I was wondering if I could get some help on troubleshooting authorization using SAML. I’m running guacamole in docker behind Nginx. It’s guacamole version 1.6.0. I’m successfully able to authenticate via SAML using our IDP. My understanding is that if we create a local group in guacamole, as long as it matches the group passed by the IDP you can enforce privileges and connections based upon the group membership. The issue I’m having is that it seems that Guacamole is not picking up the group from the SAML assertion. I’ve verified that our IDP is sending the group name in the assertion via a Chrome browser SAML Tracer. I had it working for a moment, although it didn’t seem like it was enforcing privilege and now it stopped working. I’ve attached some logs and my relevant parts of my docker-compose.yml file, I’ve sanitized portions of both. Any help or guidance would be greatly appreciated.
Thanks, Eric I have a local group created in guacamole named cn=Engineering Log entries from when it worked: 18:39:13.366 [http-nio-8080-exec-4] INFO o.a.g.event.EventLoggingListener - User "ek***[email protected]" (authenticated by "saml") successfully created user group "cn=Engineering" within “mysql" 18:39:21.704 [http-nio-8080-exec-10] INFO o.a.g.event.EventLoggingListener - User "ek***[email protected]" (authenticated by "saml") successfully updated user group "cn=Engineering" within "mysql" Log entries from when it’s not working: 9:00:06.902 [main] INFO o.a.g.extension.ExtensionModule - Multiple extensions are installed and will be loaded in order of decreasing priority: 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [saml] "SAML Authentication Extension" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-auth-sso-saml.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [mysql] "MySQL Authentication" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-auth-jdbc-mysql.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [ban] "Brute-force Authentication Detection/Prevention" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-auth-ban.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [recording-storage] "Session Recording Storage" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-history-recording-storage.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - To change this order, set the "extension-priority" property or rename the extension files. The default priority of extensions is dictated by the sort order of their filenames. 19:00:07.050 [main] INFO o.a.g.extension.ExtensionModule - Extension "SAML Authentication Extension" (saml) loaded. …… 22:59:17.092 [http-nio-8080-exec-2] INFO o.a.g.event.EventLoggingListener - User "ek***[email protected]" (authenticated by "saml") successfully authenticated from 10.1.4.65 Docker-compose.yml guacamole-local: image: guacamole/guacamole:latest container_name: guacamole-local restart: unless-stopped group_add: - "1000" volumes: # HOST PATH : CONTAINER PATH (set to read-only 'ro' for safety) - /home/guac_recordings:/var/lib/guacamole/recordings:ro - /opt/guacamole/tomcat/server.xml:/usr/local/tomcat/conf/server.xml:ro #- /opt/guacamole/extensions:/etc/guacamole/extensions depends_on: - guacdb - guacd ports: - "127.0.0.1:8081:8080" environment: GUACD_HOSTNAME: guacd MYSQL_HOSTNAME: guacdb MYSQL_DATABASE: guacamole_db MYSQL_USER: guacamole_user MYSQL_PASSWORD: password RECORDING_SEARCH_PATH: /var/lib/guacamole/recordings EXTENSION_PRIORITY: saml, mysql EXTENSIONS: auth-jdbc-mysql, history-recording-storage SAML_IDP_METADATA_URL: https://app.myidp.com/saml/metadata/metadata-string SAML_ENTITY_ID: guardian SAML_CALLBACK_URL: https://callbackurl.mydomain.io:8080/guacamole/ SAML_GROUP_ATTRIBUTE: groups SAML_DEBUG: "true" SAML_STRICT: "false" MYSQL_AUTO_CREATE_ACCOUNTS: "true" MYSQL_DISABLE_AUTH: "false" JAVA_OPTS: "-Dguacamole.log.level=DEBUG" CASE_SENSITIVE_AUTH: "false"
