safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-06 05:07:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge changes from patch branch back to main.

Browse Source
This commit is contained in:
Michael Jumper
2024-08-30 10:52:54 -07:00
parent 468c05070f df1745faa7
commit bef7e30ba2
107 changed files with 1380 additions and 294 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
doc/guacamole-example/pom.xml
View File

@@ -26,7 +26,7 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-example</artifactId>
<packaging>war</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-example</name>
<url>http://guacamole.apache.org/</url>
@@ -106,7 +106,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-common</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>compile</scope>
</dependency>
@@ -114,7 +114,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-common-js</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<type>zip</type>
<scope>runtime</scope>
</dependency>

4
doc/guacamole-playback-example/pom.xml
View File

@@ -26,7 +26,7 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-playback-example</artifactId>
<packaging>war</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-playback-example</name>
<url>http://guacamole.apache.org/</url>
@@ -88,7 +88,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-common-js</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<type>zip</type>
<scope>runtime</scope>
</dependency>

6
extensions/guacamole-auth-ban/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-ban</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-ban</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -51,7 +51,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
<!-- Exclude transitive dependencies that will be overridden by

2
extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Brute-force Authentication Detection/Prevention",
"namespace" : "ban",

14
extensions/guacamole-auth-duo/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-duo</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-duo</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -130,6 +130,14 @@
<version>${kotlin.version}</version>
</dependency>
<!-- Library for unified IPv4/6 parsing and validation -->
<dependency>
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.5.0</version>
<scope>provided</scope>
</dependency>
</dependencies>
</project>

45
extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
View File

@@ -23,10 +23,13 @@ import com.duosecurity.Client;
import com.duosecurity.exception.DuoException;
import com.duosecurity.model.Token;
import com.google.inject.Inject;
import inet.ipaddr.IPAddress;
import inet.ipaddr.IPAddressString;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.Collections;
import java.util.concurrent.TimeUnit;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
@@ -37,6 +40,7 @@ import org.apache.guacamole.language.TranslatableMessage;
import org.apache.guacamole.net.auth.AuthenticatedUser;
import org.apache.guacamole.net.auth.Credentials;
import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -107,9 +111,41 @@ public class UserVerificationService {
public void verifyAuthenticatedUser(AuthenticatedUser authenticatedUser)
throws GuacamoleException {
// Ignore anonymous users (unverifiable)
// Pull the original HTTP request used to authenticate
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
IPAddress clientAddr = new IPAddressString(request.getRemoteAddr()).getAddress();
// Ignore anonymous users
String username = authenticatedUser.getIdentifier();
if (username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
if (username == null || username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
return;
// Pull address lists to check from configuration. Note that the enforce
// list will override the bypass list, which means that, if the client
// address happens to be in both lists, Duo MFA will be enforced.
List<IPAddress> bypassAddresses = confService.getBypassHosts();
List<IPAddress> enforceAddresses = confService.getEnforceHosts();
// Check if the bypass list contains the client address, and set the
// enforce flag to the opposite.
boolean enforceHost = !(IPAddressListProperty.addressListContains(bypassAddresses, clientAddr));
// Only continue processing if the list is not empty
if (!enforceAddresses.isEmpty()) {
// If client address is not available or invalid, MFA will
// be enforced.
if (clientAddr == null || !clientAddr.isIPAddress())
enforceHost = true;
// Check the enforce list for the client address and set enforcement flag.
else
enforceHost = IPAddressListProperty.addressListContains(enforceAddresses, clientAddr);
}
// If the enforce flag is not true, bypass Duo MFA.
if (!enforceHost)
return;
// Obtain a Duo client for redirecting the user to the Duo service and
@@ -137,11 +173,6 @@ public class UserVerificationService {
+ "not currently available (failed health check).", e);
}
// Pull the original HTTP request used to authenticate, as well as any
// associated credentials
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
// Retrieve signed Duo authentication code and session state from the
// request (these will be absent if this is an initial authentication
// attempt and not a redirect back from Duo)

76
extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
View File

@@ -20,10 +20,14 @@
package org.apache.guacamole.auth.duo.conf;
import com.google.inject.Inject;
import inet.ipaddr.IPAddress;
import java.net.URI;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
@@ -106,6 +110,40 @@ public class ConfigurationService {
};
/**
* The optional property that contains a comma-separated list of IP addresses
* or CIDRs for which the MFA requirement should be bypassed. If the Duo
* extension is installed, any/all users authenticating from clients that
* match this list will be able to successfully log in without fulfilling
* the MFA requirement. If this option is omitted or is empty, and the
* Duo module is installed, all users from all hosts will have Duo MFA
* enforced.
*/
private static final IPAddressListProperty DUO_BYPASS_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "duo-bypass-hosts"; }
};
/**
* The optional property that contains a comma-separated list of IP addresses
* or CIDRs for which the MFA requirement should be explicitly enforced. If
* the Duo module is enabled and this property is specified, users that log
* in from hosts that match the items in this list will have Duo MFA required,
* and all users from hosts that do not match this list will be able to log
* in without the MFA requirement. If this option is missing or empty and
* the Duo module is installed, MFA will be enforced for all users.
*/
private static final IPAddressListProperty DUO_ENFORCE_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "duo-enforce-hosts"; }
};
/**
* Returns the hostname of the Duo API endpoint to be used to verify user
* identities, as defined in guacamole.properties by the "duo-api-hostname"
@@ -189,4 +227,42 @@ public class ConfigurationService {
return environment.getProperty(DUO_AUTH_TIMEOUT, 5);
}
/**
* Returns the list of IP addresses and subnets defined in guacamole.properties
* for which Duo MFA should _not_ be enforced. Users logging in from hosts
* contained in this list will be logged in without the MFA requirement.
*
* @return
* A list of IP addresses and subnets for which Duo MFA should not be
* enforced.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getBypassHosts() throws GuacamoleException {
return environment.getProperty(DUO_BYPASS_HOSTS, Collections.emptyList());
}
/**
* Returns the list of IP addresses and subnets defined in guacamole.properties
* for which Duo MFA should explicitly be enforced, while logins from all
* other hosts should not enforce MFA. Users logging in from hosts
* contained in this list will be required to complete the Duo MFA authentication,
* while users from all other hosts will be logged in without the MFA requirement.
*
* @return
* A list of IP addresses and subnets for which Duo MFA should be
* explicitly enforced.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getEnforceHosts() throws GuacamoleException {
return environment.getProperty(DUO_ENFORCE_HOSTS, Collections.emptyList());
}
}

2
extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Duo TFA Authentication Backend",
"namespace" : "duo",

6
extensions/guacamole-auth-header/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-header</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-header</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

2
extensions/guacamole-auth-header/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "HTTP Header Authentication Extension",
"namespace" : "header",

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
View File

@@ -483,8 +483,8 @@ public class ConnectionService extends ModeledChildDirectoryObjectService<Modele
List<ConnectionRecordModel> searchResults;
// Bypass permission checks if the user is privileged
if (user.isPrivileged())
// Bypass permission checks if the user is privileged or has System-level audit permissions
if (user.isPrivileged() || user.getUser().getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.AUDIT))
searchResults = connectionRecordMapper.search(identifier,
recordIdentifier, requiredContents, sortPredicates, limit);

71
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
View File

@@ -21,6 +21,7 @@ package org.apache.guacamole.auth.jdbc.tunnel;
import com.google.inject.Inject;
import com.google.inject.Provider;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
@@ -81,6 +82,56 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
*/
private final Logger logger = LoggerFactory.getLogger(AbstractGuacamoleTunnelService.class);
/**
* The prefix that will be used to generate JDBC tokens.
*/
private final String JDBC_TOKEN_PREFIX = "JDBC_";
/**
* The token that contains the date the connection was started.
*/
private final String JDBC_DATE_TOKEN = JDBC_TOKEN_PREFIX + "STARTDATE";
/**
* The format of the date in the date token.
*/
private final String JDBC_DATE_TOKEN_FORMAT = "yyyyMMdd";
/**
* The token that contains the start time of the connection.
*/
private final String JDBC_TIME_TOKEN = JDBC_TOKEN_PREFIX + "STARTTIME";
/**
* The format of the time in the time token.
*/
private final String JDBC_TIME_TOKEN_FORMAT = "HHmmss";
/**
* The token that contains the connection name.
*/
private final String JDBC_CONNECTION_NAME_TOKEN = JDBC_TOKEN_PREFIX + "CONNECTION_NAME";
/**
* The token that contains the connection identifier.
*/
private final String JDBC_CONNECTION_ID_TOKEN = JDBC_TOKEN_PREFIX + "CONNECTION_ID";
/**
* The token that contains the hostname configured in the connection parameters.
*/
private final String JDBC_CONNECTION_HOSTNAME_TOKEN = JDBC_TOKEN_PREFIX + "HOSTNAME";
/**
* The name of the parameter containing the hostname in the configuration.
*/
private final String JDBC_CONNECTION_HOSTNAME_TOKEN_PARAMETER = "hostname";
/**
* The token containing the protocol configured in the connection.
*/
private final String JDBC_CONNECTION_PROTOCOL_TOKEN = JDBC_TOKEN_PREFIX + "PROTOCOL";
/**
* Mapper for accessing connections.
*/
@@ -121,7 +172,7 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
* All active connections through the tunnel having a given UUID.
*/
private final Map<String, ActiveConnectionRecord> activeTunnels =
new ConcurrentHashMap<String, ActiveConnectionRecord>();
new ConcurrentHashMap<>();
/**
* All active connections to a connection having a given identifier.
@@ -460,8 +511,24 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
}
// Include history record UUID as token
// Make a copy of the tokens
tokens = new HashMap<>(tokens);
// Set up JDBC-specific tokens
tokens.put(JDBC_DATE_TOKEN,
new SimpleDateFormat(JDBC_DATE_TOKEN_FORMAT)
.format(activeConnection.getStartDate()));
tokens.put(JDBC_TIME_TOKEN,
new SimpleDateFormat(JDBC_TIME_TOKEN_FORMAT)
.format(activeConnection.getStartDate()));
tokens.put(JDBC_CONNECTION_NAME_TOKEN, activeConnection.getConnectionName());
tokens.put(JDBC_CONNECTION_ID_TOKEN, activeConnection.getConnectionIdentifier());
tokens.put(JDBC_CONNECTION_HOSTNAME_TOKEN,
activeConnection.getConnection().getConfiguration().getParameter(JDBC_CONNECTION_HOSTNAME_TOKEN_PARAMETER));
tokens.put(JDBC_CONNECTION_PROTOCOL_TOKEN,
activeConnection.getConnection().getConfiguration().getProtocol());
// Include history record UUID as token
tokens.put("HISTORY_UUID", activeConnection.getUUID().toString());
// Build token filter containing credential tokens

