@Fidreus What happens if you add the following to your guacamole.properties file?

auth-provider: org.apache.guacamole.auth.openid.OpenIDAuthenticationProvider

 

Edited April 16, 20206 yr by Taddeusz

12 hours ago, Taddeusz said:

@Fidreus What happens if you add the following to your guacamole.properties file?

auth-provider: org.apache.guacamole.auth.openid.OpenIDAuthenticationProvider

 

No change, then it shows the ordinary login again.

I would say this is a Guacamole bug, but would be nice to have a workaround in the docker until it is fixed.

Hi!

 

I looked in the official guacamole/guacamole docker, and they handle it in the start.sh-file:

    # Update config file
    set_property          "openid-authorization-endpoint"    "$OPENID_AUTHORIZATION_ENDPOINT"
    set_property          "openid-jwks-endpoint"             "$OPENID_JWKS_ENDPOINT"
    set_property          "openid-issuer"                    "$OPENID_ISSUER"
    set_property          "openid-client-id"                 "$OPENID_CLIENT_ID"
    set_property          "openid-redirect-uri"              "$OPENID_REDIRECT_URI"
    set_optional_property "openid-username-claim-type"       "$OPENID_USERNAME_CLAIM_TYPE"

    # Add required .jar files to GUACAMOLE_EXT
    # "1-{}" make it sorted as a first provider (only authentication)
    # so it can work together with the database providers (authorization)
    find /opt/guacamole/openid/ -name "*.jar" | awk -F/ '{print $NF}' | \
    xargs -I '{}' ln -s "/opt/guacamole/openid/{}" "${GUACAMOLE_EXT}/1-{}"

Is this somehing you could add to this docker as well @Taddeusz ?

 

/Fredrik

@Fidreus I'll have to take a look at this. I currently don't have any way of ensuring the extensions get loaded in a particular order.

The only way is to make sure that the openid-extension is loaded first is to rename it so it sorts first.

Thats why they rename it to 1-openidextensionname.jar when they copying it to the extension folder.

I think this will work in firstrun.sh: 

OPTOPENID=${OPT_OPENID^^}
if [ "$OPTOPENID" = "Y" ]; then
  if [ -f "$GUAC_EXT"/*openid*.jar ]; then
    oldOpenidFiles=( "$GUAC_EXT"/*openid*.jar )
    newOpenidFiles=( "$EXT_STORE"/openid/*openid*.jar )

    if diff ${oldOpenidFiles[0]} ${newOpenidFiles[0]} >/dev/null ; then
      echo "Using existing OpenID extension."
    else
      echo "Upgrading OpenID extension."
      rm "$GUAC_EXT"/*openid*.jar
      find ${EXT_STORE}/openid/ -name "*.jar" | awk -F/ '{print $NF}' | xargs -I '{}' cp "${EXT_STORE}/openid/{}" "${GUAC_EXT}/1-{}"
      CHANGES=true
    fi
  else
    echo "Copying OpenID extension."
    find ${EXT_STORE}/openid/ -name "*.jar" | awk -F/ '{print $NF}' | xargs -I '{}' cp "${EXT_STORE}/openid/{}" "${GUAC_EXT}/1-{}"
    CHANGES=true
  fi
elif [ "$OPTOPENID" = "N" ]; then
  if [ -f "$GUAC_EXT"/*openid*.jar ]; then
    echo "Removing OpenID extension."
    rm "$GUAC_EXT"/*openid*.jar
  fi
fi

 

Hey, I just got this all set up and I love the idea of using this for remoting into my systems, VMs and such from away but one thing that I just haven't been able to figure out is... I can access everything when I use the server IP and PORT http://10.10.10.99:9191/#/ from a local workstation but when I am using the reverse proxy for it https://remote.[REDACTED].net/#/ it does NOT work properly. The webUI is quick, responsive, no issues. I can VNC all day long and even the RDP works as far as I can tell. What doesn't work is SSH and Telnet. I telnet and SSH into my network infrastructure, among a few other things, and those do NOT work when they are proxied. When I try to connect, the connection will eventually time out and that's all she wrote. I have searched and searched and I just can't figure this part out and it's the only thing holding me back from fully deploying this thing and setting up the more secure authentication methods for actual full time use.

 

I use nginxproxymanager as my proxy and so far I haven't had that be an issue before, honestly, I'm just stuck.

there are alot of proxies which needs modificated proxy settings, and as proxymanager uses just default not all is working ...

 

i can say using letsencrypt all is working as it should.

Edited May 11, 20206 yr by alturismo

I'm running Nginx Proxy Manager with guacamole and have no problems with SSH now when I tried (again).

I have enabled "Websockets Support" and under "Custom Nginx Configuration" I've added "proxy_buffering off;"

 

those are the 2 majors for alot of services ...

