safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-06 21:27:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge changes from patch branch back to main.

Browse Source
This commit is contained in:
Michael Jumper
2024-08-30 10:52:54 -07:00
parent 468c05070f df1745faa7
commit bef7e30ba2
107 changed files with 1380 additions and 294 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
extensions/guacamole-auth-ban/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-ban</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-ban</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -51,7 +51,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
<!-- Exclude transitive dependencies that will be overridden by

2
extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Brute-force Authentication Detection/Prevention",
"namespace" : "ban",

14
extensions/guacamole-auth-duo/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-duo</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-duo</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -130,6 +130,14 @@
<version>${kotlin.version}</version>
</dependency>
<!-- Library for unified IPv4/6 parsing and validation -->
<dependency>
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.5.0</version>
<scope>provided</scope>
</dependency>
</dependencies>
</project>

45
extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
View File

@@ -23,10 +23,13 @@ import com.duosecurity.Client;
import com.duosecurity.exception.DuoException;
import com.duosecurity.model.Token;
import com.google.inject.Inject;
import inet.ipaddr.IPAddress;
import inet.ipaddr.IPAddressString;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.Collections;
import java.util.concurrent.TimeUnit;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
@@ -37,6 +40,7 @@ import org.apache.guacamole.language.TranslatableMessage;
import org.apache.guacamole.net.auth.AuthenticatedUser;
import org.apache.guacamole.net.auth.Credentials;
import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -107,9 +111,41 @@ public class UserVerificationService {
public void verifyAuthenticatedUser(AuthenticatedUser authenticatedUser)
throws GuacamoleException {
// Ignore anonymous users (unverifiable)
// Pull the original HTTP request used to authenticate
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
IPAddress clientAddr = new IPAddressString(request.getRemoteAddr()).getAddress();
// Ignore anonymous users
String username = authenticatedUser.getIdentifier();
if (username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
if (username == null || username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
return;
// Pull address lists to check from configuration. Note that the enforce
// list will override the bypass list, which means that, if the client
// address happens to be in both lists, Duo MFA will be enforced.
List<IPAddress> bypassAddresses = confService.getBypassHosts();
List<IPAddress> enforceAddresses = confService.getEnforceHosts();
// Check if the bypass list contains the client address, and set the
// enforce flag to the opposite.
boolean enforceHost = !(IPAddressListProperty.addressListContains(bypassAddresses, clientAddr));
// Only continue processing if the list is not empty
if (!enforceAddresses.isEmpty()) {
// If client address is not available or invalid, MFA will
// be enforced.
if (clientAddr == null || !clientAddr.isIPAddress())
enforceHost = true;
// Check the enforce list for the client address and set enforcement flag.
else
enforceHost = IPAddressListProperty.addressListContains(enforceAddresses, clientAddr);
}
// If the enforce flag is not true, bypass Duo MFA.
if (!enforceHost)
return;
// Obtain a Duo client for redirecting the user to the Duo service and
@@ -137,11 +173,6 @@ public class UserVerificationService {
+ "not currently available (failed health check).", e);
}
// Pull the original HTTP request used to authenticate, as well as any
// associated credentials
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
// Retrieve signed Duo authentication code and session state from the
// request (these will be absent if this is an initial authentication
// attempt and not a redirect back from Duo)

76
extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
View File

@@ -20,10 +20,14 @@
package org.apache.guacamole.auth.duo.conf;
import com.google.inject.Inject;
import inet.ipaddr.IPAddress;
import java.net.URI;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
@@ -105,6 +109,40 @@ public class ConfigurationService {
public String getName() { return "duo-auth-timeout"; }
};
/**
* The optional property that contains a comma-separated list of IP addresses
* or CIDRs for which the MFA requirement should be bypassed. If the Duo
* extension is installed, any/all users authenticating from clients that
* match this list will be able to successfully log in without fulfilling
* the MFA requirement. If this option is omitted or is empty, and the
* Duo module is installed, all users from all hosts will have Duo MFA
* enforced.
*/
private static final IPAddressListProperty DUO_BYPASS_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "duo-bypass-hosts"; }
};
/**
* The optional property that contains a comma-separated list of IP addresses
* or CIDRs for which the MFA requirement should be explicitly enforced. If
* the Duo module is enabled and this property is specified, users that log
* in from hosts that match the items in this list will have Duo MFA required,
* and all users from hosts that do not match this list will be able to log
* in without the MFA requirement. If this option is missing or empty and
* the Duo module is installed, MFA will be enforced for all users.
*/
private static final IPAddressListProperty DUO_ENFORCE_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "duo-enforce-hosts"; }
};
/**
* Returns the hostname of the Duo API endpoint to be used to verify user
@@ -188,5 +226,43 @@ public class ConfigurationService {
public int getAuthenticationTimeout() throws GuacamoleException {
return environment.getProperty(DUO_AUTH_TIMEOUT, 5);
}
/**
* Returns the list of IP addresses and subnets defined in guacamole.properties
* for which Duo MFA should _not_ be enforced. Users logging in from hosts
* contained in this list will be logged in without the MFA requirement.
*
* @return
* A list of IP addresses and subnets for which Duo MFA should not be
* enforced.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getBypassHosts() throws GuacamoleException {
return environment.getProperty(DUO_BYPASS_HOSTS, Collections.emptyList());
}
/**
* Returns the list of IP addresses and subnets defined in guacamole.properties
* for which Duo MFA should explicitly be enforced, while logins from all
* other hosts should not enforce MFA. Users logging in from hosts
* contained in this list will be required to complete the Duo MFA authentication,
* while users from all other hosts will be logged in without the MFA requirement.
*
* @return
* A list of IP addresses and subnets for which Duo MFA should be
* explicitly enforced.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getEnforceHosts() throws GuacamoleException {
return environment.getProperty(DUO_ENFORCE_HOSTS, Collections.emptyList());
}
}

2
extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Duo TFA Authentication Backend",
"namespace" : "duo",

6
extensions/guacamole-auth-header/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-header</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-header</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

2
extensions/guacamole-auth-header/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "HTTP Header Authentication Extension",
"namespace" : "header",