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
View File

@@ -611,8 +611,8 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
List<ActivityRecordModel> searchResults;
// Bypass permission checks if the user is privileged
if (user.isPrivileged())
// Bypass permission checks if the user is privileged or has System-level audit permissions
if (user.isPrivileged() || user.getUser().getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.AUDIT))
searchResults = userRecordMapper.search(username, recordIdentifier,
requiredContents, sortPredicates, limit);

8
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-dist/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -42,21 +42,21 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-mysql</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- PostgreSQL Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-postgresql</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- SQL Server Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-sqlserver</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/001-create-schema.sql
View File

@@ -459,6 +459,7 @@ CREATE TABLE `guacamole_system_permission` (
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER') NOT NULL,
PRIMARY KEY (`entity_id`,`permission`),
@@ -611,3 +612,4 @@ CREATE TABLE guacamole_user_password_history (
REFERENCES `guacamole_user` (`user_id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/002-create-admin-user.sql
View File

@@ -51,3 +51,4 @@ FROM (
JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'
JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER'
JOIN guacamole_user ON guacamole_user.entity_id = affected.entity_id;

32
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-1.6.0.sql Normal file
View File

@@ -0,0 +1,32 @@
--
-- Licensed to the Apache Software Foundation (ASF) under one
-- or more contributor license agreements. See the NOTICE file
-- distributed with this work for additional information
-- regarding copyright ownership. The ASF licenses this file
-- to you under the Apache License, Version 2.0 (the
-- "License"); you may not use this file except in compliance
-- with the License. You may obtain a copy of the License at
--
-- http://www.apache.org/licenses/LICENSE-2.0
--
-- Unless required by applicable law or agreed to in writing,
-- software distributed under the License is distributed on an
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-- KIND, either express or implied. See the License for the
-- specific language governing permissions and limitations
-- under the License.
--
--
-- Add new system-level permission
--
ALTER TABLE `guacamole_system_permission`
MODIFY `permission` enum('CREATE_CONNECTION',
'CREATE_CONNECTION_GROUP',
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER') NOT NULL;

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "MySQL Authentication",
"namespace" : "mysql",

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/001-create-schema.sql
View File

@@ -56,6 +56,7 @@ CREATE TYPE guacamole_system_permission_type AS ENUM(
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER'
);

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/002-create-admin-user.sql
View File

@@ -53,3 +53,4 @@ FROM (
JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'
JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER'
JOIN guacamole_user ON guacamole_user.entity_id = affected.entity_id;

27
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-1.6.0.sql Normal file
View File

@@ -0,0 +1,27 @@
--
-- Licensed to the Apache Software Foundation (ASF) under one
-- or more contributor license agreements. See the NOTICE file
-- distributed with this work for additional information
-- regarding copyright ownership. The ASF licenses this file
-- to you under the Apache License, Version 2.0 (the
-- "License"); you may not use this file except in compliance
-- with the License. You may obtain a copy of the License at
--
-- http://www.apache.org/licenses/LICENSE-2.0
--
-- Unless required by applicable law or agreed to in writing,
-- software distributed under the License is distributed on an
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-- KIND, either express or implied. See the License for the
-- specific language governing permissions and limitations
-- under the License.
--
--
-- Add new system-level audit permission
--
ALTER TYPE guacamole_system_permission_type
ADD VALUE 'AUDIT'
BEFORE 'ADMINISTER';

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "PostgreSQL Authentication",
"namespace" : "postgresql",

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -49,7 +49,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/schema/001-create-schema.sql
View File

@@ -77,6 +77,7 @@ CREATE RULE [guacamole_system_permission_list] AS @list IN (
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER'
);
GO

1
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/schema/002-create-admin-user.sql
View File

@@ -61,3 +61,4 @@ JOIN [guacamole_entity] ON [permissions].[username] = [guacamole_enti
JOIN [guacamole_entity] [affected] ON [permissions].[affected_username] = [affected].[name] AND [guacamole_entity].[type] = 'USER'
JOIN [guacamole_user] ON [guacamole_user].[entity_id] = [affected].[entity_id];
GO

43
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/schema/upgrade/upgrade-pre-1.6.0.sql Normal file
View File

@@ -0,0 +1,43 @@
--
-- Licensed to the Apache Software Foundation (ASF) under one
-- or more contributor license agreements. See the NOTICE file
-- distributed with this work for additional information
-- regarding copyright ownership. The ASF licenses this file
-- to you under the Apache License, Version 2.0 (the
-- "License"); you may not use this file except in compliance
-- with the License. You may obtain a copy of the License at
--
-- http://www.apache.org/licenses/LICENSE-2.0
--
-- Unless required by applicable law or agreed to in writing,
-- software distributed under the License is distributed on an
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-- KIND, either express or implied. See the License for the
-- specific language governing permissions and limitations
-- under the License.
--
--
-- Add new system-level audit permission
--
EXEC sp_unbindrule 'guacamole_system_permission';
DROP RULE [guacamole_system_permission_list];
GO
CREATE RULE [guacamole_system_permission_list] AS @list IN (
'CREATE_CONNECTION',
'CREATE_CONNECTION_GROUP',
'CREATE_SHARING_PROFILE',
'CREATE_USER',
'CREATE_USER_GROUP',
'AUDIT',
'ADMINISTER'
);
GO
EXEC sp_bindrule
'guacamole_system_permission_list',
'guacamole_system_permission';
GO

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "SQLServer Authentication",
"namespace" : "sqlserver",

6
extensions/guacamole-auth-jdbc/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-jdbc</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-jdbc</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -59,7 +59,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

7
extensions/guacamole-auth-json/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-json</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-json</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -78,6 +78,7 @@
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.5.0</version>
<scope>provided</scope>
</dependency>
<!-- JUnit -->

6
extensions/guacamole-auth-json/src/main/java/org/apache/guacamole/auth/json/ConfigurationService.java
View File

@@ -25,7 +25,7 @@ import java.util.Collections;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.ByteArrayProperty;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
/**
* Service for retrieving configuration information regarding the JSON
@@ -56,7 +56,7 @@ public class ConfigurationService {
* be allowed to perform authentication. If not specified, ALL address will
* be allowed.
*/
private static final StringListProperty JSON_TRUSTED_NETWORKS = new StringListProperty() {
private static final StringGuacamoleProperty JSON_TRUSTED_NETWORKS = new StringGuacamoleProperty() {
@Override
public String getName() {
@@ -95,7 +95,7 @@ public class ConfigurationService {
* If guacamole.properties cannot be parsed.
*/
public Collection<String> getTrustedNetworks() throws GuacamoleException {
return environment.getProperty(JSON_TRUSTED_NETWORKS, Collections.<String>emptyList());
return environment.getPropertyCollection(JSON_TRUSTED_NETWORKS, Collections.<String>emptyList());
}
}

2
extensions/guacamole-auth-json/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Encrypted JSON Authentication",
"namespace" : "json",

6
extensions/guacamole-auth-ldap/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-ldap</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-ldap</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

27
extensions/guacamole-auth-ldap/schema/guacConfigGroup.ldif
View File

@@ -20,9 +20,24 @@
dn: cn=guacConfigGroup,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: guacConfigGroup
olcAttributeTypes: {0}( 1.3.6.1.4.1.38971.1.1.1 NAME 'guacConfigProtocol' SYNTAX 1.3.6.1.4.1.1466
.115.121.1.15 )
olcAttributeTypes: {1}( 1.3.6.1.4.1.38971.1.1.2 NAME 'guacConfigParameter' SYNTAX 1.3.6.1.4.1.146
6.115.121.1.15 )
olcObjectClasses: {0}( 1.3.6.1.4.1.38971.1.2.1 NAME 'guacConfigGroup' DESC 'Guacamole config
uration group' SUP groupOfNames MUST guacConfigProtocol MAY guacConfigParameter )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.1 NAME 'guacConfigProtocol'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.2 NAME 'guacConfigParameter'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.3 NAME 'guacConfigProxyHostname'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.4 NAME 'guacConfigProxyPort'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcAttributeTypes: ( 1.3.6.1.4.1.38971.1.1.5 NAME 'guacConfigProxyEncryption'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcObjectClasses: ( 1.3.6.1.4.1.38971.1.2.1 NAME 'guacConfigGroup'
DESC 'Guacamole configuration group'
SUP groupOfNames
MUST guacConfigProtocol
MAY ( guacConfigParameter $
guacConfigProxyHostname $
guacConfigProxyPort $
guacConfigProxyEncryption ) )

