Passing OpenID credentials through RDP

[Alexandre Cariage <al...@sight-sound.ch>]

Hi all,

Quickly :

I'm looking to allow users to connect through OpenID Connect, and use 
the same credentials /inside the connection itself/, to open a Windows 
session with RDP.

I.e., the Guacamole authentication is made by OpenID, and, through RDP, 
the Windows session open with the OpenID credentials too, allowing for a 
seamless login with the creation of an OpenID user only.

Can Guacamole pass credentials this way ?

If not, is there any other way to edit credentials on the fly (in other 
words, pass "Username" and "Password" fields of an RDP Connection in 
Guacamole as the connection is launched) ?

To help you understand the use case, the specificity of ou business is 
that we let new users in on a regular basis, and each user has access to 
multiple connections, thus creating a lot of administrative work to 
create the connections for each.

Thanks,

Alexandre

Re: Passing OpenID credentials through RDP

[Nick Couchman <vn...@apache.org>]

On Mon, Mar 11, 2024 at 8:10 AM Alexandre Cariage <al...@sight-sound.ch>
wrote:

> Thank you for the quick response and clarifications.
>
> For the second part, I was thinking of a way to pass the 'username' and
> 'password' as parameters, not actually edit them, although that might be
> the next best solution.
>

If you leave the username and password blank in the connection properties,
it will prompt the user at connection time, and pass them through. It will
*not* permanently save these values for the connection, so every user that
accesses that connection will be prompted each time that they use it.


> If not, would it be possible for the username only ? Better than nothing
> in our case. (-> So that the user is prompted for a password, but his
> username is recognized and pre-filled).
>

Yes, if you leave the password blank, and use ${GUAC_USERNAME} for the
username, the username will be pre-filled with the user's Guacamole
username, and the user will be prompted for the password.

-Nick

>

Re: Passing OpenID credentials through RDP

[Nick Couchman <vn...@apache.org>]

On Mon, Mar 11, 2024 at 7:45 AM Alexandre Cariage <al...@sight-sound.ch>
wrote:

> Hi all,
>
> Quickly :
>
> I'm looking to allow users to connect through OpenID Connect, and use the
> same credentials *inside the connection itself*, to open a Windows
> session with RDP.
>
> I.e., the Guacamole authentication is made by OpenID, and, through RDP,
> the Windows session open with the OpenID credentials too, allowing for a
> seamless login with the creation of an OpenID user only.
>
> Can Guacamole pass credentials this way ?
>

No, not quite this simply, anyway - this is a "limitation" of OpenID - but
really more of a design feature. One of the key purposes of SSO is that
there is no need for the sensitive credentials to be passed around from
application to application. Because of this, OpenID, once it authenticates
the user, does not provide any way for those credentials - the password,
specifically - to be retrieved, which means Guacamole doesn't even know the
password to be able to pass them on. The username should be known, and,
assuming the OpenID username matches the RDP username, that part should
work.


> If not, is there any other way to edit credentials on the fly (in other
> words, pass "Username" and "Password" fields of an RDP Connection in
> Guacamole as the connection is launched) ?
>

Yes, if you leave the username and/or password fields blank, Guacamole will
prompt you for the missing credentials at the time the connection is
launched.

The other option is to use a kev vault - currently Keeper Secrets Manager
is the only one supported - to retrieve secrets on-the-fly, but that
requires that you have that up and running in your environment, or that you
implement another key vault.

-Nick