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
View File

@@ -483,8 +483,8 @@ public class ConnectionService extends ModeledChildDirectoryObjectService<Modele
List<ConnectionRecordModel> searchResults;
// Bypass permission checks if the user is privileged
if (user.isPrivileged())
// Bypass permission checks if the user is privileged or has System-level audit permissions
if (user.isPrivileged() || user.getUser().getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.AUDIT))
searchResults = connectionRecordMapper.search(identifier,
recordIdentifier, requiredContents, sortPredicates, limit);

75
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
View File

@@ -21,6 +21,7 @@ package org.apache.guacamole.auth.jdbc.tunnel;
import com.google.inject.Inject;
import com.google.inject.Provider;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
@@ -81,6 +82,56 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
*/
private final Logger logger = LoggerFactory.getLogger(AbstractGuacamoleTunnelService.class);
/**
* The prefix that will be used to generate JDBC tokens.
*/
private final String JDBC_TOKEN_PREFIX = "JDBC_";
/**
* The token that contains the date the connection was started.
*/
private final String JDBC_DATE_TOKEN = JDBC_TOKEN_PREFIX + "STARTDATE";
/**
* The format of the date in the date token.
*/
private final String JDBC_DATE_TOKEN_FORMAT = "yyyyMMdd";
/**
* The token that contains the start time of the connection.
*/
private final String JDBC_TIME_TOKEN = JDBC_TOKEN_PREFIX + "STARTTIME";
/**
* The format of the time in the time token.
*/
private final String JDBC_TIME_TOKEN_FORMAT = "HHmmss";
/**
* The token that contains the connection name.
*/
private final String JDBC_CONNECTION_NAME_TOKEN = JDBC_TOKEN_PREFIX + "CONNECTION_NAME";
/**
* The token that contains the connection identifier.
*/
private final String JDBC_CONNECTION_ID_TOKEN = JDBC_TOKEN_PREFIX + "CONNECTION_ID";
/**
* The token that contains the hostname configured in the connection parameters.
*/
private final String JDBC_CONNECTION_HOSTNAME_TOKEN = JDBC_TOKEN_PREFIX + "HOSTNAME";
/**
* The name of the parameter containing the hostname in the configuration.
*/
private final String JDBC_CONNECTION_HOSTNAME_TOKEN_PARAMETER = "hostname";
/**
* The token containing the protocol configured in the connection.
*/
private final String JDBC_CONNECTION_PROTOCOL_TOKEN = JDBC_TOKEN_PREFIX + "PROTOCOL";
/**
* Mapper for accessing connections.
*/
@@ -121,7 +172,7 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
* All active connections through the tunnel having a given UUID.
*/
private final Map<String, ActiveConnectionRecord> activeTunnels =
new ConcurrentHashMap<String, ActiveConnectionRecord>();
new ConcurrentHashMap<>();
/**
* All active connections to a connection having a given identifier.
@@ -415,7 +466,7 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
private GuacamoleTunnel assignGuacamoleTunnel(ActiveConnectionRecord activeConnection,
GuacamoleClientInformation info, Map<String, String> tokens,
boolean interceptErrors) throws GuacamoleException {
// Record new active connection
Runnable cleanupTask = new ConnectionCleanupTask(activeConnection);
try {
@@ -459,9 +510,25 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
config = getGuacamoleConfiguration(connection, connectionID, activeConnection.getSharingProfile());
}
// Include history record UUID as token
// Make a copy of the tokens
tokens = new HashMap<>(tokens);
// Set up JDBC-specific tokens
tokens.put(JDBC_DATE_TOKEN,
new SimpleDateFormat(JDBC_DATE_TOKEN_FORMAT)
.format(activeConnection.getStartDate()));
tokens.put(JDBC_TIME_TOKEN,
new SimpleDateFormat(JDBC_TIME_TOKEN_FORMAT)
.format(activeConnection.getStartDate()));
tokens.put(JDBC_CONNECTION_NAME_TOKEN, activeConnection.getConnectionName());
tokens.put(JDBC_CONNECTION_ID_TOKEN, activeConnection.getConnectionIdentifier());
tokens.put(JDBC_CONNECTION_HOSTNAME_TOKEN,
activeConnection.getConnection().getConfiguration().getParameter(JDBC_CONNECTION_HOSTNAME_TOKEN_PARAMETER));
tokens.put(JDBC_CONNECTION_PROTOCOL_TOKEN,
activeConnection.getConnection().getConfiguration().getProtocol());
// Include history record UUID as token
tokens.put("HISTORY_UUID", activeConnection.getUUID().toString());
// Build token filter containing credential tokens

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
View File

@@ -611,8 +611,8 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
List<ActivityRecordModel> searchResults;
// Bypass permission checks if the user is privileged
if (user.isPrivileged())
// Bypass permission checks if the user is privileged or has System-level audit permissions
if (user.isPrivileged() || user.getUser().getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.AUDIT))
searchResults = userRecordMapper.search(username, recordIdentifier,
requiredContents, sortPredicates, limit);

8
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-dist/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -42,21 +42,21 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-mysql</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- PostgreSQL Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-postgresql</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- SQL Server Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-sqlserver</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/001-create-schema.sql
View File

@@ -459,6 +459,7 @@ CREATE TABLE `guacamole_system_permission` (
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER') NOT NULL,
PRIMARY KEY (`entity_id`,`permission`),
@@ -611,3 +612,4 @@ CREATE TABLE guacamole_user_password_history (
REFERENCES `guacamole_user` (`user_id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/002-create-admin-user.sql
View File

@@ -51,3 +51,4 @@ FROM (
JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'
JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER'
JOIN guacamole_user ON guacamole_user.entity_id = affected.entity_id;

32
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-1.6.0.sql Normal file
View File

@@ -0,0 +1,32 @@
--
-- Licensed to the Apache Software Foundation (ASF) under one
-- or more contributor license agreements. See the NOTICE file
-- distributed with this work for additional information
-- regarding copyright ownership. The ASF licenses this file
-- to you under the Apache License, Version 2.0 (the
-- "License"); you may not use this file except in compliance
-- with the License. You may obtain a copy of the License at
--
-- http://www.apache.org/licenses/LICENSE-2.0
--
-- Unless required by applicable law or agreed to in writing,
-- software distributed under the License is distributed on an
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-- KIND, either express or implied. See the License for the
-- specific language governing permissions and limitations
-- under the License.
--
--
-- Add new system-level permission
--
ALTER TABLE `guacamole_system_permission`
MODIFY `permission` enum('CREATE_CONNECTION',
'CREATE_CONNECTION_GROUP',
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER') NOT NULL;