16
extensions/guacamole-auth-ldap/schema/guacConfigGroup.schema
View File

@@ -23,9 +23,23 @@ attributetype ( 1.3.6.1.4.1.38971.1.1.1 NAME 'guacConfigProtocol'
attributetype ( 1.3.6.1.4.1.38971.1.1.2 NAME 'guacConfigParameter'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributetype ( 1.3.6.1.4.1.38971.1.1.3 NAME 'guacConfigProxyHostname'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributetype ( 1.3.6.1.4.1.38971.1.1.4 NAME 'guacConfigProxyPort'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
attributetype ( 1.3.6.1.4.1.38971.1.1.5 NAME 'guacConfigProxyEncryption'
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
objectClass ( 1.3.6.1.4.1.38971.1.2.1 NAME 'guacConfigGroup'
DESC 'Guacamole configuration group'
SUP groupOfNames
MUST guacConfigProtocol
MAY guacConfigParameter )
MAY ( guacConfigParameter $
guacConfigProxyHostname $
guacConfigProxyPort $
guacConfigProxyEncryption ) )

2
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/AuthenticationProviderService.java
View File

@@ -401,7 +401,7 @@ public class AuthenticationProviderService {
throws GuacamoleException {
// Get attributes from configuration information
List<String> attrList = config.getAttributes();
Collection<String> attrList = config.getAttributes();
// If there are no attributes there is no reason to search LDAP
if (attrList.isEmpty())

7
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ConnectedLDAPConfiguration.java
View File

@@ -19,6 +19,7 @@
package org.apache.guacamole.auth.ldap;
import java.util.Collection;
import java.util.List;
import org.apache.directory.api.ldap.model.filter.ExprNode;
import org.apache.directory.api.ldap.model.message.AliasDerefMode;
@@ -124,7 +125,7 @@ public class ConnectedLDAPConfiguration implements LDAPConfiguration, AutoClosea
}
@Override
public List<String> getUsernameAttributes() throws GuacamoleException {
public Collection<String> getUsernameAttributes() throws GuacamoleException {
return config.getUsernameAttributes();
}
@@ -139,7 +140,7 @@ public class ConnectedLDAPConfiguration implements LDAPConfiguration, AutoClosea
}
@Override
public List<String> getGroupNameAttributes() throws GuacamoleException {
public Collection<String> getGroupNameAttributes() throws GuacamoleException {
return config.getGroupNameAttributes();
}
@@ -209,7 +210,7 @@ public class ConnectedLDAPConfiguration implements LDAPConfiguration, AutoClosea
}
@Override
public List<String> getAttributes() throws GuacamoleException {
public Collection<String> getAttributes() throws GuacamoleException {
return config.getAttributes();
}

14
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/EnvironmentLDAPConfiguration.java
View File

@@ -19,7 +19,7 @@
package org.apache.guacamole.auth.ldap.conf;
import java.util.List;
import java.util.Collection;
import org.apache.directory.api.ldap.model.filter.ExprNode;
import org.apache.directory.api.ldap.model.message.AliasDerefMode;
import org.apache.directory.api.ldap.model.name.Dn;
@@ -75,8 +75,8 @@ public class EnvironmentLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getUsernameAttributes() throws GuacamoleException {
return environment.getProperty(
public Collection<String> getUsernameAttributes() throws GuacamoleException {
return environment.getPropertyCollection(
LDAPGuacamoleProperties.LDAP_USERNAME_ATTRIBUTE,
DEFAULT.getUsernameAttributes()
);
@@ -98,8 +98,8 @@ public class EnvironmentLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getGroupNameAttributes() throws GuacamoleException {
return environment.getProperty(
public Collection<String> getGroupNameAttributes() throws GuacamoleException {
return environment.getPropertyCollection(
LDAPGuacamoleProperties.LDAP_GROUP_NAME_ATTRIBUTE,
DEFAULT.getGroupNameAttributes()
);
@@ -210,8 +210,8 @@ public class EnvironmentLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getAttributes() throws GuacamoleException {
return environment.getProperty(
public Collection<String> getAttributes() throws GuacamoleException {
return environment.getPropertyCollection(
LDAPGuacamoleProperties.LDAP_USER_ATTRIBUTES,
DEFAULT.getAttributes()
);

7
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/JacksonLDAPConfiguration.java
View File

@@ -22,6 +22,7 @@ package org.apache.guacamole.auth.ldap.conf;
import com.fasterxml.jackson.annotation.JsonFormat;
import static com.fasterxml.jackson.annotation.JsonFormat.Feature.ACCEPT_SINGLE_VALUE_AS_ARRAY;
import com.fasterxml.jackson.annotation.JsonProperty;
import java.util.Collection;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -331,7 +332,7 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getUsernameAttributes() throws GuacamoleException {
public Collection<String> getUsernameAttributes() throws GuacamoleException {
return withDefault(usernameAttributes, defaultConfig::getUsernameAttributes);
}
@@ -348,7 +349,7 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getGroupNameAttributes() throws GuacamoleException {
public Collection<String> getGroupNameAttributes() throws GuacamoleException {
return withDefault(groupNameAttributes, defaultConfig::getGroupNameAttributes);
}
@@ -424,7 +425,7 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
}
@Override
public List<String> getAttributes() throws GuacamoleException {
public Collection<String> getAttributes() throws GuacamoleException {
return withDefault(userAttributes, defaultConfig::getAttributes);
}

7
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPConfiguration.java
View File

@@ -19,6 +19,7 @@
package org.apache.guacamole.auth.ldap.conf;
import java.util.Collection;
import java.util.List;
import org.apache.directory.api.ldap.model.filter.ExprNode;
import org.apache.directory.api.ldap.model.message.AliasDerefMode;
@@ -84,7 +85,7 @@ public interface LDAPConfiguration {
* @throws GuacamoleException
* If the username attributes cannot be retrieved.
*/
List<String> getUsernameAttributes() throws GuacamoleException;
Collection<String> getUsernameAttributes() throws GuacamoleException;
/**
* Returns the base DN under which all Guacamole users will be stored
@@ -125,7 +126,7 @@ public interface LDAPConfiguration {
* @throws GuacamoleException
* If the group name attributes cannot be retrieved.
*/
List<String> getGroupNameAttributes() throws GuacamoleException;
Collection<String> getGroupNameAttributes() throws GuacamoleException;
/**
* Returns the base DN under which all Guacamole role based access control
@@ -305,7 +306,7 @@ public interface LDAPConfiguration {
* If the names of the LDAP user attributes to be exposed as parameter
* tokens cannot be retrieved.
*/
List<String> getAttributes() throws GuacamoleException;
Collection<String> getAttributes() throws GuacamoleException;
/**
* Returns the name of the LDAP attribute used to enumerate members in a

12
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPGuacamoleProperties.java
View File

@@ -84,8 +84,8 @@ public class LDAPGuacamoleProperties {
* one attribute, and the concatenation of that attribute and the value of
* LDAP_USER_BASE_DN must equal the user's full DN.
*/
public static final StringListProperty LDAP_USERNAME_ATTRIBUTE =
new StringListProperty() {
public static final StringGuacamoleProperty LDAP_USERNAME_ATTRIBUTE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "ldap-username-attribute"; }
@@ -97,8 +97,8 @@ public class LDAPGuacamoleProperties {
* attributes must be present within each Guacamole user group's record in
* the LDAP directory for that group to be visible.
*/
public static final StringListProperty LDAP_GROUP_NAME_ATTRIBUTE =
new StringListProperty() {
public static final StringGuacamoleProperty LDAP_GROUP_NAME_ATTRIBUTE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "ldap-group-name-attribute"; }
@@ -277,8 +277,8 @@ public class LDAPGuacamoleProperties {
* Custom attribute or attributes to query from Guacamole user's record in
* the LDAP directory.
*/
public static final StringListProperty LDAP_USER_ATTRIBUTES =
new StringListProperty() {
public static final StringGuacamoleProperty LDAP_USER_ATTRIBUTES =
new StringGuacamoleProperty() {
@Override
public String getName() { return "ldap-user-attributes"; }

62
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/StringListProperty.java
View File

