On Sun, Nov 26, 2023 at 7:15 PM Remush <[email protected]> wrote:
> Hey there! > > Im really struggling with this part. > > I have set up a Guacamole and Guacd containers and configured the > guacamole to authenticate with LDAP. > > when I login with a LDAP user, I have no ability to access the admin panel > nor create connections. And Im unable to log with the default user. > Why so? > For one of two reasons: 1) If you're only using the LDAP extension, then you cannot manage connections within the Guacamole UI. 2) If you're using both LDAP and database, then you have not assigned administrative permissions to the user who is logging in. > > Now I see people suggest that I might need a DB. > I believe I was the one who suggested it - yes, if you want to manage connections in the Guacamole UI, ***you must use the database extension and the associated database*** - MySQL/MariaDB, PostgreSQL, or SQL Server. > Well I can set a Postgresql DB, and load the Guacamole schema or > something like that. > But what then? I need to manually add groups and users and give them > permissions? > There are a few ways to work this - and, please keep in mind that most, if not all, of this is documented in the manual pages that I sent you the last time around. It explains how the link between LDAP and the JDBC authentication extension works and how to "associate" users in the modules (hint: match the username). The first possible method is as follows: 1) Log in with the default (guacadmin) user account and password. 2) Manually create a user, or a group, in the database, where the username matches a user or group in your LDAP tree you want to use with Guacamole. 3) Assign that user or group administrative privileges. 4) Log out of the guacadmin account, and log in to Guacamole using the LDAP account that has been assigned administrative permissions (either directly or via group membership). 5) Once you log in with an account that has access to LDAP, you will be able to see all of the LDAP users and groups, and you can assign them permissions, which will automatically create their entries in the DB. The other possibility is only slightly different: 1) In guacamole.properties, enable user auto-creation for the database extension (this is documented in the manual). 2) Log in to Guacamole with the LDAP account you want to use to manage Guacamole. 3) Log out of Guacamole and log back in with the "guacadmin" account. 4) Locate the auto-created user account and assign it administrative privileges. 5) Log back out and log in under the LDAP account. A third possibility is: 1) In LDAP, create a "guacadmin" user. 2) Log in with the "guacadmin" user and the *LDAP* password. 3) You should automatically have admin access (assuming you've set up the user with the default SQL schema files). 4) Because you're logged in with LDAP, you should also be able to see other LDAP users and groups and assign them admin privileges. > > Can't I just say in the Guacamole configurations the lets say group > "theLegs" have administration permissions or at least be able to make > connections? > There is no such configuration option in guacamole.properties, no. You need to create the user and/or group entries in the database extension and assign those entities admin privileges. -Nick