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "MySQL Authentication",
"namespace" : "mysql",

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/001-create-schema.sql
View File

@@ -56,6 +56,7 @@ CREATE TYPE guacamole_system_permission_type AS ENUM(
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER'
);

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/002-create-admin-user.sql
View File

@@ -53,3 +53,4 @@ FROM (
JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'
JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER'
JOIN guacamole_user ON guacamole_user.entity_id = affected.entity_id;

27
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-1.6.0.sql Normal file
View File

@@ -0,0 +1,27 @@
--
-- Licensed to the Apache Software Foundation (ASF) under one
-- or more contributor license agreements. See the NOTICE file
-- distributed with this work for additional information
-- regarding copyright ownership. The ASF licenses this file
-- to you under the Apache License, Version 2.0 (the
-- "License"); you may not use this file except in compliance
-- with the License. You may obtain a copy of the License at
--
-- http://www.apache.org/licenses/LICENSE-2.0
--
-- Unless required by applicable law or agreed to in writing,
-- software distributed under the License is distributed on an
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-- KIND, either express or implied. See the License for the
-- specific language governing permissions and limitations
-- under the License.
--
--
-- Add new system-level audit permission
--
ALTER TYPE guacamole_system_permission_type
ADD VALUE 'AUDIT'
BEFORE 'ADMINISTER';

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "PostgreSQL Authentication",
"namespace" : "postgresql",

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/schema/001-create-schema.sql
View File

@@ -77,6 +77,7 @@ CREATE RULE [guacamole_system_permission_list] AS @list IN (
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER'
);
GO

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/schema/002-create-admin-user.sql
View File

@@ -61,3 +61,4 @@ JOIN [guacamole_entity] ON [permissions].[username] = [guacamole_enti
JOIN [guacamole_entity] [affected] ON [permissions].[affected_username] = [affected].[name] AND [guacamole_entity].[type] = 'USER'
JOIN [guacamole_user] ON [guacamole_user].[entity_id] = [affected].[entity_id];
GO

43
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/schema/upgrade/upgrade-pre-1.6.0.sql Normal file
View File

@@ -0,0 +1,43 @@
--
-- Licensed to the Apache Software Foundation (ASF) under one
-- or more contributor license agreements. See the NOTICE file
-- distributed with this work for additional information
-- regarding copyright ownership. The ASF licenses this file
-- to you under the Apache License, Version 2.0 (the
-- "License"); you may not use this file except in compliance
-- with the License. You may obtain a copy of the License at
--
-- http://www.apache.org/licenses/LICENSE-2.0
--
-- Unless required by applicable law or agreed to in writing,
-- software distributed under the License is distributed on an
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-- KIND, either express or implied. See the License for the
-- specific language governing permissions and limitations
-- under the License.
--
--
-- Add new system-level audit permission
--
EXEC sp_unbindrule 'guacamole_system_permission';
DROP RULE [guacamole_system_permission_list];
GO
CREATE RULE [guacamole_system_permission_list] AS @list IN (
'CREATE_CONNECTION',
'CREATE_CONNECTION_GROUP',
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER'
);
GO
EXEC sp_bindrule
'guacamole_system_permission_list',
'guacamole_system_permission';
GO

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "SQLServer Authentication",
"namespace" : "sqlserver",

6
extensions/guacamole-auth-jdbc/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-jdbc</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -59,7 +59,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

7
extensions/guacamole-auth-json/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-json</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-json</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -78,6 +78,7 @@
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.5.0</version>
<scope>provided</scope>
</dependency>
<!-- JUnit -->

6
extensions/guacamole-auth-json/src/main/java/org/apache/guacamole/auth/json/ConfigurationService.java
View File

@@ -25,7 +25,7 @@ import java.util.Collections;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.ByteArrayProperty;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
/**
* Service for retrieving configuration information regarding the JSON
@@ -56,7 +56,7 @@ public class ConfigurationService {
* be allowed to perform authentication. If not specified, ALL address will
* be allowed.
*/
private static final StringListProperty JSON_TRUSTED_NETWORKS = new StringListProperty() {
private static final StringGuacamoleProperty JSON_TRUSTED_NETWORKS = new StringGuacamoleProperty() {
@Override
public String getName() {
@@ -95,7 +95,7 @@ public class ConfigurationService {
* If guacamole.properties cannot be parsed.
*/
public Collection<String> getTrustedNetworks() throws GuacamoleException {
return environment.getProperty(JSON_TRUSTED_NETWORKS, Collections.<String>emptyList());
return environment.getPropertyCollection(JSON_TRUSTED_NETWORKS, Collections.<String>emptyList());
}
}

2
extensions/guacamole-auth-json/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Encrypted JSON Authentication",
"namespace" : "json",

6
extensions/guacamole-auth-ldap/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-ldap</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-ldap</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

27
extensions/guacamole-auth-ldap/schema/guacConfigGroup.ldif
View File

@@ -20,9 +20,24 @@
dn: cn=guacConfigGroup,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: guacConfigGroup
olcAttributeTypes: {0}( 1.3.6.1.4.1.38971.1.1.1 NAME 'guacConfigProtocol' SYNTAX 1.3.6.1.4.1.1466
.115.121.1.15 )
olcAttributeTypes: {1}( 1.3.6.1.4.1.38971.1.1.2 NAME 'guacConfigParameter' SYNTAX 1.3.6.1.4.1.146
6.115.121.1.15 )
olcObjectClasses: {0}( 1.3.6.1.4.1.38971.1.2.1 NAME 'guacConfigGroup' DESC 'Guacamole config
uration group' SUP groupOfNames MUST guacConfigProtocol MAY guacConfigParameter )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.1 NAME 'guacConfigProtocol'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.2 NAME 'guacConfigParameter'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.3 NAME 'guacConfigProxyHostname'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.4 NAME 'guacConfigProxyPort'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.5 NAME 'guacConfigProxyEncryption'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcObjectClasses: ( 1.3.6.1.4.1.38971.1.2.1 NAME 'guacConfigGroup'
DESC 'Guacamole configuration group'
SUP groupOfNames
MUST guacConfigProtocol
MAY ( guacConfigParameter $
guacConfigProxyHostname $
guacConfigProxyPort $
guacConfigProxyEncryption ) )

