Mailing-List: contact user-help@guacamole.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@guacamole.incubator.apache.org
MIME-Version: 1.0
In-Reply-To: <1506615618837-0.post@n4.nabble.com>
References: <1506116383746-0.post@n4.nabble.com> <CALKeL-PT3zi0mv6efSkouvPujUEHeMYn4PQqgUhz7aZ0a5x=+g@mail.gmail.com>
 <1506452175565-0.post@n4.nabble.com> <1506548113921-0.post@n4.nabble.com>
 <CAFjj601Dm-2vCqPxhYUOKLdEo_Ps2OzL8nHRnLpdQ0q3=G6BSg@mail.gmail.com>
 <CAFjj600uc2nYxTOEaRMWnbSAA-vcAhVOX6xZLanQAHH3hRJymw@mail.gmail.com>
 <CAFjj603pPEd=yDTPaQ+4eaON7VBTC48bQ+riGy17cOSGh1DNBg@mail.gmail.com> <1506615618837-0.post@n4.nabble.com>
From: Nick Couchman <vnick@apache.org>
Date: Thu, 28 Sep 2017 12:23:55 -0400
Message-ID: <CAFjj60162V2ch6T_iWdorunCu6g1NqbaWeo1Jm5d-QAaKu_WPw@mail.gmail.com>
Subject: Re: Handling a SAML POST response
To: user@guacamole.incubator.apache.org
Content-Type: multipart/alternative; boundary="94eb2c0941c2c0a968055a42556c"
archived-at: Thu, 28 Sep 2017 16:24:04 -0000

--94eb2c0941c2c0a968055a42556c
Content-Type: text/plain; charset="UTF-8"

On Thu, Sep 28, 2017 at 12:20 PM, Colin McGuigan <
colin_guacamole@walkingshadows.org> wrote:

> Nick;
>
> Thanks for all your help.  Let me elaborate.
>
> When I say I have a REST service, it's just as you described -- a WS
> annotated class that is returned from the authentication provider's
> getResource method.  I can call this REST service just fine, and know that
> it works.
>
>
Very nice.


> This service takes in as POST (from the SAML identity provider), calls the
> existing /api/tokens endpoint, passing all of the same content, and
> receives
> a Guacamole authentication token -- ie, the user is know authenticated by
> Guacamole (specifically by my authentication provider), and is stored in
> the
> session.  This also works.  I receive the token just fine.
>
> The problem is I need to pass this token, somehow, to the Guacamole UI so
> that when it calls /api/tokens itself, it can pass in the same token.  The
> essentials of the REST method:
>
>     @POST
>     @Path("/postredirect")
>     public Response redirectSamlPostToGet(@Context HttpServletRequest
> request, String content) throws GuacamoleException, URISyntaxException {
>         try {
>                 String token = callTokenService(request, content);
>                 return Response.seeOther(new URI("http://
> <site>/guacamole/#/token=" +
> token)).build();
>         } catch (Exception e) {
>                 logger.error("Error occurred in postredirect", e);
>                 throw new RuntimeException(e);
>         }
>     }
>
> There is no errors in the logs.  In network traffic I see the redirect
> happen correctly.  However, Guacamole is ignoring the token=<token> portion
> of the URL.  I've tried using id_token instead, but that is also ignored.
>
>
What if you try:

 return Response.seeOther(new URI("http://<site>/guacamole/#/?token=" +
token)).build();

(Add the ? between the token parameter and the Guacamole URL).  Does that
work?

-Nick

--94eb2c0941c2c0a968055a42556c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Thu, Sep 28, 2017 at 12:20 PM, Colin McGuigan <span dir=3D"ltr">&lt;=
<a href=3D"mailto:colin_guacamole@walkingshadows.org" target=3D"_blank">col=
in_guacamole@walkingshadows.org</a>&gt;</span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex">Nick;<br>
<br>
Thanks for all your help.=C2=A0 Let me elaborate.<br>
<br>
When I say I have a REST service, it&#39;s just as you described -- a WS<br=
>
annotated class that is returned from the authentication provider&#39;s<br>
getResource method.=C2=A0 I can call this REST service just fine, and know =
that<br>
it works.<br>
<br></blockquote><div><br></div><div>Very nice.</div><div>=C2=A0</div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex">
This service takes in as POST (from the SAML identity provider), calls the<=
br>
existing /api/tokens endpoint, passing all of the same content, and receive=
s<br>
a Guacamole authentication token -- ie, the user is know authenticated by<b=
r>
Guacamole (specifically by my authentication provider), and is stored in th=
e<br>
session.=C2=A0 This also works.=C2=A0 I receive the token just fine.<br>
<br>
The problem is I need to pass this token, somehow, to the Guacamole UI so<b=
r>
that when it calls /api/tokens itself, it can pass in the same token.=C2=A0=
 The<br>
essentials of the REST method:<br>
<br>
=C2=A0 =C2=A0 @POST<br>
=C2=A0 =C2=A0 @Path(&quot;/postredirect&quot;)<br>
=C2=A0 =C2=A0 public Response redirectSamlPostToGet(@Context HttpServletReq=
uest<br>
request, String content) throws GuacamoleException, URISyntaxException {<br=
>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 try {<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 String token =3D ca=
llTokenService(request, content);<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return Response.see=
Other(new URI(&quot;http://&lt;site&gt;/guacamole/#<wbr>/token=3D&quot; +<b=
r>
token)).build();<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 } catch (Exception e) {<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 logger.error(&quot;=
Error occurred in postredirect&quot;, e);<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 throw new RuntimeEx=
ception(e);<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 }<br>
=C2=A0 =C2=A0 }<br>
<br>
There is no errors in the logs.=C2=A0 In network traffic I see the redirect=
<br>
happen correctly.=C2=A0 However, Guacamole is ignoring the token=3D&lt;toke=
n&gt; portion<br>
of the URL.=C2=A0 I&#39;ve tried using id_token instead, but that is also i=
gnored.<br>
<div class=3D"gmail-HOEnZb"><div class=3D"gmail-h5"><br></div></div></block=
quote><div><br></div><div>What if you try:</div><div><br></div><div>=C2=A0r=
eturn Response.seeOther(new URI(&quot;http://&lt;site&gt;/guacamole/#/?toke=
n=3D&quot; +</div><div>token)).build();</div><div><br></div><div>(Add the ?=
 between the token parameter and the Guacamole URL).=C2=A0 Does that work?<=
/div><div><br></div><div>-Nick</div></div></div></div>

--94eb2c0941c2c0a968055a42556c--