16 hours ago, Fidreus said:

I'm running Nginx Proxy Manager with guacamole and have no problems with SSH now when I tried (again).

I have enabled "Websockets Support" and under "Custom Nginx Configuration" I've added "proxy_buffering off;"

 

Spot the heck on there my friend! It's the custom part I was missing. I THOUGHT the turning off of caching was the same but seems I was VERY wrong about that. The instant I added that to the config it started working perfectly and instantly. Thanks a million!

 

I used to use the normal nginx and switched to proxy manager version just because it was quicker and easier to set up new things, especially experimental stuff. I am writing this from work remoting into my main PC just for kicks. Hehe, this is super neat and super useful!

Edited May 12, 20206 yr by cammelspit

Trying to set this up with lets encrypt via duckdns.

 

but I'm getting  a 502 Bad Gateway error.

 

Anyone any ideas how to fix this?

Edited May 21, 20206 yr by dodgypast

@dodgypast If you have your Guacamole container on a custom network you use the container port. Try changing your conf file from 9999 to 8080 and see if it works.

13 hours ago, Taddeusz said:

@dodgypast If you have your Guacamole container on a custom network you use the container port. Try changing your conf file from 9999 to 8080 and see if it works.

I use 8080 for something else.

 

I did some digging and this worked:
 

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name PRIVATE

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth, fill in ldap details in ldap.conf
    #include /config/nginx/ldap.conf;

    location / {
    proxy_pass http://192.168.1.153:9999/;
    proxy_buffering off;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_no_cache $cookie_session;
                
    }
} 

 

@dodgypast Oh yeah, you can only reference the container name if you're running them on a custom network. Otherwise you have to reference your server's IP address. I'm glad you got it working. 

Hi All,   Has anyone managed to get VNC File sharing working with a Unraid Docker Guacamole instance connecting to an Unraid VM/KVM Instance?
Everytime I try to enable SFTP I cant connect to the remote host anymore, and from within the Guac shell there is no ability to sftp to check connectivity.

Any advice or pointers? Google and reddit seems pretty skimp on info

I got the same problem here.

@Taddeusz may a version upgrade in sight, 1.2 released and i hope my remote app issue would be solved

1 hour ago, alturismo said:

@Taddeusz may a version upgrade in sight, 1.2 released and i hope my remote app issue would be solved

@Taddeusz , please include the fix in firstrun.sh for openid if you update the docker, otherwise it will break all users using it.

small update, switched now fast to the official guacd && guacamole docker and yes, my issue is fixed in 1.2

 

(remote app connections closing after 2 mins)

 

and i use mysql (mariadb) and did not run the firstrun.sh, any reason why its needed ? any changes in database ?

I'll work on getting this out by the end of the weekend. @Fidreus I'll also include the fix for OpenID.

47 minutes ago, Taddeusz said:

I'll work on getting this out by the end of the weekend. @Fidreus I'll also include the fix for OpenID.

Thanks!

I’m not ready to update the “latest” branch yet. I think I need to rethink the database upgrade scripting. I’ve always thought it was a kludge. I just haven’t thought of a better way to do it. Fortunately there are no database changes this time around.

 

However, if you’d like to test it out I’ve pushed out 1.2.0 with the tags “1.2.0” and “1.2.0-nomariadb”. I’m sure I’ll be making changes to the database update code before I decide to make this official.

 

That being said, I really like the quick change feature for if you have multiple remotes open.

 

I also have to admit that I personally haven’t been using my own Guacamole that much. A lot of that has to do with changing jobs and then having to work from home due to COVID-19. I just don’t need the remote access as much as I once did. Plus, Unraid’s built-in Wire Guard has made it much easier to get remote access when I need it. I am still dedicated to maintaining this container. It’s a great tool that needs an all-in-one version. I’m sure the separate client and server containers have their place but the all-in-one approach is much cleaner to deploy.
 

If you decide to test this out please let me know if you run into any issues.

@Taddeusz thanks alot, first impressions looking good, and i also prefer the server/frontend in 1 docker

 

it was just a fast test from me due i wanted to know if this finally is solving my remoteapp issue, back to this one now.

11 hours ago, Taddeusz said:

I also have to admit that I personally haven’t been using my own Guacamole that much. A lot of that has to do with changing jobs and then having to work from home due to COVID-19. I just don’t need the remote access as much as I once did.

it's the same for me too! i have Guacamole setup just running, but lastly i'm moving slowly to meshcentral2 https://www.meshcommander.com/meshcentral2. to me it adds a value to connect to another desktop like in teamviever to support another person. RDP still works, VNC too. according RDP, if you need it through browser, then Guacamole is still the champ in UX - works very well like native Windows RDP. i'm running this Meshcentral in docker too, so, if anyone have an interest, just ask.