Mailing-List: contact user-help@guacamole.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@guacamole.apache.org
MIME-Version: 1.0
In-Reply-To: <1510932575660-0.post@n4.nabble.com>
References: <1510932575660-0.post@n4.nabble.com>
From: Nick Couchman <vnick@apache.org>
Date: Fri, 17 Nov 2017 11:15:57 -0500
Message-ID: <CAFjj600_S4g5y1F6XW7KdZNEy9FttuD9Se0yBOW28GKzhAjHwg@mail.gmail.com>
Subject: Re: HTTP header authentication not working. Infomation missing
To: user@guacamole.apache.org
Content-Type: multipart/alternative; boundary="089e082751604a8058055e300db6"
archived-at: Fri, 17 Nov 2017 16:16:02 -0000

--089e082751604a8058055e300db6
Content-Type: text/plain; charset="UTF-8"

On Fri, Nov 17, 2017 at 10:29 AM, Masood <masoodhussain10@gmail.com> wrote:

> I am trying to add HTTP header auth extension into guacamole. I have
> followed
> all the instructions from the chapter 9 of Manual. The jar file is in the
> extension folder, but I don't see any new loaded extension in syslog. I
> have
> not added any new property to the guacamole.properties. As it is optional
>
> I am using Tomcat 7. Do I need to change some properties in Tomcat to allow
> HTTP headers?
>
> Also, I don't understand the following line in manual "If your
> authentication system uses a different HTTP header" I don't have any
> authentication system. Do I need to install it? Is it in Tomcat or 3rd
> party
> application.
>

You need to configure your web server - either Tomcat or your reverse proxy
web server, if you're proxying it through nginx or httpd, for example - to
do HTTP authentication.  You can find configuration examples for BASIC
authentication in the following document - item #5:

http://archive.oreilly.com/pub/a/java/archive/tomcat-tips.html

If you're proxying Guacamole through Apache httpd, you'd do something like
this in your configuration:

<Location /guacamole>
   ...
    AuthType basic
    AuthName "Basic Authentication"
    AuthBasicProvider file
    AuthUserFile /etc/httpd/guacamole.users
    Require valid-user
</Location>

By default Apache will set the REMOTE_USER header during authentication,
which should be passed through to Tomcat and accessible by Guacamole.
Nginx has similar options:

https://www.nginx.com/resources/admin-guide/restricting-access-auth-basic/

-Nick

--089e082751604a8058055e300db6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On F=
ri, Nov 17, 2017 at 10:29 AM, Masood <span dir=3D"ltr">&lt;<a href=3D"mailt=
o:masoodhussain10@gmail.com" target=3D"_blank">masoodhussain10@gmail.com</a=
>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0p=
x 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I =
am trying to add HTTP header auth extension into guacamole. I have followed=
<br>
all the instructions from the chapter 9 of Manual. The jar file is in the<b=
r>
extension folder, but I don&#39;t see any new loaded extension in syslog. I=
 have<br>
not added any new property to the guacamole.properties. As it is optional<b=
r>
<br>
I am using Tomcat 7. Do I need to change some properties in Tomcat to allow=
<br>
HTTP headers?<br>
<br>
Also, I don&#39;t understand the following line in manual &quot;If your<br>
authentication system uses a different HTTP header&quot; I don&#39;t have a=
ny<br>
authentication system. Do I need to install it? Is it in Tomcat or 3rd part=
y<br>
application.<br></blockquote><div><br></div><div>You need to configure your=
 web server - either Tomcat or your reverse proxy web server, if you&#39;re=
 proxying it through nginx or httpd, for example - to do HTTP authenticatio=
n.=C2=A0 You can find configuration examples for BASIC authentication in th=
e following document - item #5:</div><div><br></div><div><a href=3D"http://=
archive.oreilly.com/pub/a/java/archive/tomcat-tips.html">http://archive.ore=
illy.com/pub/a/java/archive/tomcat-tips.html</a></div><div><br></div><div>I=
f you&#39;re proxying Guacamole through Apache httpd, you&#39;d do somethin=
g like this in your configuration:</div><div><br></div><div>&lt;Location /g=
uacamole&gt;<br>=C2=A0 =C2=A0...</div><div>=C2=A0 =C2=A0 AuthType basic</di=
v><div>=C2=A0 =C2=A0 AuthName &quot;Basic Authentication&quot;</div><div>=
=C2=A0 =C2=A0 AuthBasicProvider file</div><div>=C2=A0 =C2=A0 AuthUserFile /=
etc/httpd/guacamole.users</div><div>=C2=A0 =C2=A0 Require valid-user</div><=
div>&lt;/Location&gt;</div><div><br></div><div>By default Apache will set t=
he REMOTE_USER header during authentication, which should be passed through=
 to Tomcat and accessible by Guacamole.=C2=A0 Nginx has similar options:</d=
iv><div><br></div><div><a href=3D"https://www.nginx.com/resources/admin-gui=
de/restricting-access-auth-basic/">https://www.nginx.com/resources/admin-gu=
ide/restricting-access-auth-basic/</a><br></div><div><br></div><div>-Nick</=
div></div></div></div>

--089e082751604a8058055e300db6--