20
extensions/guacamole-auth-ldap/schema/guacConfigGroup.schema
View File

@@ -18,14 +18,28 @@
#
attributetype ( 1.3.6.1.4.1.38971.1.1.1 NAME 'guacConfigProtocol'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributetype ( 1.3.6.1.4.1.38971.1.1.2 NAME 'guacConfigParameter'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributetype ( 1.3.6.1.4.1.38971.1.1.3 NAME 'guacConfigProxyHostname'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributetype ( 1.3.6.1.4.1.38971.1.1.4 NAME 'guacConfigProxyPort'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
attributetype ( 1.3.6.1.4.1.38971.1.1.5 NAME 'guacConfigProxyEncryption'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
objectClass ( 1.3.6.1.4.1.38971.1.2.1 NAME 'guacConfigGroup'
DESC 'Guacamole configuration group'
SUP groupOfNames
MUST guacConfigProtocol
MAY guacConfigParameter )
MAY ( guacConfigParameter $
guacConfigProxyHostname $
guacConfigProxyPort $
guacConfigProxyEncryption ) )

2
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/AuthenticationProviderService.java
View File

@@ -401,7 +401,7 @@ public class AuthenticationProviderService {
throws GuacamoleException {
// Get attributes from configuration information
List<String> attrList = config.getAttributes();
Collection<String> attrList = config.getAttributes();
// If there are no attributes there is no reason to search LDAP
if (attrList.isEmpty())

7
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ConnectedLDAPConfiguration.java
View File

@@ -19,6 +19,7 @@
package org.apache.guacamole.auth.ldap;
import java.util.Collection;
import java.util.List;
import org.apache.directory.api.ldap.model.filter.ExprNode;
import org.apache.directory.api.ldap.model.message.AliasDerefMode;
@@ -124,7 +125,7 @@ public class ConnectedLDAPConfiguration implements LDAPConfiguration, AutoClosea
}
@Override
public List<String> getUsernameAttributes() throws GuacamoleException {
public Collection<String> getUsernameAttributes() throws GuacamoleException {
return config.getUsernameAttributes();
}
@@ -139,7 +140,7 @@ public class ConnectedLDAPConfiguration implements LDAPConfiguration, AutoClosea
}
@Override
public List<String> getGroupNameAttributes() throws GuacamoleException {
public Collection<String> getGroupNameAttributes() throws GuacamoleException {
return config.getGroupNameAttributes();
}
@@ -209,7 +210,7 @@ public class ConnectedLDAPConfiguration implements LDAPConfiguration, AutoClosea
}
@Override
public List<String> getAttributes() throws GuacamoleException {
public Collection<String> getAttributes() throws GuacamoleException {
return config.getAttributes();
}

14
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/EnvironmentLDAPConfiguration.java
View File

@@ -19,7 +19,7 @@
package org.apache.guacamole.auth.ldap.conf;
import java.util.List;
import java.util.Collection;
import org.apache.directory.api.ldap.model.filter.ExprNode;
import org.apache.directory.api.ldap.model.message.AliasDerefMode;
import org.apache.directory.api.ldap.model.name.Dn;
@@ -75,8 +75,8 @@ public class EnvironmentLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getUsernameAttributes() throws GuacamoleException {
return environment.getProperty(
public Collection<String> getUsernameAttributes() throws GuacamoleException {
return environment.getPropertyCollection(
LDAPGuacamoleProperties.LDAP_USERNAME_ATTRIBUTE,
DEFAULT.getUsernameAttributes()
);
@@ -98,8 +98,8 @@ public class EnvironmentLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getGroupNameAttributes() throws GuacamoleException {
return environment.getProperty(
public Collection<String> getGroupNameAttributes() throws GuacamoleException {
return environment.getPropertyCollection(
LDAPGuacamoleProperties.LDAP_GROUP_NAME_ATTRIBUTE,
DEFAULT.getGroupNameAttributes()
);
@@ -210,8 +210,8 @@ public class EnvironmentLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getAttributes() throws GuacamoleException {
return environment.getProperty(
public Collection<String> getAttributes() throws GuacamoleException {
return environment.getPropertyCollection(
LDAPGuacamoleProperties.LDAP_USER_ATTRIBUTES,
DEFAULT.getAttributes()
);

7
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/JacksonLDAPConfiguration.java
View File

@@ -22,6 +22,7 @@ package org.apache.guacamole.auth.ldap.conf;
import com.fasterxml.jackson.annotation.JsonFormat;
import static com.fasterxml.jackson.annotation.JsonFormat.Feature.ACCEPT_SINGLE_VALUE_AS_ARRAY;
import com.fasterxml.jackson.annotation.JsonProperty;
import java.util.Collection;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -331,7 +332,7 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getUsernameAttributes() throws GuacamoleException {
public Collection<String> getUsernameAttributes() throws GuacamoleException {
return withDefault(usernameAttributes, defaultConfig::getUsernameAttributes);
}
@@ -348,7 +349,7 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getGroupNameAttributes() throws GuacamoleException {
public Collection<String> getGroupNameAttributes() throws GuacamoleException {
return withDefault(groupNameAttributes, defaultConfig::getGroupNameAttributes);
}
@@ -424,7 +425,7 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getAttributes() throws GuacamoleException {
public Collection<String> getAttributes() throws GuacamoleException {
return withDefault(userAttributes, defaultConfig::getAttributes);
}

7
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPConfiguration.java
View File

