On Fri, Apr 6, 2018 at 8:59 AM, Fertig, Brian <brian.fer...@philips.com> wrote:
> Greetings! > > > > Im looking to setup Guacamole for 2FA. I have setup multiOTP and would > like to see if its possible to have Guacamole use LDAP for user component > and then multiOTP (radius) for the 2nd factor piece. Is this possible? > Can someone direct me to documentation on how to setup the environment this > way? I have the documentation for LDAP just looking for radius/TOTP > documentation. > > > The RADIUS extension has not been officially released, yet, so the documentation is not on the web site. You can check out the latest guacamole-client git repo and build it with the "-Plgpl-extensions" flag to build the RADIUS module. If you do that you'll also need to check out the latest guacamole-server code and build and use that. We're actively working toward a 1.0.0 release, which will include this (and many, many more) changes. If you need the documentation for the RADIUS module you'll need to check out the guacamole-manual git repo and build that manual, and you can find the documentation for RADIUS. However, I will caution that, based on what you've said, I don't think LDAP + RADIUS is actually what you want to do. The way I tested 2FA with RADIUS in Guacamole was using LinOTP + FreeRADIUS, and the authentication was done entirely through RADIUS. If you're looking to add a second factor to LDAP authentication for Guacamole, and you want to do it through something like multiOTP, you probably want to set up multiOTP to authenticate first with LDAP and then move on to the second factor - if you rely on Guacamole to do both LDAP and RADIUS, LDAP is going to succeed and log the user in and won't know to move on to RADIUS. Alternatively you can use the recently-merged guacamole-auth-totp module to do this inside Guacamole, and you should be able to layer the modules such that LDAP can do the primary authentication and then the TOTP module will prompt for the second factor. I think Mike is still working documentation for this module, so you'll have to go back through the mailing list and find documentation on how to use it, but it should eliminate the need to do RADIUS authentication for Guacamole unless you're using RADIUS for other stuff in your environment. -Nick