@@ -1,62 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.ldap.conf;
import java.util.Arrays;
import java.util.List;
import java.util.regex.Pattern;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.properties.GuacamoleProperty;
/**
* A GuacamoleProperty whose value is a List of Strings. The string value
* parsed to produce this list is a comma-delimited list. Duplicate values are
* ignored, as is any whitespace following delimiters. To maintain
* compatibility with the behavior of Java properties in general, only
* whitespace at the beginning of each value is ignored; trailing whitespace
* becomes part of the value.
*/
public abstract class StringListProperty implements GuacamoleProperty<List<String>> {
/**
* A pattern which matches against the delimiters between values. This is
* currently simply a comma and any following whitespace. Parts of the
* input string which match this pattern will not be included in the parsed
* result.
*/
private static final Pattern DELIMITER_PATTERN = Pattern.compile(",\\s*");
@Override
public List<String> parseValue(String values) throws GuacamoleException {
// If no property provided, return null.
if (values == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(values));
if (stringValues.isEmpty())
return null;
return stringValues;
}
}

112
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java
View File

@@ -42,7 +42,11 @@ import org.apache.guacamole.auth.ldap.ConnectedLDAPConfiguration;
import org.apache.guacamole.auth.ldap.ObjectQueryService;
import org.apache.guacamole.auth.ldap.group.UserGroupService;
import org.apache.guacamole.auth.ldap.user.LDAPAuthenticatedUser;
import org.apache.guacamole.environment.LocalEnvironment;
import org.apache.guacamole.net.auth.AuthenticatedUser;
import org.apache.guacamole.net.auth.Connection;
import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration;
import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration.EncryptionMethod;
import org.apache.guacamole.net.auth.TokenInjectingConnection;
import org.apache.guacamole.net.auth.simple.SimpleConnection;
import org.apache.guacamole.protocol.GuacamoleConfiguration;
@@ -60,6 +64,33 @@ public class ConnectionService {
*/
private static final Logger logger = LoggerFactory.getLogger(ConnectionService.class);
/**
* The name of the LDAP attribute that stores connection configuration
* parameters for Guacamole.
*/
public static final String LDAP_ATTRIBUTE_PARAMETER = "guacConfigParameter";
/**
* The name of the LDAP attribute that stores the protocol for a Guacamole
* connection.
*/
public static final String LDAP_ATTRIBUTE_PROTOCOL = "guacConfigProtocol";
/**
* The name of the LDAP attribute that stores guacd proxy hostname.
*/
public static final String LDAP_ATTRIBUTE_PROXY_HOSTNAME = "guacConfigProxyHostname";
/**
* The name of the LDAP attribute that stores guacd proxy port.
*/
public static final String LDAP_ATTRIBUTE_PROXY_PORT = "guacConfigProxyPort";
/**
* The name of the LDAP attribute that stores guacd proxy hostname.
*/
public static final String LDAP_ATTRIBUTE_PROXY_ENCRYPTION = "guacConfigProxyEncryption";
/**
* Service for executing LDAP queries.
*/
@@ -192,12 +223,22 @@ public class ConnectionService {
config.setProtocol(protocol.getString());
}
catch (LdapInvalidAttributeValueException e) {
logger.error("Invalid value of the protocol entry: {}",
e.getMessage());
logger.error("Invalid value of the protocol entry: {}", e.getMessage());
logger.debug("LDAP exception when getting protocol value.", e);
return null;
}
// Get proxy configuration, if any
GuacamoleProxyConfiguration proxyConfig;
try {
proxyConfig = getProxyConfiguration(entry);
}
catch (GuacamoleException e) {
logger.error("Failed to retrieve proxy configuration.", e.getMessage());
logger.debug("Guacamole Exception when retrieving proxy configuration.", e);
return null;
}
// Get parameters, if any
Attribute parameterAttribute = entry.get(LDAP_ATTRIBUTE_NAME_PARAMETER);
if (parameterAttribute != null) {
@@ -209,10 +250,8 @@ public class ConnectionService {
parameter = parameterAttribute.getString();
}
catch (LdapInvalidAttributeValueException e) {
logger.warn("Parameter value not valid for {}: {}",
cnName, e.getMessage());
logger.debug("LDAP exception when getting parameter value.",
e);
logger.warn("Parameter value not valid for {}: {}", cnName, e.getMessage());
logger.debug("LDAP exception when getting parameter value.", e);
return null;
}
parameterAttribute.remove(parameter);
@@ -234,7 +273,7 @@ public class ConnectionService {
}
// Store connection using cn for both identifier and name
Connection connection = new SimpleConnection(cnName, cnName, config, true);
Connection connection = new SimpleConnection(cnName, cnName, proxyConfig, config, true);
connection.setParentIdentifier(LDAPAuthenticationProvider.ROOT_CONNECTION_GROUP);
// Inject LDAP-specific tokens only if LDAP handled user
@@ -302,4 +341,63 @@ public class ConnectionService {
return searchFilter;
}
/**
* Given an LDAP entry that stores a GuacamoleConfiguration, generate a
* GuacamoleProxyConfiguration that tells the client how to connect to guacd.
* If the proxy configuration values are not found in the LDAP entry the
* defaults from the environment are used. If errors occur while trying to
* ready or parse values from the LDAP entry a GuacamoleException is thrown.
*
* @param connectionEntry
* The LDAP entry that should be checked for proxy configuration values.
*
* @return
* The GuacamoleProxyConfiguration that contains information on how
* to contact guacd for the given Guacamole connection configuration.
*
* @throws GuacamoleException
* If errors occur trying to parse LDAP values from the entry.
*/
private GuacamoleProxyConfiguration getProxyConfiguration(Entry connectionEntry)
throws GuacamoleException {
try {
// Get default proxy configuration values
GuacamoleProxyConfiguration proxyConfig = LocalEnvironment.getInstance().getDefaultGuacamoleProxyConfiguration();
String proxyHostname = proxyConfig.getHostname();
int proxyPort = proxyConfig.getPort();
EncryptionMethod proxyEncryption = proxyConfig.getEncryptionMethod();
// Get the proxy hostname
Attribute proxyHostAttr = connectionEntry.get(LDAP_ATTRIBUTE_PROXY_HOSTNAME);
if (proxyHostAttr != null && proxyHostAttr.size() > 0)
proxyHostname = proxyHostAttr.getString();
// Get the proxy port
Attribute proxyPortAttr = connectionEntry.get(LDAP_ATTRIBUTE_PROXY_PORT);
if (proxyPortAttr != null && proxyPortAttr.size() > 0)
proxyPort = Integer.parseInt(proxyPortAttr.getString());
// Get the proxy encryption method
Attribute proxyEncryptionAttr = connectionEntry.get(LDAP_ATTRIBUTE_PROXY_ENCRYPTION);
if (proxyEncryptionAttr != null && proxyEncryptionAttr.size() > 0) {
try {
proxyEncryption = EncryptionMethod.valueOf(proxyEncryptionAttr.getString());
}
catch (IllegalArgumentException e) {
throw new GuacamoleServerException("Unknown encryption method specified, value must be either \"NONE\" or \"SSL\".", e);
}
}
// Return a new proxy configuration
return new GuacamoleProxyConfiguration(proxyHostname, proxyPort, proxyEncryption);
}
catch (LdapInvalidAttributeValueException e) {
logger.error("Invalid value in proxy configuration: {}", e.getMessage());
logger.debug("LDAP exception fetching proxy attribute value.", e);
throw new GuacamoleServerException("Invalid LDAP value in proxy configuration.", e);
}
}
}

2
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/user/UserService.java
View File

@@ -183,7 +183,7 @@ public class UserService {
throws GuacamoleException {
// Pull username attributes from properties
List<String> usernameAttributes = config.getUsernameAttributes();
List<String> usernameAttributes = new ArrayList<>(config.getUsernameAttributes());
// We need exactly one base DN to derive the user DN
if (usernameAttributes.size() != 1) {

2
extensions/guacamole-auth-ldap/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "LDAP Authentication",
"namespace" : "ldap",

6
extensions/guacamole-auth-quickconnect/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-quickconnect</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-quickconnect</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -98,7 +98,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

15
extensions/guacamole-auth-quickconnect/src/main/java/org/apache/guacamole/auth/quickconnect/conf/ConfigurationService.java
View File

@@ -20,10 +20,11 @@
package org.apache.guacamole.auth.quickconnect.conf;
import com.google.inject.Inject;
import java.util.Collection;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
/**
* Configuration options to control the QuickConnect module.
@@ -42,7 +43,7 @@ public class ConfigurationService {
* the parameters defined in this list. Defaults to null (all parameters
* are allowed).
*/
public static final StringListProperty QUICKCONNECT_ALLOWED_PARAMETERS = new StringListProperty() {
public static final StringGuacamoleProperty QUICKCONNECT_ALLOWED_PARAMETERS = new StringGuacamoleProperty() {
@Override
public String getName() { return "quickconnect-allowed-parameters"; }
@@ -55,7 +56,7 @@ public class ConfigurationService {
* except the ones defined in this list. Defaults to null (all parameters
* are allowed).
*/
public static final StringListProperty QUICKCONNECT_DENIED_PARAMETERS = new StringListProperty() {
public static final StringGuacamoleProperty QUICKCONNECT_DENIED_PARAMETERS = new StringGuacamoleProperty() {
@Override
public String getName() { return "quickconnect-denied-parameters"; }
@@ -74,8 +75,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public List<String> getAllowedParameters() throws GuacamoleException {
return environment.getProperty(QUICKCONNECT_ALLOWED_PARAMETERS);
public Collection<String> getAllowedParameters() throws GuacamoleException {
return environment.getPropertyCollection(QUICKCONNECT_ALLOWED_PARAMETERS);
}
/**
@@ -90,8 +91,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public List<String> getDeniedParameters() throws GuacamoleException {
return environment.getProperty(QUICKCONNECT_DENIED_PARAMETERS);
public Collection<String> getDeniedParameters() throws GuacamoleException {
return environment.getPropertyCollection(QUICKCONNECT_DENIED_PARAMETERS);
}
}