@@ -19,6 +19,7 @@
package org.apache.guacamole.auth.ldap.conf;
import java.util.Collection;
import java.util.List;
import org.apache.directory.api.ldap.model.filter.ExprNode;
import org.apache.directory.api.ldap.model.message.AliasDerefMode;
@@ -84,7 +85,7 @@ public interface LDAPConfiguration {
* @throws GuacamoleException
* If the username attributes cannot be retrieved.
*/
List<String> getUsernameAttributes() throws GuacamoleException;
Collection<String> getUsernameAttributes() throws GuacamoleException;
/**
* Returns the base DN under which all Guacamole users will be stored
@@ -125,7 +126,7 @@ public interface LDAPConfiguration {
* @throws GuacamoleException
* If the group name attributes cannot be retrieved.
*/
List<String> getGroupNameAttributes() throws GuacamoleException;
Collection<String> getGroupNameAttributes() throws GuacamoleException;
/**
* Returns the base DN under which all Guacamole role based access control
@@ -305,7 +306,7 @@ public interface LDAPConfiguration {
* If the names of the LDAP user attributes to be exposed as parameter
* tokens cannot be retrieved.
*/
List<String> getAttributes() throws GuacamoleException;
Collection<String> getAttributes() throws GuacamoleException;
/**
* Returns the name of the LDAP attribute used to enumerate members in a

12
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPGuacamoleProperties.java
View File

@@ -84,8 +84,8 @@ public class LDAPGuacamoleProperties {
* one attribute, and the concatenation of that attribute and the value of
* LDAP_USER_BASE_DN must equal the user's full DN.
*/
public static final StringListProperty LDAP_USERNAME_ATTRIBUTE =
new StringListProperty() {
public static final StringGuacamoleProperty LDAP_USERNAME_ATTRIBUTE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "ldap-username-attribute"; }
@@ -97,8 +97,8 @@ public class LDAPGuacamoleProperties {
* attributes must be present within each Guacamole user group's record in
* the LDAP directory for that group to be visible.
*/
public static final StringListProperty LDAP_GROUP_NAME_ATTRIBUTE =
new StringListProperty() {
public static final StringGuacamoleProperty LDAP_GROUP_NAME_ATTRIBUTE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "ldap-group-name-attribute"; }
@@ -277,8 +277,8 @@ public class LDAPGuacamoleProperties {
* Custom attribute or attributes to query from Guacamole user's record in
* the LDAP directory.
*/
public static final StringListProperty LDAP_USER_ATTRIBUTES =
new StringListProperty() {
public static final StringGuacamoleProperty LDAP_USER_ATTRIBUTES =
new StringGuacamoleProperty() {
@Override
public String getName() { return "ldap-user-attributes"; }

62
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/StringListProperty.java
View File

@@ -1,62 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.ldap.conf;
import java.util.Arrays;
import java.util.List;
import java.util.regex.Pattern;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.properties.GuacamoleProperty;
/**
* A GuacamoleProperty whose value is a List of Strings. The string value
* parsed to produce this list is a comma-delimited list. Duplicate values are
* ignored, as is any whitespace following delimiters. To maintain
* compatibility with the behavior of Java properties in general, only
* whitespace at the beginning of each value is ignored; trailing whitespace
* becomes part of the value.
*/
public abstract class StringListProperty implements GuacamoleProperty<List<String>> {
/**
* A pattern which matches against the delimiters between values. This is
* currently simply a comma and any following whitespace. Parts of the
* input string which match this pattern will not be included in the parsed
* result.
*/
private static final Pattern DELIMITER_PATTERN = Pattern.compile(",\\s*");
@Override
public List<String> parseValue(String values) throws GuacamoleException {
// If no property provided, return null.
if (values == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(values));
if (stringValues.isEmpty())
return null;
return stringValues;
}
}

