Re: Understanding Sharing Profile for Non-Admins

[Rasmus Haslund]

Is it not possible to pre-share a connection that another non-admin user can 
use to “monitor” a users connection?

With best regards,
Rasmus Haslund
Principal Technologist & VMCT Program Manager | Veeam Software | Phone: +40 372 
821 972 | Twitter: @haslund

From: "Leath, Austin" 
Reply to: "user@guacamole.apache.org" 
Date: Tuesday, 1 March 2022 at 18.40
To: "user@guacamole.apache.org" 
Subject: RE: Re: Understanding Sharing Profile for Non-Admins

CAUTION - This email originated from outside of Veeam. Do not click links or 
open attachments unless you recognize the sender.

Hello, we are utilizing the guacamole API and are really wanting to know if 
there is a PATCH API endpoint that allows us to add sharing profile connection 
permissions to user groups programmatically. All of the sharing profile 
connections are already created, all we need to do is figure out a way to add 
permissions for specific user groups to access them

I have been using some documentation that I found on GitHub that covers another 
version of Guacamole (Version 1.1.0), and while I know it is out of date it has 
mostly everything we need to create synchronization scripts.

I made an issue in that GitHub project that better describes what we are 
looking for: 
https://github.com/ridvanaltun/guacamole-rest-api-documentation/issues/8


On 2022/03/01 01:08:18 Mike Jumper wrote:
> On Mon, Feb 28, 2022, 12:42 Khoe, Yonathan 
> mailto:yo...@unt.edu>> wrote:
>
> > Hello,
> >
> > We set up sharing profiles for all of our connections under an admin
> > account.  We want the ability for our students to be able to generate a
> > share link to their connection viewing (to their professor) when they are
> > remoted to a machine.  We thought that this was the idea when we create the
> > sharing profiles individually and giving them a read-only option and name,
> > but it turns out that our students cannot see the “Share” button when
> > opening the Guacamole menu (ctrl+alt+shift).  The student accounts
> > themselves do not have any permissions; the user groups that the students
> > belong to also do not have permissions set (we only use it to assign the
> > connection groups).  Are we missing something in terms of letting
> > non-admins to be able to generate a share link to be given to other people?
> >
>
> You need to additionally grant the users (or the relevant group) access to
> the sharing profile, not just the connection. Only users with access to a
> particular sharing profile will be able to share the relevant connection
> using that profile.
>
> - Mike
>

Re: [EXT] Re: Re: Understanding Sharing Profile for Non-Admins

[Leath, Austin]

Thank you so much! This solves my issue

From: Nick Couchman 
Date: Tuesday, March 1, 2022 at 12:48 PM
To: user@guacamole.apache.org 
Subject: [EXT] Re: Re: Understanding Sharing Profile for Non-Admins
On Tue, Mar 1, 2022 at 12:33 PM Leath, Austin 
mailto:austin.le...@unt.edu>> wrote:
Hello, we are utilizing the guacamole API and are really wanting to know if 
there is a PATCH API endpoint that allows us to add sharing profile connection 
permissions to user groups programmatically. All of the sharing profile 
connections are already created, all we need to do is figure out a way to add 
permissions for specific user groups to access them


This can definitely be done programmatically. The correct endpoint would be a 
PATCH:
api/session/data/postgresql/userGroups//permissions

and the patch would look something like this:
[
  {
op: "add",
path: "/sharingProfilePermissions/",
value: "READ"
  }
]

I just pulled this information out of the "Network" tab in my browser's 
developer tools section, so it might take some tweaking to get it right, but 
that should put you on the right track.

-Nick

Re: Re: Understanding Sharing Profile for Non-Admins

[Nick Couchman]

On Tue, Mar 1, 2022 at 12:33 PM Leath, Austin  wrote:

> Hello, we are utilizing the guacamole API and are really wanting to know
> if there is a PATCH API endpoint that allows us to add sharing profile
> connection permissions to user groups programmatically. All of the sharing
> profile connections are already created, all we need to do is figure out a
> way to add permissions for specific user groups to access them
>
>
>

This can definitely be done programmatically. The correct endpoint would be
a PATCH:
api/session/data/postgresql/userGroups//permissions

and the patch would look something like this:
[
  {
op: "add",
path: "/sharingProfilePermissions/",
value: "READ"
  }
]

I just pulled this information out of the "Network" tab in my browser's
developer tools section, so it might take some tweaking to get it right,
but that should put you on the right track.

