HTTP header authentication and NGINX

["SCOTT, Keith (NHS NATIONAL SERVICES SCOTLAND)" <ke...@nhs.net>]

I have been unable to get Guacamoles and HTTP Header Auth working so
would like some help with getting a simple Nginx / Guacamole
configuration working where I just a single hard coded http header via
Nginx to allow me to authenticate with Guacamole.

My Guacamole v0.9.12 install works well and I am able to login with the
username Keith and my password.

I can see the following in the logs so I guess the extension is being
loaded correctly.
INFO  o.a.g.extension.ExtensionModule - Extension "HTTP Header
Authentication Extension" loaded.

This is my nginx.conf.
location / {
            proxy_pass            "http://127.0.0.1:8080";
            proxy_set_header       X-Remote-User Keith;
}

This is the line I have added to my guacamole.properties
http-auth-header: HTTP_X_REMOTE_USER

I have checked the http headers and can confirm that there is a
HTTP_X_REMOTE_USER header.

HTTP_X_REMOTE_USER = Keith

I visit the Guacamole login page but don't get logged in and just get
the default User/Password login box.

Where could I be going wrong ?

Thanks
Keith


********************************************************************************************************************

This message may contain confidential information. If you are not the intended recipient please inform the
sender that you have received the message in error before deleting it.
Please do not disclose, copy or distribute information in this e-mail or take any action in reliance on its contents:
to do so is strictly prohibited and may be unlawful.

Thank you for your co-operation.

NHSmail is the secure email and directory service available for all NHS staff in England and Scotland
NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services.
NHSmail provides an email address for your career in the NHS and can be accessed anywhere
For more information and to find out how you can switch, visit http://support.nhs.net/joiningnhsmail

********************************************************************************************************************

Re: HTTP header authentication and NGINX

[Mike Jumper <mi...@guac-dev.org>]

On Tue, May 16, 2017 at 2:38 PM, SCOTT, Keith (NHS NATIONAL SERVICES
SCOTLAND) <ke...@nhs.net> wrote:

> I have been unable to get Guacamoles and HTTP Header Auth working so
> would like some help with getting a simple Nginx / Guacamole
> configuration working where I just a single hard coded http header via
> Nginx to allow me to authenticate with Guacamole.
>
> My Guacamole v0.9.12 install works well and I am able to login with the
> username Keith and my password.
>
> I can see the following in the logs so I guess the extension is being
> loaded correctly.
> INFO  o.a.g.extension.ExtensionModule - Extension "HTTP Header
> Authentication Extension" loaded.
>
> This is my nginx.conf.
> location / {
>             proxy_pass            "http://127.0.0.1:8080";
>             proxy_set_header       X-Remote-User Keith;
> }
>
> This is the line I have added to my guacamole.properties
> http-auth-header: HTTP_X_REMOTE_USER
>
> I have checked the http headers and can confirm that there is a
> HTTP_X_REMOTE_USER header.
>

Given the "proxy_set_header X-Remote-User" line, shouldn't the header in
the HTTP request be "X-Remote-User", not "HTTP_X_REMOTE_USER"?

- Mike