112
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java
View File

@@ -42,7 +42,11 @@ import org.apache.guacamole.auth.ldap.ConnectedLDAPConfiguration;
import org.apache.guacamole.auth.ldap.ObjectQueryService;
import org.apache.guacamole.auth.ldap.group.UserGroupService;
import org.apache.guacamole.auth.ldap.user.LDAPAuthenticatedUser;
import org.apache.guacamole.environment.LocalEnvironment;
import org.apache.guacamole.net.auth.AuthenticatedUser;
import org.apache.guacamole.net.auth.Connection;
import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration;
import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration.EncryptionMethod;
import org.apache.guacamole.net.auth.TokenInjectingConnection;
import org.apache.guacamole.net.auth.simple.SimpleConnection;
import org.apache.guacamole.protocol.GuacamoleConfiguration;
@@ -59,6 +63,33 @@ public class ConnectionService {
* Logger for this class.
*/
private static final Logger logger = LoggerFactory.getLogger(ConnectionService.class);
/**
* The name of the LDAP attribute that stores connection configuration
* parameters for Guacamole.
*/
public static final String LDAP_ATTRIBUTE_PARAMETER = "guacConfigParameter";
/**
* The name of the LDAP attribute that stores the protocol for a Guacamole
* connection.
*/
public static final String LDAP_ATTRIBUTE_PROTOCOL = "guacConfigProtocol";
/**
* The name of the LDAP attribute that stores guacd proxy hostname.
*/
public static final String LDAP_ATTRIBUTE_PROXY_HOSTNAME = "guacConfigProxyHostname";
/**
* The name of the LDAP attribute that stores guacd proxy port.
*/
public static final String LDAP_ATTRIBUTE_PROXY_PORT = "guacConfigProxyPort";
/**
* The name of the LDAP attribute that stores guacd proxy hostname.
*/
public static final String LDAP_ATTRIBUTE_PROXY_ENCRYPTION = "guacConfigProxyEncryption";
/**
* Service for executing LDAP queries.
@@ -192,11 +223,21 @@ public class ConnectionService {
config.setProtocol(protocol.getString());
}
catch (LdapInvalidAttributeValueException e) {
logger.error("Invalid value of the protocol entry: {}",
e.getMessage());
logger.error("Invalid value of the protocol entry: {}", e.getMessage());
logger.debug("LDAP exception when getting protocol value.", e);
return null;
}
// Get proxy configuration, if any
GuacamoleProxyConfiguration proxyConfig;
try {
proxyConfig = getProxyConfiguration(entry);
}
catch (GuacamoleException e) {
logger.error("Failed to retrieve proxy configuration.", e.getMessage());
logger.debug("Guacamole Exception when retrieving proxy configuration.", e);
return null;
}
// Get parameters, if any
Attribute parameterAttribute = entry.get(LDAP_ATTRIBUTE_NAME_PARAMETER);
@@ -209,10 +250,8 @@ public class ConnectionService {
parameter = parameterAttribute.getString();
}
catch (LdapInvalidAttributeValueException e) {
logger.warn("Parameter value not valid for {}: {}",
cnName, e.getMessage());
logger.debug("LDAP exception when getting parameter value.",
e);
logger.warn("Parameter value not valid for {}: {}", cnName, e.getMessage());
logger.debug("LDAP exception when getting parameter value.", e);
return null;
}
parameterAttribute.remove(parameter);
@@ -234,7 +273,7 @@ public class ConnectionService {
}
// Store connection using cn for both identifier and name
Connection connection = new SimpleConnection(cnName, cnName, config, true);
Connection connection = new SimpleConnection(cnName, cnName, proxyConfig, config, true);
connection.setParentIdentifier(LDAPAuthenticationProvider.ROOT_CONNECTION_GROUP);
// Inject LDAP-specific tokens only if LDAP handled user
@@ -301,5 +340,64 @@ public class ConnectionService {
return searchFilter;
}
/**
* Given an LDAP entry that stores a GuacamoleConfiguration, generate a
* GuacamoleProxyConfiguration that tells the client how to connect to guacd.
* If the proxy configuration values are not found in the LDAP entry the
* defaults from the environment are used. If errors occur while trying to
* ready or parse values from the LDAP entry a GuacamoleException is thrown.
*
* @param connectionEntry
* The LDAP entry that should be checked for proxy configuration values.
*
* @return
* The GuacamoleProxyConfiguration that contains information on how
* to contact guacd for the given Guacamole connection configuration.
*
* @throws GuacamoleException
* If errors occur trying to parse LDAP values from the entry.
*/
private GuacamoleProxyConfiguration getProxyConfiguration(Entry connectionEntry)
throws GuacamoleException {
try {
// Get default proxy configuration values
GuacamoleProxyConfiguration proxyConfig = LocalEnvironment.getInstance().getDefaultGuacamoleProxyConfiguration();
String proxyHostname = proxyConfig.getHostname();
int proxyPort = proxyConfig.getPort();
EncryptionMethod proxyEncryption = proxyConfig.getEncryptionMethod();
// Get the proxy hostname
Attribute proxyHostAttr = connectionEntry.get(LDAP_ATTRIBUTE_PROXY_HOSTNAME);
if (proxyHostAttr != null && proxyHostAttr.size() > 0)
proxyHostname = proxyHostAttr.getString();
// Get the proxy port
Attribute proxyPortAttr = connectionEntry.get(LDAP_ATTRIBUTE_PROXY_PORT);
if (proxyPortAttr != null && proxyPortAttr.size() > 0)
proxyPort = Integer.parseInt(proxyPortAttr.getString());
// Get the proxy encryption method
Attribute proxyEncryptionAttr = connectionEntry.get(LDAP_ATTRIBUTE_PROXY_ENCRYPTION);
if (proxyEncryptionAttr != null && proxyEncryptionAttr.size() > 0) {
try {
proxyEncryption = EncryptionMethod.valueOf(proxyEncryptionAttr.getString());
}
catch (IllegalArgumentException e) {
throw new GuacamoleServerException("Unknown encryption method specified, value must be either \"NONE\" or \"SSL\".", e);
}
}
// Return a new proxy configuration
return new GuacamoleProxyConfiguration(proxyHostname, proxyPort, proxyEncryption);
}
catch (LdapInvalidAttributeValueException e) {
logger.error("Invalid value in proxy configuration: {}", e.getMessage());
logger.debug("LDAP exception fetching proxy attribute value.", e);
throw new GuacamoleServerException("Invalid LDAP value in proxy configuration.", e);
}
}
}

2
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/user/UserService.java
View File

@@ -183,7 +183,7 @@ public class UserService {
throws GuacamoleException {
// Pull username attributes from properties
List<String> usernameAttributes = config.getUsernameAttributes();
List<String> usernameAttributes = new ArrayList<>(config.getUsernameAttributes());
// We need exactly one base DN to derive the user DN
if (usernameAttributes.size() != 1) {

2
extensions/guacamole-auth-ldap/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "LDAP Authentication",
"namespace" : "ldap",

6
extensions/guacamole-auth-quickconnect/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-quickconnect</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-quickconnect</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -98,7 +98,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

15
extensions/guacamole-auth-quickconnect/src/main/java/org/apache/guacamole/auth/quickconnect/conf/ConfigurationService.java
View File

@@ -20,10 +20,11 @@
package org.apache.guacamole.auth.quickconnect.conf;
import com.google.inject.Inject;
import java.util.Collection;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
/**
* Configuration options to control the QuickConnect module.
@@ -42,7 +43,7 @@ public class ConfigurationService {
* the parameters defined in this list. Defaults to null (all parameters
* are allowed).
*/
public static final StringListProperty QUICKCONNECT_ALLOWED_PARAMETERS = new StringListProperty() {
public static final StringGuacamoleProperty QUICKCONNECT_ALLOWED_PARAMETERS = new StringGuacamoleProperty() {
@Override
public String getName() { return "quickconnect-allowed-parameters"; }
@@ -55,7 +56,7 @@ public class ConfigurationService {
* except the ones defined in this list. Defaults to null (all parameters
* are allowed).
*/
public static final StringListProperty QUICKCONNECT_DENIED_PARAMETERS = new StringListProperty() {
public static final StringGuacamoleProperty QUICKCONNECT_DENIED_PARAMETERS = new StringGuacamoleProperty() {
@Override
public String getName() { return "quickconnect-denied-parameters"; }
@@ -74,8 +75,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public List<String> getAllowedParameters() throws GuacamoleException {
return environment.getProperty(QUICKCONNECT_ALLOWED_PARAMETERS);
public Collection<String> getAllowedParameters() throws GuacamoleException {
return environment.getPropertyCollection(QUICKCONNECT_ALLOWED_PARAMETERS);
}
/**
@@ -90,8 +91,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public List<String> getDeniedParameters() throws GuacamoleException {
return environment.getProperty(QUICKCONNECT_DENIED_PARAMETERS);
public Collection<String> getDeniedParameters() throws GuacamoleException {
return environment.getPropertyCollection(QUICKCONNECT_DENIED_PARAMETERS);
}
}