7
extensions/guacamole-auth-quickconnect/src/main/java/org/apache/guacamole/auth/quickconnect/utility/QCParser.java
View File

@@ -25,6 +25,7 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.net.URLDecoder;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.regex.Matcher;
@@ -60,13 +61,13 @@ public class QCParser {
* by this parser. If not defined, all parameters will be allowed unless
* explicitly denied.
*/
private final List<String> allowedParams;
private final Collection<String> allowedParams;
/**
* The list of parameters that are explicitly denied from being placed into
* a configuration by this parser.
*/
private final List<String> deniedParams;
private final Collection<String> deniedParams;
/**
* Create a new instance of the QCParser class, with the provided allowed
@@ -81,7 +82,7 @@ public class QCParser {
* A list of parameters, if any, that should be explicitly denied from
* being placed into a connection configuration.
*/
public QCParser(List<String> allowedParams, List<String> deniedParams) {
public QCParser(Collection<String> allowedParams, Collection<String> deniedParams) {
this.allowedParams = allowedParams;
this.deniedParams = deniedParams;
}

2
extensions/guacamole-auth-quickconnect/src/main/resources/guac-manifest.json
View File

@@ -1,5 +1,5 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Adhoc Guacamole Connections",
"namespace" : "quickconnect",

6
extensions/guacamole-auth-radius/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-radius</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-radius</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -115,7 +115,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

2
extensions/guacamole-auth-radius/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "RADIUS Authentication Backend",
"namespace" : "radius",

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-cas</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-cas</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "CAS Authentication Extension",
"namespace" : "cas",

10
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
View File

@@ -32,7 +32,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -42,28 +42,28 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-cas</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- OpenID Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-openid</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- SAML Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-saml</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- SSL Authentication Extension -->
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-ssl</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-openid</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-openid</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

10
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java
View File

@@ -21,13 +21,13 @@ package org.apache.guacamole.auth.openid.conf;
import com.google.inject.Inject;
import java.net.URI;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
/**
@@ -138,8 +138,8 @@ public class ConfigurationService {
* The claims within any valid JWT that should be mapped to
* the authenticated user's tokens, as configured with guacamole.properties.
*/
private static final StringListProperty OPENID_ATTRIBUTES_CLAIM_TYPE =
new StringListProperty() {
private static final StringGuacamoleProperty OPENID_ATTRIBUTES_CLAIM_TYPE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-attributes-claim-type"; }
};
@@ -356,8 +356,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public List<String> getAttributesClaimType() throws GuacamoleException {
return environment.getProperty(OPENID_ATTRIBUTES_CLAIM_TYPE, DEFAULT_ATTRIBUTES_CLAIM_TYPE);
public Collection<String> getAttributesClaimType() throws GuacamoleException {
return environment.getPropertyCollection(OPENID_ATTRIBUTES_CLAIM_TYPE, DEFAULT_ATTRIBUTES_CLAIM_TYPE);
}
/**

3
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
View File

@@ -20,6 +20,7 @@
package org.apache.guacamole.auth.openid.token;
import com.google.inject.Inject;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
@@ -229,7 +230,7 @@ public class TokenValidationService {
* If guacamole.properties could not be parsed.
*/
public Map<String, String> processAttributes(JwtClaims claims) throws GuacamoleException {
List<String> attributesClaim = confService.getAttributesClaimType();
Collection<String> attributesClaim = confService.getAttributesClaimType();
if (claims != null && !attributesClaim.isEmpty()) {
try {

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "OpenID Authentication Extension",
"namespace" : "openid",

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-saml</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-saml</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "SAML Authentication Extension",
"namespace" : "saml",

4
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-ssl</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso-ssl</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

3
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
View File

@@ -26,6 +26,7 @@ import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.util.Collection;
import java.util.Date;
import java.util.List;
import java.util.concurrent.TimeUnit;
@@ -214,7 +215,7 @@ public class SSLClientAuthenticationResource extends SSOResource {
// Verify that the username is specified with one of the allowed
// attributes
List<String> usernameAttributes = confService.getSubjectUsernameAttributes();
Collection<String> usernameAttributes = confService.getSubjectUsernameAttributes();
if (usernameAttributes != null && !usernameAttributes.stream().anyMatch(nameRdn.getType()::equalsIgnoreCase))
throw new GuacamoleClientException("Subject DN \"" + dn + "\" "
+ "does not contain an acceptable username attribute.");

11
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
View File

@@ -22,7 +22,7 @@ package org.apache.guacamole.auth.ssl.conf;
import com.google.inject.Inject;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.List;
import java.util.Collection;
import javax.naming.ldap.LdapName;
import javax.ws.rs.core.UriBuilder;
import org.apache.guacamole.GuacamoleException;
@@ -30,7 +30,6 @@ import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.StringListProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
/**
@@ -146,8 +145,8 @@ public class ConfigurationService {
* one of these attributes, the certificate will be rejected. By default,
* any attribute is accepted.
*/
private static final StringListProperty SSL_SUBJECT_USERNAME_ATTRIBUTE =
new StringListProperty () {
private static final StringGuacamoleProperty SSL_SUBJECT_USERNAME_ATTRIBUTE =
new StringGuacamoleProperty () {
@Override
public String getName() { return "ssl-subject-username-attribute"; }
@@ -433,8 +432,8 @@ public class ConfigurationService {
* @throws GuacamoleException
* If the configured set of username attributes cannot be read.
*/
public List<String> getSubjectUsernameAttributes() throws GuacamoleException {
return environment.getProperty(SSL_SUBJECT_USERNAME_ATTRIBUTE);
public Collection<String> getSubjectUsernameAttributes() throws GuacamoleException {
return environment.getPropertyCollection(SSL_SUBJECT_USERNAME_ATTRIBUTE);
}
}

2
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "SSL Authentication Extension",
"namespace" : "ssl",

8
extensions/guacamole-auth-sso/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-sso</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -60,7 +60,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -68,7 +68,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-sso-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<!-- Java servlet API -->

14
extensions/guacamole-auth-totp/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-auth-totp</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-auth-totp</name>
<url>http://guacamole.incubator.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -127,7 +127,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>
@@ -178,6 +178,14 @@
<scope>provided</scope>
</dependency>
<!-- Library for unified IPv4/6 parsing and validation -->
<dependency>
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.5.0</version>
<scope>provided</scope>
</dependency>
</dependencies>
</project>

68
extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/conf/ConfigurationService.java
View File

@@ -20,10 +20,14 @@
package org.apache.guacamole.auth.totp.conf;
import com.google.inject.Inject;
import inet.ipaddr.IPAddress;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.EnumGuacamoleProperty;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.totp.TOTPGenerator;
@@ -89,6 +93,36 @@ public class ConfigurationService {
};
/**
* A property that contains a list of IP addresses and/or subnets for which
* MFA via the TOTP module should be bypassed. Users logging in from addresses
* contained in this list will not be prompted for a second authentication
* factor. If this property is empty or not defined, and the TOTP module
* is installed, all users will be prompted for MFA.
*/
private static final IPAddressListProperty TOTP_BYPASS_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "totp-bypass-hosts"; }
};
/**
* A property that contains a list of IP addresses and/or subnets for which
* MFA via the TOTP module should explicitly be enabled. If this property is defined,
* and the TOTP module is installed, users logging in from hosts contained
* in this list will be prompted for MFA, and users logging in from all
* other hosts will not be prompted for MFA.
*/
private static final IPAddressListProperty TOTP_ENFORCE_HOSTS =
new IPAddressListProperty() {
@Override
public String getName() { return "totp-enforce-hosts"; }
};
/**
* Returns the human-readable name of the entity issuing user accounts. If
* not specified, "Apache Guacamole" will be used by default.
@@ -159,4 +193,38 @@ public class ConfigurationService {
return environment.getProperty(TOTP_MODE, TOTPGenerator.Mode.SHA1);
}
/**
* Return the list of IP addresses and/or subnets for which MFA authentication via the
* TOTP module should be bypassed, allowing users from those addresses to log in
* without the MFA requirement.
*
* @return
* A list of IP addresses and/or subnets for which MFA authentication
* should be bypassed.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getBypassHosts() throws GuacamoleException {
return environment.getProperty(TOTP_BYPASS_HOSTS, Collections.emptyList());
}
/**
* Return the list of IP addresses and/or subnets for which MFA authentication via the TOTP
* module should be explicitly enabled, requiring users logging in from hosts specified in
* the list to complete MFA.
*
* @return
* A list of IP addresses and/or subnets for which MFA authentication
* should be explicitly enabled.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or an invalid IP address
* or subnet is specified.
*/
public List<IPAddress> getEnforceHosts() throws GuacamoleException {
return environment.getProperty(TOTP_ENFORCE_HOSTS, Collections.emptyList());
}
}

