PGina <-> Guacamole

[Ali Zamani]

Hi. Is there any way to integrate PGina talking to Apache Guacamole in web-based remote desktop connections?
https://guacamole.apache.org/
https://github.com/apache/guacamole-server

[wyatt-made]

Were you ever able to get this to work? I have ~300 computers on Guac right now and would love to be able to pass user credentials into pgina from guac.

[Ali Zamani]

Nope - Guaca can directly talk to Active Directory and no issue if you manage your nodes in Microsoft only environment. My setup is in mixed Unix-Windows environment and pGina is the middle man talking between LDAP and Active Directory (https://www.informit.com/articles/article.aspx?p=330803&seqNum=2). Therefore, Guaca can't communicate with pGina as Windows GINA plugin. So what happens now, user will again enter credential at Windows login page to re-authenticate after logging into Guacamole. Same LDAP database is used here for both pGina and Guacamole authentication.
Please share if you could find any plugin/solution for this.

[Zosoworld]

I would also be very interested in a solution like this. Having the users log in twice is annoying.

[Ali Zamani]

solution: pass credential as parameter token in connection setting. So, same credential used for logging into guaca will be passed into pGina.
https://guacamole.apache.org/doc/gug/configuring-guacamole.html#parameter-tokens

[wyatt-made]

Did this work for you? I've tried this and it didn't work for me. What version of pGina are you running? I'm on pgina v3.1.8.0 and Guac v1.3.0

[Ali Zamani]

It works but randomly sending guaca credentials to "other user" mode in pgina. Trying to find a way to solve this. Same version: guaca 1.3.0 and pgina 3.1.8.0 stable.
Just put username: ${GUAC_USERNAME} and password: ${GUAC_PASSWORD} in guaca connection setting and it will pass same login credential to pgina to login. ATM, looking for the setting to make LDAP login in pgina default, so it directly logs into windows without further manual authentication.

[wyatt-made]

That's what I've been trying ($GUAC_Credentials) and it won't pass through to pGina. Would you mind sharing your guac connection settings?

…

On Thu, Sep 9, 2021 at 7:12 AM Ali Zamani ***@***.***> wrote: It works but randomly sending guaca credentials to "other user" mode in pgina. Trying to find a way to solve this. Same version: guaca 1.3.0 and pgina 3.1.8.0 stable. Just put username: ${GUAC_USERNAME} and password: ${GUAC_PASSWORD} in guaca connection setting and it will pass same login credential to pgina to login. ATM, looking for the setting to make LDAP login in pgina default, so it directly logs into windows without further manual authentication. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#365 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ARPGZ3KW7RLUNLQWHW6ASHDUBCJDRANCNFSM4IT5ITXA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- *Wyatt Madej* *Desktop Operations System Administrator* Riverdale, NY 10471 ***@***.*** ***@***.***>

[Ali Zamani]

EDIT CONNECTION
Protocol: RDP

PARAMETERS
Network
Hostname: IP/Domain
Port: 3389
Authentication
Username: ${GUAC_USERNAME}
Password: ${GUAC_PASSWORD}

[Ali Zamani]

If it takes you to pGina "other user" mode saying your credential's incorrect, try to login to Windows with ldap credential and disconnect session, then re-try to login by refreshing the page or establishing the connection in guaca home (dashboard) and you'll get through directly with no further manual authentication. Trying to make ldap authentication in pgina default, still no success. Have made pgina default authentication tool as well but no change: https://www.thewindowsclub.com/assign-default-credential-provider-windows-10

[wyatt-made]

I figured out why it's giving me issues. It's not a Guac issue, but rather how we have our SSO/login configured. In our case, guac never sees the users actual password, so using the respective parameter token just inputs a random string into the password entry. That being said, I'm using Guac in an educational computer lab environment, with a variety of different users logging in, and the "Other User" has never been an issue for us since we have pgina set to delete the user and profile once they logout.

…

On Thu, Sep 9, 2021 at 10:09 PM Ali Zamani ***@***.***> wrote: if it takes you to pGina "other user" mode saying your credential's incorrect, try to login with ldap credential and disconnect session, then re-try by refreshing the page to establishing the connection in guaca home/dashboard and you'll get through directly with no further manual authentication. Trying to male ldap authentication in pgina default still no success. Have made pgina default authentication tool as well but no change: https://www.thewindowsclub.com/assign-default-credential-provider-windows-10 — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#365 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ARPGZ3PPLXROQLCFHG5MG3TUBFSGPANCNFSM4IT5ITXA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- *Wyatt Madej* *Desktop Operations System Administrator* Riverdale, NY 10471 ***@***.*** ***@***.***>