7
extensions/guacamole-auth-quickconnect/src/main/java/org/apache/guacamole/auth/quickconnect/utility/QCParser.java
View File

@@ -25,6 +25,7 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.net.URLDecoder;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.regex.Matcher;
@@ -60,13 +61,13 @@ public class QCParser {
* by this parser. If not defined, all parameters will be allowed unless
* explicitly denied.
*/
private final List<String> allowedParams;
private final Collection<String> allowedParams;
/**
* The list of parameters that are explicitly denied from being placed into
* a configuration by this parser.
*/
private final List<String> deniedParams;
private final Collection<String> deniedParams;
/**
* Create a new instance of the QCParser class, with the provided allowed
@@ -81,7 +82,7 @@ public class QCParser {
* A list of parameters, if any, that should be explicitly denied from
* being placed into a connection configuration.
*/
public QCParser(List<String> allowedParams, List<String> deniedParams) {
public QCParser(Collection<String> allowedParams, Collection<String> deniedParams) {
this.allowedParams = allowedParams;
this.deniedParams = deniedParams;
}

2
extensions/guacamole-auth-quickconnect/src/main/resources/guac-manifest.json
View File

@@ -1,5 +1,5 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Adhoc Guacamole Connections",
"namespace" : "quickconnect",

6
extensions/guacamole-auth-radius/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-radius</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-radius</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -115,7 +115,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

2
extensions/guacamole-auth-radius/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "RADIUS Authentication Backend",
"namespace" : "radius",

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-cas</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-cas</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "CAS Authentication Extension",
"namespace" : "cas",

10
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -42,28 +42,28 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-cas</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- OpenID Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-openid</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- SAML Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-saml</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- SSL Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-ssl</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-openid</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-openid</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

10
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java
View File

@@ -21,13 +21,13 @@ package org.apache.guacamole.auth.openid.conf;
import com.google.inject.Inject;
import java.net.URI;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
/**
@@ -138,8 +138,8 @@ public class ConfigurationService {
* The claims within any valid JWT that should be mapped to
* the authenticated user's tokens, as configured with guacamole.properties.
*/
private static final StringListProperty OPENID_ATTRIBUTES_CLAIM_TYPE =
new StringListProperty() {
private static final StringGuacamoleProperty OPENID_ATTRIBUTES_CLAIM_TYPE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-attributes-claim-type"; }
};
@@ -356,8 +356,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public List<String> getAttributesClaimType() throws GuacamoleException {
return environment.getProperty(OPENID_ATTRIBUTES_CLAIM_TYPE, DEFAULT_ATTRIBUTES_CLAIM_TYPE);
public Collection<String> getAttributesClaimType() throws GuacamoleException {
return environment.getPropertyCollection(OPENID_ATTRIBUTES_CLAIM_TYPE, DEFAULT_ATTRIBUTES_CLAIM_TYPE);
}
/**

3
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
View File

@@ -20,6 +20,7 @@
package org.apache.guacamole.auth.openid.token;
import com.google.inject.Inject;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
@@ -229,7 +230,7 @@ public class TokenValidationService {
* If guacamole.properties could not be parsed.
*/
public Map<String, String> processAttributes(JwtClaims claims) throws GuacamoleException {
List<String> attributesClaim = confService.getAttributesClaimType();
Collection<String> attributesClaim = confService.getAttributesClaimType();
if (claims != null && !attributesClaim.isEmpty()) {
try {

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "OpenID Authentication Extension",
"namespace" : "openid",

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-saml</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-saml</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "SAML Authentication Extension",
"namespace" : "saml",

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-ssl</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-ssl</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

3
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
View File

@@ -26,6 +26,7 @@ import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.util.Collection;
import java.util.Date;
import java.util.List;
import java.util.concurrent.TimeUnit;
@@ -214,7 +215,7 @@ public class SSLClientAuthenticationResource extends SSOResource {
// Verify that the username is specified with one of the allowed
// attributes
List<String> usernameAttributes = confService.getSubjectUsernameAttributes();
Collection<String> usernameAttributes = confService.getSubjectUsernameAttributes();
if (usernameAttributes != null && !usernameAttributes.stream().anyMatch(nameRdn.getType()::equalsIgnoreCase))
throw new GuacamoleClientException("Subject DN \"" + dn + "\" "
+ "does not contain an acceptable username attribute.");

11
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
View File

@@ -22,7 +22,7 @@ package org.apache.guacamole.auth.ssl.conf;
import com.google.inject.Inject;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.List;
import java.util.Collection;
import javax.naming.ldap.LdapName;
import javax.ws.rs.core.UriBuilder;
import org.apache.guacamole.GuacamoleException;
@@ -30,7 +30,6 @@ import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
/**
@@ -146,8 +145,8 @@ public class ConfigurationService {
* one of these attributes, the certificate will be rejected. By default,
* any attribute is accepted.
*/
private static final StringListProperty SSL_SUBJECT_USERNAME_ATTRIBUTE =
new StringListProperty () {
private static final StringGuacamoleProperty SSL_SUBJECT_USERNAME_ATTRIBUTE =
new StringGuacamoleProperty () {
@Override
public String getName() { return "ssl-subject-username-attribute"; }
@@ -433,8 +432,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If the configured set of username attributes cannot be read.
*/
public List<String> getSubjectUsernameAttributes() throws GuacamoleException {
return environment.getProperty(SSL_SUBJECT_USERNAME_ATTRIBUTE);
public Collection<String> getSubjectUsernameAttributes() throws GuacamoleException {
return environment.getPropertyCollection(SSL_SUBJECT_USERNAME_ATTRIBUTE);
}
}

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "SSL Authentication Extension",
"namespace" : "ssl",

8
extensions/guacamole-auth-sso/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -60,7 +60,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -68,7 +68,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- Java servlet API -->