-Nick

>

RE: Re: Understanding Sharing Profile for Non-Admins

[Leath, Austin]

Hello, we are utilizing the guacamole API and are really wanting to know if 
there is a PATCH API endpoint that allows us to add sharing profile connection 
permissions to user groups programmatically. All of the sharing profile 
connections are already created, all we need to do is figure out a way to add 
permissions for specific user groups to access them

I have been using some documentation that I found on GitHub that covers another 
version of Guacamole (Version 1.1.0), and while I know it is out of date it has 
mostly everything we need to create synchronization scripts.

I made an issue in that GitHub project that better describes what we are 
looking for: 
https://github.com/ridvanaltun/guacamole-rest-api-documentation/issues/8


On 2022/03/01 01:08:18 Mike Jumper wrote:
> On Mon, Feb 28, 2022, 12:42 Khoe, Yonathan 
> mailto:yo...@unt.edu>> wrote:
>
> > Hello,
> >
> > We set up sharing profiles for all of our connections under an admin
> > account.  We want the ability for our students to be able to generate a
> > share link to their connection viewing (to their professor) when they are
> > remoted to a machine.  We thought that this was the idea when we create the
> > sharing profiles individually and giving them a read-only option and name,
> > but it turns out that our students cannot see the “Share” button when
> > opening the Guacamole menu (ctrl+alt+shift).  The student accounts
> > themselves do not have any permissions; the user groups that the students
> > belong to also do not have permissions set (we only use it to assign the
> > connection groups).  Are we missing something in terms of letting
> > non-admins to be able to generate a share link to be given to other people?
> >
>
> You need to additionally grant the users (or the relevant group) access to
> the sharing profile, not just the connection. Only users with access to a
> particular sharing profile will be able to share the relevant connection
> using that profile.
>
> - Mike
>

Re: Understanding Sharing Profile for Non-Admins

[Mike Jumper]

On Mon, Feb 28, 2022, 12:42 Khoe, Yonathan  wrote:

> Hello,
>
> We set up sharing profiles for all of our connections under an admin
> account.  We want the ability for our students to be able to generate a
> share link to their connection viewing (to their professor) when they are
> remoted to a machine.  We thought that this was the idea when we create the
> sharing profiles individually and giving them a read-only option and name,
> but it turns out that our students cannot see the “Share” button when
> opening the Guacamole menu (ctrl+alt+shift).  The student accounts
> themselves do not have any permissions; the user groups that the students
> belong to also do not have permissions set (we only use it to assign the
> connection groups).  Are we missing something in terms of letting
> non-admins to be able to generate a share link to be given to other people?
>

You need to additionally grant the users (or the relevant group) access to
the sharing profile, not just the connection. Only users with access to a
particular sharing profile will be able to share the relevant connection
using that profile.

- Mike

Understanding Sharing Profile for Non-Admins

[Khoe, Yonathan]

Hello,
We set up sharing profiles for all of our connections under an admin account.  
We want the ability for our students to be able to generate a share link to 
their connection viewing (to their professor) when they are remoted to a 
machine.  We thought that this was the idea when we create the sharing profiles 
individually and giving them a read-only option and name, but it turns out that 
our students cannot see the "Share" button when opening the Guacamole menu 
(ctrl+alt+shift).  The student accounts themselves do not have any permissions; 
the user groups that the students belong to also do not have permissions set 
(we only use it to assign the connection groups).  Are we missing something in 
terms of letting non-admins to be able to generate a share link to be given to 
other people?

Thanks in advanced.

Yonathan Khoe
Senior Systems Administrator
CVAD IT

University of North Texas
940.565.4793
yonat...@unt.edu
https://itservices.cvad.unt.edu/