47
extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
View File

@@ -22,9 +22,12 @@ package org.apache.guacamole.auth.totp.user;
import com.google.common.io.BaseEncoding;
import com.google.inject.Inject;
import com.google.inject.Provider;
import inet.ipaddr.IPAddress;
import inet.ipaddr.IPAddressString;
import java.security.InvalidKeyException;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
import javax.servlet.http.HttpServletRequest;
@@ -44,6 +47,7 @@ import org.apache.guacamole.net.auth.User;
import org.apache.guacamole.net.auth.UserContext;
import org.apache.guacamole.net.auth.UserGroup;
import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
import org.apache.guacamole.properties.IPAddressListProperty;
import org.apache.guacamole.totp.TOTPGenerator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -311,6 +315,45 @@ public class UserVerificationService {
public void verifyIdentity(UserContext context,
AuthenticatedUser authenticatedUser) throws GuacamoleException {
// Pull the original HTTP request used to authenticate
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
// Get the current client address
IPAddress clientAddr = new IPAddressString(request.getRemoteAddr()).getAddress();
// Ignore anonymous users
if (authenticatedUser.getIdentifier().equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
return;
// Pull address lists to check from configuration. Note that the enforce
// list will override the bypass list, which means that, if the client
// address happens to be in both lists, Duo MFA will be enforced.
List<IPAddress> bypassAddresses = confService.getBypassHosts();
List<IPAddress> enforceAddresses = confService.getEnforceHosts();
// Check the bypass list for the client address, and set the enforce
// flag to the opposite.
boolean enforceHost = !(IPAddressListProperty.addressListContains(bypassAddresses, clientAddr));
// Only continue processing if the list is not empty
if (!enforceAddresses.isEmpty()) {
// If client address is not available or invalid, MFA will
// be enforced.
if (clientAddr == null || !clientAddr.isIPAddress())
enforceHost = true;
// Check the enforce list and set the flag if the client address
// is found in the list.
else
enforceHost = IPAddressListProperty.addressListContains(enforceAddresses, clientAddr);
}
// If the enforce flag is not true, bypass TOTP MFA.
if (!enforceHost)
return;
// Ignore anonymous users
String username = authenticatedUser.getIdentifier();
if (username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
@@ -325,10 +368,6 @@ public class UserVerificationService {
if (key == null)
return;
// Pull the original HTTP request used to authenticate
Credentials credentials = authenticatedUser.getCredentials();
HttpServletRequest request = credentials.getRequest();
// Retrieve TOTP from request
String code = request.getParameter(AuthenticationCodeField.PARAMETER_NAME);

2
extensions/guacamole-auth-totp/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "TOTP TFA Authentication Backend",
"namespace" : "totp",

4
extensions/guacamole-display-statistics/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-display-statistics</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-display-statistics</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>

2
extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Display Statistic Toolbar",
"namespace" : "display-stats",

6
extensions/guacamole-history-recording-storage/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-history-recording-storage</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-history-recording-storage</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -43,7 +43,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

2
extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Session Recording Storage",
"namespace" : "recording-storage",

2
extensions/guacamole-vault/modules/guacamole-vault-base/pom.xml
View File

@@ -36,7 +36,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>

4
extensions/guacamole-vault/modules/guacamole-vault-dist/pom.xml
View File

@@ -36,7 +36,7 @@
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -46,7 +46,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault-ksm</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
</dependencies>

6
extensions/guacamole-vault/modules/guacamole-vault-ksm/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault-ksm</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-vault-ksm</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../../</relativePath>
</parent>
@@ -54,7 +54,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault-base</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
</dependency>
<dependency>

2
extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/guac-manifest.json
View File

@@ -1,6 +1,6 @@
{
"guacamoleVersion" : "1.5.5",
"guacamoleVersion" : "1.6.0",
"name" : "Keeper Secrets Manager",
"namespace" : "keeper-secrets-manager",

6
extensions/guacamole-vault/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-vault</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-vault</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -57,7 +57,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>provided</scope>
</dependency>

4
extensions/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>extensions</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>extensions</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-client</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>

4
guacamole-common-js/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-common-js</artifactId>
<packaging>pom</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-common-js</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-client</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>

2
guacamole-common-js/src/main/webapp/modules/Version.js
View File

@@ -27,4 +27,4 @@ var Guacamole = Guacamole || {};
*
* @type {!string}
*/
Guacamole.API_VERSION = "1.5.4";
Guacamole.API_VERSION = "1.6.0";

4
guacamole-common/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-common</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-common</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-client</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>

13
guacamole-ext/pom.xml
View File

@@ -26,14 +26,14 @@
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-ext</artifactId>
<packaging>jar</packaging>
<version>1.5.5</version>
<version>1.6.0</version>
<name>guacamole-ext</name>
<url>http://guacamole.apache.org/</url>
<parent>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-client</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<relativePath>../</relativePath>
</parent>
@@ -87,7 +87,7 @@
<dependency>
<groupId>org.apache.guacamole</groupId>
<artifactId>guacamole-common</artifactId>
<version>1.5.5</version>
<version>1.6.0</version>
<scope>compile</scope>
</dependency>
@@ -110,6 +110,13 @@
<artifactId>jackson-databind</artifactId>
</dependency>
<!-- Library for unified IPv4/6 parsing and validation -->
<dependency>
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.5.0</version>
</dependency>
</dependencies>
</project>

25
guacamole-ext/src/main/java/org/apache/guacamole/environment/DelegatingEnvironment.java
View File

@@ -20,6 +20,7 @@
package org.apache.guacamole.environment;
import java.io.File;
import java.util.Collection;
import java.util.Map;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration;
@@ -74,11 +75,35 @@ public class DelegatingEnvironment implements Environment {
return environment.getProperty(property, defaultValue);
}
@Override
public <Type> Collection<Type> getPropertyCollection(GuacamoleProperty<Type> property)
throws GuacamoleException {
return environment.getPropertyCollection(property);
}
@Override
public <Type> Collection<Type> getPropertyCollection(GuacamoleProperty<Type> property,
Type defaultValue) throws GuacamoleException {
return environment.getPropertyCollection(property, defaultValue);
}
@Override
public <Type> Collection<Type> getPropertyCollection(GuacamoleProperty<Type> property,
Collection<Type> defaultValue) throws GuacamoleException {
return environment.getPropertyCollection(property, defaultValue);
}
@Override
public <Type> Type getRequiredProperty(GuacamoleProperty<Type> property) throws GuacamoleException {
return environment.getRequiredProperty(property);
}
@Override
public <Type> Collection<Type> getRequiredPropertyCollection(GuacamoleProperty<Type> property)
throws GuacamoleException {
return environment.getRequiredPropertyCollection(property);
}
@Override
public GuacamoleProxyConfiguration getDefaultGuacamoleProxyConfiguration() throws GuacamoleException {
return environment.getDefaultGuacamoleProxyConfiguration();

215
guacamole-ext/src/main/java/org/apache/guacamole/environment/Environment.java
View File

