[
https://issues.apache.org/jira/browse/GUACAMOLE-715?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16822607#comment-16822607
]
Michael Jumper commented on GUACAMOLE-715:
------------------------------------------
{quote}
{code:none}
21:19:48.879 [http-nio-8080-exec-38] DEBUG
o.a.g.w.GuacamoleWebSocketTunnelEndpoint - Error connecting WebSocket tunnel.
org.apache.guacamole.GuacamoleSecurityException: Permission denied.
at
org.apache.guacamole.auth.jdbc.connection.ConnectionService.connect(ConnectionService.java:522)
...
{code}
{quote}
That particular exception is thrown after falling through due to explicit
"READ" permission not being found on the user accessing the connection:
{code:java}
// Connect only if READ permission is granted
if (hasObjectPermission(user, connection.getIdentifier(),
ObjectPermission.Type.READ))
return tunnelService.getGuacamoleTunnel(user, connection, info,
tokens);
// The user does not have permission to connect
throw new GuacamoleSecurityException("Permission denied.");
{code}
Tested quickly with my local dev environment with a build from master, MariaDB
10.2.19, and Fedora 28, and things are working. I guess I'll have to retry with
the exact same versions as you mentioned and see if it's reproducible.
In your case, there's no other difference between failure and success other
than MySQL being used? Same LDAP server, same ldap-* properties, same group,
same explicit READ permission grant in the DB, etc.?
> Permission management based on LDAP groups not working as documented
> --------------------------------------------------------------------
>
> Key: GUACAMOLE-715
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-715
> Project: Guacamole
> Issue Type: Bug
> Components: guacamole-auth-jdbc-mysql, guacamole-auth-ldap
> Affects Versions: 1.0.0
> Environment: I'm running guacamole in a docker environment using the
> official base images and a MySQL database. Users are authenticated against an
> Active Directory server in combination with the MySQL database.
> Reporter: Micha Kohl
> Assignee: Nick Couchman
> Priority: Major
> Fix For: 1.1.0
>
>
> From the documentation on user groups in 1.0.0 I expected to be able to
> manage user permissions via LDAP groups like this (using LDAP for
> authentication and MySQL for configuration management as documented
> [here|https://guacamole.apache.org/doc/gug/ldap-auth.html#ldap-and-database]):
> # Create user group in MySQL with the name of a corresponding user group in
> the LDAP directory
> # Create connection in MySQL
> # Grant connection permission to the user group created in 1.
> # LDAP users that are part of the LDAP group (in the directory) are able to
> log in with their LDAP credentials and access that connection
> This does not work at all (the user does not even see the connection). In my
> attempt to narrow down the problem and ensure that I'm not just doing it
> wrong, I tested the following scenarios:
> # _Having just the LDAP group be mirrored in MySQL by creating an_
> _identically named one there_
> -> Login succeeds, but no associated connections are shown.
> # _Having both the LDAP group and the user be mirrored in MySQL by creating_
> _identically named entities there without manually linking the two (MySQL
> user is not part of MySQL user group)_
> -> Login succeeds and guacamole tries to auto-connect to the only available
> connection/shows all available connections and fails when trying to connect
> with a permission error.
> # _Having both the LDAP group and the user be mirrored in MySQL by creating_
> _identically named entities there and manually adding the MySQL user to the_
> _MySQL group_ _(MySQL user is part of MySQL user group)_
> -> Connections are established successfully.
> Either there seems to be a big misunderstanding regarding the way the new
> group system is supposed to work with LDAP, or there's something going wrong
> here. It goes without saying that scenario 3 completely eliminates the
> purpose of relying on existing LDAP groups. Scenario 1 is the configuration I
> outlined above that would allow managing connections based on LDAP groups
> without having to create any MySQL users whatsoever. Scenario 2 in
> combination with similar reports on the mailing list led me to believe that
> this is either based on a common misconception or there's a bug.
> Side-Note: While it has been suggested that this is already covered by
> GUACAMOLE-696, I think this could only be said if this turns out to be
> expected but poorly documented behavior.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