14
extensions/guacamole-auth-totp/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-totp</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-totp</name>
<url>http://guacamole.incubator.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -127,7 +127,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -177,6 +177,14 @@
<version>2.1.1</version>
<scope>provided</scope>
</dependency>
<!-- Library for unified IPv4/6 parsing and validation -->
<dependency>
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.5.0</version>
<scope>provided</scope>
</dependency>
</dependencies>

68
extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/conf/ConfigurationService.java
View File

@@ -20,10 +20,14 @@
package org.apache.guacamole.auth.totp.conf;
import com.google.inject.Inject;
import inet.ipaddr.IPAddress;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.EnumGuacamoleProperty;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.totp.TOTPGenerator;
@@ -88,6 +92,36 @@ public class ConfigurationService {
public String getName() { return "totp-mode"; }
};
/**
* A property that contains a list of IP addresses and/or subnets for which
* MFA via the TOTP module should be bypassed. Users logging in from addresses
* contained in this list will not be prompted for a second authentication
* factor. If this property is empty or not defined, and the TOTP module
* is installed, all users will be prompted for MFA.
*/
private static final IPAddressListProperty TOTP_BYPASS_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "totp-bypass-hosts"; }
};
/**
* A property that contains a list of IP addresses and/or subnets for which
* MFA via the TOTP module should explicitly be enabled. If this property is defined,
* and the TOTP module is installed, users logging in from hosts contained
* in this list will be prompted for MFA, and users logging in from all
* other hosts will not be prompted for MFA.
*/
private static final IPAddressListProperty TOTP_ENFORCE_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "totp-enforce-hosts"; }
};
/**
* Returns the human-readable name of the entity issuing user accounts. If
@@ -158,5 +192,39 @@ public class ConfigurationService {
public TOTPGenerator.Mode getMode() throws GuacamoleException {
return environment.getProperty(TOTP_MODE, TOTPGenerator.Mode.SHA1);
}
/**
* Return the list of IP addresses and/or subnets for which MFA authentication via the
* TOTP module should be bypassed, allowing users from those addresses to log in
* without the MFA requirement.
*
* @return
* A list of IP addresses and/or subnets for which MFA authentication
* should be bypassed.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getBypassHosts() throws GuacamoleException {
return environment.getProperty(TOTP_BYPASS_HOSTS, Collections.emptyList());
}
/**
* Return the list of IP addresses and/or subnets for which MFA authentication via the TOTP
* module should be explicitly enabled, requiring users logging in from hosts specified in
* the list to complete MFA.
*
* @return
* A list of IP addresses and/or subnets for which MFA authentication
* should be explicitly enabled.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getEnforceHosts() throws GuacamoleException {
return environment.getProperty(TOTP_ENFORCE_HOSTS, Collections.emptyList());
}
}

47
extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
View File

@@ -22,9 +22,12 @@ package org.apache.guacamole.auth.totp.user;
import com.google.common.io.BaseEncoding;
import com.google.inject.Inject;
import com.google.inject.Provider;
import inet.ipaddr.IPAddress;
import inet.ipaddr.IPAddressString;
import java.security.InvalidKeyException;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
import javax.servlet.http.HttpServletRequest;
@@ -44,6 +47,7 @@ import org.apache.guacamole.net.auth.User;
import org.apache.guacamole.net.auth.UserContext;
import org.apache.guacamole.net.auth.UserGroup;
import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.apache.guacamole.totp.TOTPGenerator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -311,6 +315,45 @@ public class UserVerificationService {
public void verifyIdentity(UserContext context,
AuthenticatedUser authenticatedUser) throws GuacamoleException {
// Pull the original HTTP request used to authenticate
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
// Get the current client address
IPAddress clientAddr = new IPAddressString(request.getRemoteAddr()).getAddress();
// Ignore anonymous users
if (authenticatedUser.getIdentifier().equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
return;
// Pull address lists to check from configuration. Note that the enforce
// list will override the bypass list, which means that, if the client
// address happens to be in both lists, Duo MFA will be enforced.
List<IPAddress> bypassAddresses = confService.getBypassHosts();
List<IPAddress> enforceAddresses = confService.getEnforceHosts();
// Check the bypass list for the client address, and set the enforce
// flag to the opposite.
boolean enforceHost = !(IPAddressListProperty.addressListContains(bypassAddresses, clientAddr));
// Only continue processing if the list is not empty
if (!enforceAddresses.isEmpty()) {
// If client address is not available or invalid, MFA will
// be enforced.
if (clientAddr == null || !clientAddr.isIPAddress())
enforceHost = true;
// Check the enforce list and set the flag if the client address
// is found in the list.
else
enforceHost = IPAddressListProperty.addressListContains(enforceAddresses, clientAddr);
}
// If the enforce flag is not true, bypass TOTP MFA.
if (!enforceHost)
return;
// Ignore anonymous users
String username = authenticatedUser.getIdentifier();
if (username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
@@ -325,10 +368,6 @@ public class UserVerificationService {
if (key == null)
return;
// Pull the original HTTP request used to authenticate
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
// Retrieve TOTP from request
String code = request.getParameter(AuthenticationCodeField.PARAMETER_NAME);

2
extensions/guacamole-auth-totp/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "TOTP TFA Authentication Backend",
"namespace" : "totp",

4
extensions/guacamole-display-statistics/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-display-statistics</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-display-statistics</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>

2
extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Display Statistic Toolbar",
"namespace" : "display-stats",

6
extensions/guacamole-history-recording-storage/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-history-recording-storage</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-history-recording-storage</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

2
extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Session Recording Storage",
"namespace" : "recording-storage",

2
extensions/guacamole-vault/modules/guacamole-vault-base/pom.xml
View File

@@ -36,7 +36,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

4
extensions/guacamole-vault/modules/guacamole-vault-dist/pom.xml
View File

@@ -36,7 +36,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -46,7 +46,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault-ksm</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

6
extensions/guacamole-vault/modules/guacamole-vault-ksm/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault-ksm</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-vault-ksm</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -54,7 +54,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<dependency>

2
extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Keeper Secrets Manager",
"namespace" : "keeper-secrets-manager",

6
extensions/guacamole-vault/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-vault</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -57,7 +57,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

4
extensions/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>extensions</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-client</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>