@@ -21,6 +21,8 @@ package org.apache.guacamole.environment;
import org.apache.guacamole.properties.GuacamoleProperties;
import java.io.File;
import java.util.Collection;
import java.util.Collections;
import java.util.Map;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleUnsupportedException;
@@ -102,12 +104,17 @@ public interface Environment {
* Given a GuacamoleProperty, parses and returns the value set for that
* property in guacamole.properties, if any.
*
* @param <Type> The type that the given property is parsed into.
* @param property The property to read from guacamole.properties.
* @return The parsed value of the property as read from
* guacamole.properties.
* @throws GuacamoleException If an error occurs while parsing the value
* for the given property in
* @param <Type>
* The type that the given property is parsed into.
*
* @param property
* The property to read from guacamole.properties.
*
* @return
* The parsed value of the property as read from guacamole.properties.
*
* @throws GuacamoleException
* If an error occurs while parsing the value for the given property in
* guacamole.properties.
*/
public <Type> Type getProperty(GuacamoleProperty<Type> property)
@@ -118,20 +125,161 @@ public interface Environment {
* property in guacamole.properties, if any. If no value is found, the
* provided default value is returned.
*
* @param <Type> The type that the given property is parsed into.
* @param property The property to read from guacamole.properties.
* @param defaultValue The value to return if no value was given in
* guacamole.properties.
* @return The parsed value of the property as read from
* guacamole.properties, or the provided default value if no value
* was found.
* @throws GuacamoleException If an error occurs while parsing the value
* for the given property in
* @param <Type>
* The type that the given property is parsed into.
*
* @param property
* The property to read from guacamole.properties.
*
* @param defaultValue
* The value to return if no value was given in guacamole.properties.
*
* @return
* The parsed value of the property as read from guacamole.properties,
* or the provided default value if no value was found.
*
* @throws GuacamoleException
* If an error occurs while parsing the value for the given property in
* guacamole.properties.
*/
public <Type> Type getProperty(GuacamoleProperty<Type> property,
Type defaultValue) throws GuacamoleException;
/**
* Given a GuacamoleProperty, parses and returns a sorted Collection of the
* value set for that property in guacamole.properties, if any. The
* implementation of parsing and returning a collection of multiple
* values is up to the individual property implementations, and not all
* implementations will support reading and returning multiple values.
*
* @param <Type>
* The type that the given property is parsed into.
*
* @param property
* The property to read from guacamole.properties.
*
* @return
* A sorted collection of the the parsed values of the property as read
* from guacamole.properties.
*
* @throws GuacamoleException
* If an error occurs while parsing the value for the given property in
* guacamole.properties.
*/
public default <Type> Collection<Type> getPropertyCollection(
GuacamoleProperty<Type> property) throws GuacamoleException {
/* Pull the given property as a string. */
StringGuacamoleProperty stringProperty = new StringGuacamoleProperty() {
@Override
public String getName() { return property.getName(); }
};
/* Parse the string to a Collection of the desired type. */
return property.parseValueCollection(getProperty(stringProperty));
}
/**
* Given a GuacamoleProperty, parses and returns the value set for that
* property in guacamole.properties, if any. If no value is found, a
* Collection is returned with the provided default value. The
* implementation of parsing and returning a collection of multiple
* values is up to the individual property implementations, and not all
* implementations will support reading and returning multiple values.
*
* @param <Type>
* The type that the given property is parsed into.
*
* @param property
* The property to read from guacamole.properties.
*
* @param defaultValue
* The single value to return in the Collection if no value was given
* in guacamole.properties.
*
* @return
* A sorted collection of the the parsed values of the property as read
* from guacamole.properties, or a Collection with the single default
* value provided.
*
* @throws GuacamoleException
* If an error occurs while parsing the value for the given property in
* guacamole.properties.
*/
public default <Type> Collection<Type> getPropertyCollection(
GuacamoleProperty<Type> property, Type defaultValue)
throws GuacamoleException {
/* Pull the given property as a string. */
StringGuacamoleProperty stringProperty = new StringGuacamoleProperty() {
@Override
public String getName() { return property.getName(); }
};
/* Check the value and return the default if null. */
String stringValue = getProperty(stringProperty);
if (stringValue == null)
return Collections.singletonList(defaultValue);
/* Parse the string and return the collection. */
return property.parseValueCollection(stringValue);
}
/**
* Given a GuacamoleProperty, parses and returns the value set for that
* property in guacamole.properties, if any. If no value is found, the
* provided Collection of default values is returned. The
* implementation of parsing and returning a collection of multiple
* values is up to the individual property implementations, and not all
* implementations will support reading and returning multiple values.
*
* @param <Type>
* The type that the given property is parsed into.
*
* @param property
* The property to read from guacamole.properties.
*
* @param defaultValue
* The Collection of values to return in the Collection if no value was
* given in guacamole.properties.
*
* @return
* A sorted collection of the the parsed values of the property as read
* from guacamole.properties, or a Collection with the single default
* value provided.
*
* @throws GuacamoleException
* If an error occurs while parsing the value for the given property in
* guacamole.properties.
*/
public default <Type> Collection<Type> getPropertyCollection(
GuacamoleProperty<Type> property, Collection<Type> defaultValue)
throws GuacamoleException {
/* Pull the given property as a string. */
StringGuacamoleProperty stringProperty = new StringGuacamoleProperty() {
@Override
public String getName() { return property.getName(); }
};
/* Check the value and return the default if null. */
String stringValue = getProperty(stringProperty);
if (stringValue == null)
return defaultValue;
/* Parse the string and return the collection. */
return property.parseValueCollection(stringValue);
}
/**
* Given a GuacamoleProperty, parses and returns the value set for that
* property in guacamole.properties. An exception is thrown if the value
@@ -149,6 +297,43 @@ public interface Environment {
public <Type> Type getRequiredProperty(GuacamoleProperty<Type> property)
throws GuacamoleException;
/**
* Given a GuacamoleProperty, parses and returns a sorted Collection of
* values for that property in guacamole.properties. An exception is thrown
* if the value is not provided. The implementation of parsing and returning
* a collection of multiple values is up to the individual property
* implementations, and not all implementations will support reading and
* returning multiple values.
*
* @param <Type>
* The type that the given property is parsed into.
*
* @param property
* The property to read from guacamole.properties.
*
* @return
* A sorted Collection of the property as read from guacamole.properties.
*
* @throws GuacamoleException
* If an error occurs while parsing the value for the given property in
* guacamole.properties, or if the property is not specified.
*/
public default <Type> Collection<Type> getRequiredPropertyCollection(
GuacamoleProperty<Type> property) throws GuacamoleException {
/* Pull the given property as a string. */
StringGuacamoleProperty stringProperty = new StringGuacamoleProperty() {
@Override
public String getName() { return property.getName(); }
};
/* Parse the string to a Collection of the desired type. */
return property.parseValueCollection(getRequiredProperty(stringProperty));
}
/**
* Returns the connection information which should be used, by default, to
* connect to guacd when establishing a remote desktop connection.

46
guacamole-ext/src/main/java/org/apache/guacamole/environment/LocalEnvironment.java
View File

@@ -25,6 +25,8 @@ import java.io.FileInputStream;
import java.io.FilenameFilter;
import java.io.IOException;
import java.io.InputStream;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@@ -354,6 +356,38 @@ public class LocalEnvironment implements Environment {
}
@Override
public <Type> Collection<Type> getPropertyCollection(GuacamoleProperty<Type> property)
throws GuacamoleException {
return property.parseValueCollection(getPropertyValue(property.getName()));
}
@Override
public <Type> Collection<Type> getPropertyCollection(GuacamoleProperty<Type> property,
Type defaultValue) throws GuacamoleException {
Collection<Type> value = getPropertyCollection(property);
if (value == null)
return Collections.singletonList(defaultValue);
return value;
}
@Override
public <Type> Collection<Type> getPropertyCollection(GuacamoleProperty<Type> property,
Collection<Type> defaultValue) throws GuacamoleException {
Collection<Type> value = getPropertyCollection(property);
if (value == null)
return defaultValue;
return value;
}
@Override
public <Type> Type getRequiredProperty(GuacamoleProperty<Type> property)
throws GuacamoleException {
@@ -366,6 +400,18 @@ public class LocalEnvironment implements Environment {
}
@Override
public <Type> Collection<Type> getRequiredPropertyCollection(GuacamoleProperty<Type> property)
throws GuacamoleException {
Collection<Type> value = getPropertyCollection(property);
if (value == null)
throw new GuacamoleServerException("Property " + property.getName() + " is required.");
return value;
}
@Override
public Map<String, ProtocolInfo> getProtocols() {
return availableProtocols;

8
guacamole-ext/src/main/java/org/apache/guacamole/net/auth/permission/SystemPermission.java
View File

@@ -57,6 +57,14 @@ public class SystemPermission implements Permission<SystemPermission.Type> {
*/
CREATE_SHARING_PROFILE,
/**
* Audit the system in general, which involves the ability to view
* active and historical connection records, user logon records, etc.,
* but lacks permission to change any of these details (interact with
* active connections, update user accounts, etc).
*/
AUDIT,
/**
* Administer the system in general, including adding permissions
* which affect the system (like user creation, connection creation,

45
guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleConnection.java
View File

@@ -24,7 +24,6 @@ import java.util.Date;
import java.util.Map;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.environment.LocalEnvironment;
import org.apache.guacamole.net.GuacamoleSocket;
import org.apache.guacamole.net.GuacamoleTunnel;
@@ -54,6 +53,11 @@ public class SimpleConnection extends AbstractConnection {
*/
private GuacamoleConfiguration fullConfig;
/**
* The proxy configuration describing how to connect to guacd.
*/
private GuacamoleProxyConfiguration proxyConfig;
/**
* Whether parameter tokens in the underlying GuacamoleConfiguration should
* be automatically applied upon connecting. If false, parameter tokens
@@ -159,6 +163,39 @@ public class SimpleConnection extends AbstractConnection {
}
/**
* Creates a new SimpleConnection having the given identifier,
* GuacamoleConfiguration, and GuacamoleProxyConfiguration. Parameter tokens
* will be interpreted if explicitly requested.
*
* @param name
* The name to associate with this connection.
*
* @param identifier
* The identifier to associate with this connection.
*
* @param proxyConfig
* The Guacamole proxy configuration describing how the connection to
* guacd should be established, or null if the default settings will be
* used.
*
* @param config
* The configuration describing how to connect to this connection.
*
* @param interpretTokens
* Whether parameter tokens in the underlying GuacamoleConfiguration
* should be automatically applied upon connecting. If false, parameter
* tokens will not be interpreted at all.
*/
public SimpleConnection(String name, String identifier,
GuacamoleProxyConfiguration proxyConfig,
GuacamoleConfiguration config, boolean interpretTokens) {
this(name, identifier, config, interpretTokens);
this.proxyConfig = proxyConfig;
}
/**
* Returns the GuacamoleConfiguration describing how to connect to this
* connection. Unlike {@link #getConfiguration()}, which is allowed to omit
@@ -201,9 +238,9 @@ public class SimpleConnection extends AbstractConnection {
public GuacamoleTunnel connect(GuacamoleClientInformation info)
throws GuacamoleException {
// Retrieve proxy configuration from environment
Environment environment = LocalEnvironment.getInstance();
GuacamoleProxyConfiguration proxyConfig = environment.getDefaultGuacamoleProxyConfiguration();
// Retrieve proxy configuration from environment if we don't have one
if (proxyConfig == null)
proxyConfig = LocalEnvironment.getInstance().getDefaultGuacamoleProxyConfiguration();
// Get guacd connection parameters
String hostname = proxyConfig.getHostname();

25
guacamole-ext/src/main/java/org/apache/guacamole/properties/FileGuacamoleProperty.java
View File

