Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 55E0E200B40 for ; Fri, 1 Jul 2016 21:07:20 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id 546F8160A61; Fri, 1 Jul 2016 19:07:20 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 52CD5160A4D for ; Fri, 1 Jul 2016 21:07:19 +0200 (CEST) Received: (qmail 89930 invoked by uid 500); 1 Jul 2016 19:07:18 -0000 Mailing-List: contact user-help@guacamole.incubator.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@guacamole.incubator.apache.org Delivered-To: mailing list user@guacamole.incubator.apache.org Received: (qmail 89915 invoked by uid 99); 1 Jul 2016 19:07:18 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd3-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 01 Jul 2016 19:07:18 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd3-us-west.apache.org (ASF Mail Server at spamd3-us-west.apache.org) with ESMTP id C534F187B83 for ; Fri, 1 Jul 2016 19:07:17 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd3-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 1.279 X-Spam-Level: * X-Spam-Status: No, score=1.279 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=2, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=disabled Authentication-Results: spamd3-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=guac-dev-org.20150623.gappssmtp.com Received: from mx1-lw-us.apache.org ([10.40.0.8]) by localhost (spamd3-us-west.apache.org [10.40.0.10]) (amavisd-new, port 10024) with ESMTP id voLyoTXKXOQy for ; Fri, 1 Jul 2016 19:07:15 +0000 (UTC) Received: from mail-vk0-f45.google.com (mail-vk0-f45.google.com [209.85.213.45]) by mx1-lw-us.apache.org (ASF Mail Server at mx1-lw-us.apache.org) with ESMTPS id 1C3BC5F56C for ; Fri, 1 Jul 2016 19:07:15 +0000 (UTC) Received: by mail-vk0-f45.google.com with SMTP id k68so78292852vkb.0 for ; Fri, 01 Jul 2016 12:07:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=guac-dev-org.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=pR9Zf3iDAu9c3xy7HA/rQRLb5im/QamoSi0sHfa0pSI=; b=sWgsQg/Cdn1d0quaJ6tlvGYouq9yamB++K50wJmv4SKUtHfeLCB1VElAnz8sTEym6i OwAOiSnZQ+L1JqoTzr4jq5ZMie+Tf3JAXQGluvRD0EoNl7HCfJn+rBblHCmPN9BfPUGV NHGaSe1FtoNmSvN1G1omGI4QE12JtdBrS2KdszCipvVds1h+6qRfvpz29GJUqcmZeFn5 vlcebRyLLHRImO7tAPxJsre6HxG+BeCydOycz19DEG8SekpUEVNtUpgRmBRnWI9HfvVZ ajWA4qYvZnJeDBE90gWFJNtd3aUL1OeWnRWqJ710eBNFZLaAEeFAfhI+vDDe2EjwLnbs e8hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=pR9Zf3iDAu9c3xy7HA/rQRLb5im/QamoSi0sHfa0pSI=; b=j0RQYufatYIjFSIpL+Ixq7OQj1cpXuXgnvrPbASL8zULK8sk3O3ql4zccI6oNa+5Yt 5j4PH3XvUz4DC9MHFRf2wp7IgQaxIQLvM2g7/1bDo/QbJ00zncDK8TSyKeb+7ZvHWivd 8+XMd+TRfYfVnJkxg5EA0OG+DEjf5+PXdw3QeMo06G/OA7TbvCkj5Tsr5ZCtQ9SiL3xD qJlqYWnFiQiCv+QGAP+AbhkEZFSTz5vwldicfHJMLywprSppq9H8qapx+V59sVawCvLY TdbaSqm3ZNzpNInkEIekOIPx2CXLWB8GKsCfpWLHPUg/S+XynremVjzVsotZm3uLPCp/ +99g== X-Gm-Message-State: ALyK8tJAce7SQ0k92xSSEOvmp5IYwqp9a9a71on1lHKTTjPALIuHoyRDF1+sQRCYaryN7XE3goVKdcJ2xUY9xQ== X-Received: by 10.31.168.3 with SMTP id r3mr10331505vke.8.1467400033448; Fri, 01 Jul 2016 12:07:13 -0700 (PDT) MIME-Version: 1.0 Received: by 10.176.4.38 with HTTP; Fri, 1 Jul 2016 12:07:12 -0700 (PDT) X-Originating-IP: [67.164.58.106] In-Reply-To: References: From: Mike Jumper Date: Fri, 1 Jul 2016 12:07:12 -0700 Message-ID: Subject: Re: Custom Authentication with DIGITAL Certificate from a Apache HTTP Reverse Proxy To: user@guacamole.incubator.apache.org Content-Type: multipart/alternative; boundary=001a11426a68bcca03053697b159 archived-at: Fri, 01 Jul 2016 19:07:20 -0000 --001a11426a68bcca03053697b159 Content-Type: text/plain; charset=UTF-8 On Tue, Jun 21, 2016 at 7:38 AM, Massimo Cusumano wrote: > Hi, > > I have an Apache HTTP Server with SSL authentication (Client > certificate Authentication). This Apache HTTP Server reverse proxies from > port 443 to Guacamole ajp port 8009 > > The Guacamole setup uses the mysql jdbc authentication extension > (guacamole-auth-jdbc-mysql-0.9.9.jar). > > I wrote an extension that perform authentication based on the "Common > Name" of the user's Client Digital Certificate. The extension retrieves the > "Common Name" from the certificate and the "Common Name" is then used by > MYSQL authenticator (MYSQL authenticator trusts the extension > authentication). > > Now, when I browse to Guacamole web portal (https://MYIP/guacamole/), a > client certificate is required by Apache; after I select the client > certificate, the "default Guacamole login page" is displayed (index.html) > and when clicking on the Login button (without entering any > username/password) I can access with success to the "Guacamole Home Screen" > > My questions are: > - Can I customize the "default Guacamole login page" to remove the > username and password field and leave only the "Login" button? > There is no login "page" per se - the username and password fields are generated dynamically, based on a machine-readable description of the credentials required when an authentication attempt fails: http://guacamole.incubator.apache.org/doc/guacamole-ext/org/glyptodon/guacamole/net/auth/credentials/GuacamoleInvalidCredentialsException.html http://guacamole.incubator.apache.org/doc/guacamole-ext/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.html If you do not wish the username/password fields to appear, then simply do not ask for them when you throw your GuacamoleInvalidCredentialsException. The part of the code that actually does this within the JDBC auth is here: https://github.com/apache/incubator-guacamole-client/blob/3c2dbbe4f9577ed7da97acec7412c2e43ee48122/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/AuthenticationProviderService.java#L80-L81 Some older code may not throw these exceptions at all, relying instead on behavior providing backwards compatibility with older versions of Guacamole that did not have these exceptions. In such a case, Guacamole would throw this exception for you, and would include the username/password fields. - Can I insert the "common name" of the certificate in the login page (e.g. > Welcome " " User; > or > - Can I bypass the "default login page" and connect directly to the > "Guacamole Home Screen"? > There no need to bypass it, as it doesn't truly exist. The authentication system is flexible enough that if you don't wish to prompt the user for credentials, then all you need to do is not ask for them. Visiting any page within Guacamole results in an authentication / reauthentication attempt, so your AuthenticationProvider will be queried and requeried regarding whether the user is authorized. The login form appears only in response to an error thrown by the extension indicating that additional credentials are required, or that the provided credentials are invalid. If your AuthenticationProvider's authenticateUser() implementation returns an AuthenticatedUser and does not throw a GuacamoleInvalidCredentialsException (or GuacamoleInsufficientCredentialsException), then they will not be prompted for anything. Thanks, - Mike --001a11426a68bcca03053697b159 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= ue, Jun 21, 2016 at 7:38 AM, Massimo Cusumano <maxcus.w@gmail.com>= wrote:
Hi,

