that.
-Nick
>
RE: Guacamole, MySQL and LDAP groups
Posted by Luciano Oliveira <ol...@outlook.com>.
hello!
My guacamole.properties
# >>>>>>>>>>>>> LDAP
ldap-hostname: ldap.contoso.local
ldap-port: 389
ldap-encryption-method: none
ldap-user-base-dn: DC=unisc,DC=br
ldap-username-attribute: sAMAccountName
ldap-search-bind-dn: CN=guacadmin,OU=services,DC=contoso,DC=local
ldap-search-bind-password: password202020
ldap-group-name-attribute: cn
ldap-member-attribute: member
ldap-user-search-filter:(&(&(objectClass=user)(objectCategory=person))(memberof=CN=access_guacamole,OU=services,DC=contoso,DC=local))
Set to ldap-encryption-method: none
[ ]'s
Luciano
________________________________
De: Brad Saxton <bs...@brocku.ca>
Enviado: quarta-feira, 19 de janeiro de 2022 14:43
Para: user@guacamole.apache.org <us...@guacamole.apache.org>
Assunto: Guacamole, MySQL and LDAP groups
So, I have gotten the integration of LDAP, MySQL and Active Directory working (using Guacamole 1.3) but the login process takes a large amount of time (> 2 minutes). This appears to be because Guacamole is doing a large number of LDAP queries for groups that the user logging in belongs to even though there are no Guacamole groups defined with those names.
Am I missing something that could make this process quicker? My configuration is below but I've shortened/simplified the DN structure to be easier to read. Eliminating the ldap-group-base-dn & ldap-group-name-attribute has the login take less than 10 secs but with no group functionality of course.
Thanks in advance for any advice
Brad
guacd-hostname: localhost
guacd-port: 4822
user-mapping: /etc/guacamole/user-mapping.xml
auth-provider: net.sourceforge.guacamole.net.auth.mariadb.MySQLDBAuthenticationProvider
ldap-port: 389
ldap-hostname: myDC.local
ldap-encryption-method: STARTTLS
ldap-search-bind-dn: CN=testacct,OU=Users,DC=local
ldap-search-bind-password: SomePassword
ldap-user-base-dn: OU=Users,DC=local
ldap-username-attribute: uid
ldap-member-attribute: member
ldap-member-attribute-type: dn
ldap-user-search-filter: (memberOf=CN=guacamoleaccess,OU=Security Groups,OU=Security,DC=local)
#
# Security groups I want to use are of the form DN=groupname,OU=Security Groups,DC=local. It should be noted
# that there are other security groups of the form DN=othergroup,OU=otherou,OU=Security Groups,DC=local
# There are a large number of groups in this base DN but only one of them is defined as a Guacamole group
# groupname is used as the name for Guacamole groups
#
ldap-group-base-dn: OU=Security Groups,,DC=local
ldap-group-name-attribute: cn
#
# MySQL properties
#
mysql-driver: mariadb
mysql-hostname: localhost
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole
mysql-password: SomePassword
mysql-auto-create-accounts: true
--
Brad Saxton
Senior System Administrator
Infrastructure Team
Brock University | Information Technology Services
Niagara Region | 1812 Sir Isaac Brock Way | St. Catharines, ON, Canada L2S 3A1
brocku.ca | T 905-688-5550 x4761 | F 905-688-4191