@@ -20,6 +20,9 @@
package org.apache.guacamole.properties;
import java.io.File;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
/**
@@ -38,4 +41,26 @@ public abstract class FileGuacamoleProperty implements GuacamoleProperty<File> {
}
@Override
public List<File> parseValueCollection(String value) throws GuacamoleException {
// If no property is provided, return null.
if (value == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(value));
if (stringValues.isEmpty())
return null;
// Translate values to Files and add to result array.
List<File> fileValues = new ArrayList<>();
for (String stringFile : stringValues) {
fileValues.add(new File(stringFile));
}
return fileValues;
}
}

48
guacamole-ext/src/main/java/org/apache/guacamole/properties/GuacamoleProperty.java
View File

@@ -19,6 +19,9 @@
package org.apache.guacamole.properties;
import java.util.Collection;
import java.util.Collections;
import java.util.regex.Pattern;
import org.apache.guacamole.GuacamoleException;
/**
@@ -30,11 +33,20 @@ import org.apache.guacamole.GuacamoleException;
*/
public interface GuacamoleProperty<Type> {
/**
* A pattern which matches against the delimiters between values. This is
* currently simply a semicolon and any following whitespace. Parts of the
* input string which match this pattern will not be included in the parsed
* result.
*/
static final Pattern DELIMITER_PATTERN = Pattern.compile(";\\s*");
/**
* Returns the name of the property in guacamole.properties that this
* GuacamoleProperty will parse.
*
* @return The name of the property in guacamole.properties that this
* @return
* The name of the property in guacamole.properties that this
* GuacamoleProperty will parse.
*/
public String getName();
@@ -43,11 +55,37 @@ public interface GuacamoleProperty<Type> {
* Parses the given string value into the type associated with this
* GuacamoleProperty.
*
* @param value The string value to parse.
* @return The parsed value.
* @throws GuacamoleException If an error occurs while parsing the
* provided value.
* @param value
* The string value to parse.
*
* @return
* The parsed value.
*
* @throws GuacamoleException
* If an error occurs while parsing the provided value.
*/
public Type parseValue(String value) throws GuacamoleException;
/**
* Parses the given string value into a Collection of values of the type
* associated with this GuacamoleProperty. The default implementation
* simply returns a list containing a single item as parsed by the
* parseValue method.
*
* @param value
* The string value to parse.
*
* @return
* A sorted Collection of the parsed values.
*
* @throws GuacamoleException
* If an error occurs while parsing the provided value.
*/
default public Collection<Type> parseValueCollection(String value)
throws GuacamoleException {
return Collections.singletonList(parseValue(value));
}
}

113
guacamole-ext/src/main/java/org/apache/guacamole/properties/IPAddressListProperty.java Normal file
View File

@@ -0,0 +1,113 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.properties;
import inet.ipaddr.IPAddress;
import inet.ipaddr.IPAddressString;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.regex.Pattern;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
/**
* A GuacamoleProperty implementation that parses a String for a comma-separated
* list of IP addresses and/or IP subnets, both IPv4 and IPv6, and returns the
* list of those valid IP addresses/subnets.
*/
public abstract class IPAddressListProperty implements GuacamoleProperty<List<IPAddress>> {
/**
* A pattern which matches against the delimiters between values. This is
* currently simply a comma and any following whitespace. Parts of the
* input string which match this pattern will not be included in the parsed
* result.
*/
private static final Pattern DELIMITER_PATTERN = Pattern.compile(",\\s*");
@Override
public List<IPAddress> parseValue(String values) throws GuacamoleException {
// Null for null
if (values == null)
return null;
// Not null, just empty
if (values.isEmpty())
return Collections.emptyList();
// Split the string into an array
List<String> addrStrings = Arrays.asList(DELIMITER_PATTERN.split(values));
List<IPAddress> ipAddresses = new ArrayList<>();
// Loop through each string
for (String addrString : addrStrings) {
// Convert the string to an IPAddressString for validation
IPAddressString ipString = new IPAddressString(addrString);
// If this isn't a valid address, subnet, etc., throw an exception
if (!ipString.isIPAddress())
throw new GuacamoleServerException("Invalid IP address specified: " + addrString);
// Add the address to the list.
ipAddresses.add(ipString.getAddress());
}
// Return our list of valid IP addresses and/or subnets
return ipAddresses;
}
/**
* Return true if the provided address list contains the client address,
* or false if no match is found.
*
* @param addrList
* The address list to check for matches.
*
* @param ipAddr
* The client address to look for in the list.
*
* @return
* True if the client address is in the provided list, otherwise
* false.
*/
public static boolean addressListContains(List<IPAddress> addrList, IPAddress ipAddr) {
// If either is null, return false
if (ipAddr == null || addrList == null)
return false;
for (IPAddress ipEntry : addrList)
// If version matches and entry contains it, return true
if (ipEntry.getIPVersion().equals(ipAddr.getIPVersion())
&& ipEntry.contains(ipAddr))
return true;
// No match, so return false
return false;
}
}

24
guacamole-ext/src/main/java/org/apache/guacamole/properties/IntegerGuacamoleProperty.java
View File

@@ -19,6 +19,9 @@
package org.apache.guacamole.properties;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
@@ -43,4 +46,25 @@ public abstract class IntegerGuacamoleProperty implements GuacamoleProperty<Inte
}
@Override
public List<Integer> parseValueCollection(String value) throws GuacamoleException {
if (value == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(value));
if (stringValues.isEmpty())
return null;
// Translate values to Integers, validating along the way.
List<Integer> intValues = new ArrayList<>();
for (String stringInt : stringValues) {
intValues.add(parseValue(stringInt));
}
return intValues;
}
}

24
guacamole-ext/src/main/java/org/apache/guacamole/properties/LongGuacamoleProperty.java
View File

@@ -19,6 +19,9 @@
package org.apache.guacamole.properties;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
@@ -43,4 +46,25 @@ public abstract class LongGuacamoleProperty implements GuacamoleProperty<Long> {
}
@Override
public List<Long> parseValueCollection(String value) throws GuacamoleException {
if (value == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(value));
if (stringValues.isEmpty())
return null;
// Translate values to Longs, validating along the way.
List<Long> longValues = new ArrayList<>();
for (String stringLong : stringValues) {
longValues.add(parseValue(stringLong));
}
return longValues;
}
}

17
guacamole-ext/src/main/java/org/apache/guacamole/properties/StringGuacamoleProperty.java
View File

@@ -19,6 +19,8 @@
package org.apache.guacamole.properties;
import java.util.Arrays;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
/**
@@ -31,4 +33,19 @@ public abstract class StringGuacamoleProperty implements GuacamoleProperty<Strin
return value;
}
@Override
public List<String> parseValueCollection(String value) throws GuacamoleException {
if (value == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(value));
if (stringValues.isEmpty())
return null;
return stringValues;
}
}

13
guacamole-ext/src/main/java/org/apache/guacamole/properties/StringListProperty.java
View File

@@ -31,17 +31,14 @@ import org.apache.guacamole.GuacamoleException;
* compatibility with the behavior of Java properties in general, only
* whitespace at the beginning of each value is ignored; trailing whitespace
* becomes part of the value.
*
* @deprecated
* This class is now deprecated in favor of using the StringGuacamoleProperty
* class with the parseValueCollection method.
*/
@Deprecated
public abstract class StringListProperty implements GuacamoleProperty<List<String>> {
/**
* A pattern which matches against the delimiters between values. This is
* currently simply a comma and any following whitespace. Parts of the
* input string which match this pattern will not be included in the parsed
* result.
*/
private static final Pattern DELIMITER_PATTERN = Pattern.compile(",\\s*");
@Override
public List<String> parseValue(String values) throws GuacamoleException {

24
guacamole-ext/src/main/java/org/apache/guacamole/properties/TimeZoneGuacamoleProperty.java
View File

@@ -19,6 +19,9 @@
package org.apache.guacamole.properties;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.TimeZone;
import java.util.regex.Pattern;
import org.apache.guacamole.GuacamoleException;
@@ -57,4 +60,25 @@ public abstract class TimeZoneGuacamoleProperty
}
@Override
public List<TimeZone> parseValueCollection(String value) throws GuacamoleException {
if (value == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(value));
if (stringValues.isEmpty())
return null;
// Translate values to Integers, validating along the way.
List<TimeZone> tzValues = new ArrayList<>();
for (String stringTz : stringValues) {
tzValues.add(parseValue(stringTz));
}
return tzValues;
}
}

25
guacamole-ext/src/main/java/org/apache/guacamole/properties/URIGuacamoleProperty.java
View File

@@ -21,6 +21,9 @@ package org.apache.guacamole.properties;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
@@ -46,4 +49,26 @@ public abstract class URIGuacamoleProperty implements GuacamoleProperty<URI> {
}
@Override
public List<URI> parseValueCollection(String value) throws GuacamoleException {
// Nothing provided, return nothing.
if (value == null)
return null;
// Split string into a list of individual values
List<String> stringValues = Arrays.asList(DELIMITER_PATTERN.split(value));
if (stringValues.isEmpty())
return null;
// Translate values to URIs, validating along the way.
List<URI> uriValues = new ArrayList<>();
for (String stringUri : stringValues) {
uriValues.add(parseValue(stringUri));
}
return uriValues;
}
}

Some files were not shown because too many files have changed in this diff Show More