I have an Apache HTTP Server with=C2=A0 SSL authentica= tion=C2=A0=20 (Client certificate=C2=A0 Authentication). This Apache HTTP Server reverse= =20 proxies from port 443 to Guacamole ajp port=C2=A0 8009

The=C2=A0 Gua= camole setup uses the mysql jdbc authentication extension (guacamole-auth-j= dbc-mysql-0.9.9.jar).

I wrote an extension that perform authentication based on=C2=A0 the "Co= mmon=20 Name" of the user's Client Digital Certificate. The extension retr= ieves=20 the "Common Name" from the certificate and the "Common Name&= quot; is then=20 used by MYSQL authenticator (MYSQL authenticator trusts the extension=20 authentication).

Now, when I browse to=C2=A0 Guacamole web portal (<= a href=3D"https://MYIP/guacamole/" target=3D"_blank">https://MYIP/guacamole= /), a client certificate is required by Apache; after I select the=C2=A0 clien= t=20 certificate, the=C2=A0=C2=A0 "default Guacamole login page" is di= splayed=20 (index.html) and when clicking=C2=A0 on the Login button (without entering= =20 any username/password) I can access with success to the "Guacamole Hom= e=20 Screen"

My questions are:
- Can I customize the "defaul= t=20 Guacamole login page"=C2=A0 to remove the username and password field = and=20 leave only the "Login" button?

There is no login "page" per se - the username and passw= ord fields are generated dynamically, based on a machine-readable descripti= on of the credentials required when an authentication attempt fails:
<= div>


If you do not wish the username/pass= word fields to appear, then simply do not ask for them when you throw your = GuacamoleInvalidCredentialsException.

The part of = the code that actually does this within the JDBC auth is here:

Some older code may not throw = these exceptions at all, relying instead on behavior providing backwards co= mpatibility with older versions of Guacamole that did not have these except= ions. In such a case, Guacamole would throw this exception for you, and wou= ld include the username/password fields.

- Can I insert the &qu= ot;common name" of the certificate in the login page (e.g. Welcome &qu= ot;<Common Name> " User;
or
- Can I bypass the "defau= lt login page" and connect directly to the "Guacamole Home Screen= "?

There no need to bypass it, a= s it doesn't truly exist. The authentication system is flexible enough = that if you don't wish to prompt the user for credentials, then all you= need to do is not ask for them.

Visiting any page= within Guacamole results in an authentication / reauthentication attempt, = so your AuthenticationProvider will be queried and requeried regarding whet= her the user is authorized. The login form appears only in response to an e= rror thrown by the extension indicating that additional credentials are req= uired, or that the provided credentials are invalid.

If your AuthenticationProvider's authenticateUser() implementation r= eturns an AuthenticatedUser and does not throw a GuacamoleInvalidCredential= sException (or GuacamoleInsufficientCredentialsException), then they will n= ot be prompted for anything.

Thanks,

- Mike

--001a11426a68bcca03053697b159--