You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Tom Schoonjans <to...@me.com.INVALID> on 2020/05/26 16:39:25 UTC
Get token from REST API with OpenID authentication
Hi all,
I have been running Guacamole with LDAP authentication (and MariaDB as database backend) for a couple of weeks now and I am currently exploring switching to OpenID Connect based auth.
I have got the authentication itself working as I can access the web interface but I’m not sure how to use this with the REST API: I like to administer my Guacamole instance for our dozens of users through Ansible, and I have until now been using something like this to get a token:
- name: "Authenticate as {{ guacadmin_username }}"
uri:
url: "{{ guacamole_url }}/api/tokens"
body_format: form-urlencoded
body:
username: "{{ guacadmin_username }}"
password: "{{ guacadmin_password }}"
method: POST
status_code: 200
return_content: True
register: guactoken
become: False
This approach no longer works since switching to OIDC, which I kind of expected given that I need to go the OpenID provider sign-in page to get authenticated.
Any thoughts on how I can get my authToken now?
Thanks in advance!
Tom
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: Get token from REST API with OpenID authentication
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Feb 2, 2021 at 9:25 AM pr0totyp <ki...@dezim-institut.de> wrote:
> Any update on this?
>
>
No, nothing has changed, here.
> We are facing the exact same problem when connecting guacamole
> with keycloak via oidc. We want to run guacamole on multiple machines
> and managing user and their connections with Ansible would be great.
>
>
At this point the only work-around is the one that I suggested.
-Nick
Re: Get token from REST API with OpenID authentication
Posted by pr0totyp <ki...@dezim-institut.de>.
Any update on this?
We are facing the exact same problem when connecting guacamole
with keycloak via oidc. We want to run guacamole on multiple machines
and managing user and their connections with Ansible would be great.
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: Get token from REST API with OpenID authentication
Posted by Nick Couchman <vn...@apache.org>.
On Wed, May 27, 2020 at 6:27 AM Tom Schoonjans
<to...@me.com.invalid> wrote:
> Hi Nick,
>
>
> Unfortunately your approach doesn’t work: as soon as LDAP is the primary
> authentication mechanism, OIDC is ignored: the login page switches back to
> the default Guacamole page, and there is no way anymore for users to login
> using their OpenID credentials.
>
>
Yeah, I was afraid of something like that. So, I don't know that I have
any good solutions, but I can offer one work-around - you could set up
another instance of Guacamole Client, in a separate container, pointed at
the same DB, that just uses LDAP (or even JDBC) authentication, and use the
REST API to manage things that way. This is a hack/kludge, and not a great
solution, but, it would probably work...
-Nick
Re: Get token from REST API with OpenID authentication
Posted by Tom Schoonjans <to...@me.com.INVALID>.
Hi Nick,
Unfortunately your approach doesn’t work: as soon as LDAP is the primary authentication mechanism, OIDC is ignored: the login page switches back to the default Guacamole page, and there is no way anymore for users to login using their OpenID credentials.
Tom
> On 26 May 2020, at 17:54, Nick Couchman <vn...@apache.org> wrote:
>
> On Tue, May 26, 2020 at 12:39 PM Tom Schoonjans <to...@me.com.invalid> wrote:
> Hi all,
>
>
>
> I have been running Guacamole with LDAP authentication (and MariaDB as database backend) for a couple of weeks now and I am currently exploring switching to OpenID Connect based auth.
>
> I have got the authentication itself working as I can access the web interface but I’m not sure how to use this with the REST API: I like to administer my Guacamole instance for our dozens of users through Ansible, and I have until now been using something like this to get a token:
>
> - name: "Authenticate as {{ guacadmin_username }}"
> uri:
> url: "{{ guacamole_url }}/api/tokens"
> body_format: form-urlencoded
> body:
> username: "{{ guacadmin_username }}"
> password: "{{ guacadmin_password }}"
> method: POST
> status_code: 200
> return_content: True
> register: guactoken
> become: False
>
>
> This approach no longer works since switching to OIDC, which I kind of expected given that I need to go the OpenID provider sign-in page to get authenticated.
>
> Any thoughts on how I can get my authToken now?
>
>
> You could try making sure that the LDAP authentication module is loaded and processed prior to the OIDC module by making sure that the name of the LDAP module comes alphabetically prior to the OIDC module. This will likely be the default, and may not make a difference, but it's worth a look.
>
> -Nick
Re: Get token from REST API with OpenID authentication
Posted by Nick Couchman <vn...@apache.org>.
On Tue, May 26, 2020 at 12:39 PM Tom Schoonjans
<to...@me.com.invalid> wrote:
> Hi all,
>
>
>
> I have been running Guacamole with LDAP authentication (and MariaDB as
> database backend) for a couple of weeks now and I am currently exploring
> switching to OpenID Connect based auth.
>
> I have got the authentication itself working as I can access the web
> interface but I’m not sure how to use this with the REST API: I like to
> administer my Guacamole instance for our dozens of users through Ansible,
> and I have until now been using something like this to get a token:
>
> - name: "Authenticate as {{ guacadmin_username }}"
> uri:
> url: "{{ guacamole_url }}/api/tokens"
> body_format: form-urlencoded
> body:
> username: "{{ guacadmin_username }}"
> password: "{{ guacadmin_password }}"
> method: POST
> status_code: 200
> return_content: True
> register: guactoken
> become: False
>
>
> This approach no longer works since switching to OIDC, which I kind of
> expected given that I need to go the OpenID provider sign-in page to get
> authenticated.
>
> Any thoughts on how I can get my authToken now?
>
>
You could try making sure that the LDAP authentication module is loaded and
processed prior to the OIDC module by making sure that the name of the LDAP
module comes alphabetically prior to the OIDC module. This will likely be
the default, and may not make a difference, but it's worth a look.
-Nick