This documentation assumes that you have already configured Guacamole to use LDAP for authentication. If have not already done so, please  configure Guacamole for LDAP authentication before proceeding.

Defining the guacConfigGroup object class

When connection data is stored within your LDAP directory, each connection is represented by a special type of LDAP group, and permissions related to Guacamole connections can be managed directly with LDAP based on user membership of these groups. Doing this requires schema modifications which add a new object class called guacConfigGroup.

An LDIF file defining the schema changes in a manner compatible with OpenLDAP is provided by the glyptodon-guacamole-auth-ldap package within /usr/share/guacamole-auth-ldap/schema/guacConfigGroup.ldif. This file can be applied to your OpenLDAP server using the “ldapadd” command:

$ sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /usr/share/guacamole-auth-ldap/schema/guacConfigGroup.ldif

Once this is done, connections can be defined by creating new guacConfigGroup objects within the LDAP directory. Each guacConfigGroup accepts a single guacConfigProtocol attribute, defining the protocol associated with the connection, and any number of guacConfigParameter attributes, each defining a connection parameter name/value pair. Users that should have access to the connection must be added as members of the guacConfigGroup using the member attribute.

For example, a connection accessible to two users which uses VNC to connect to localhost at port 5900 with the password “secret” could be defined with the following LDIF file:

dn: cn=Example Connection,ou=groups,dc=example,dc=net
objectClass: guacConfigGroup
objectClass: groupOfNames
cn: Example Connection
guacConfigProtocol: vnc
guacConfigParameter: hostname=localhost
guacConfigParameter: port=5900
guacConfigParameter: password=secret
member: cn=user1,ou=people,dc=example,dc=net
member: cn=user2,ou=people,dc=example,dc=net

Configuring Guacamole to read connections from LDAP

To read connection data from LDAP, Guacamole’s main configuration file, /etc/guacamole/guacamole.properties, must be modified to define the subtree containing these connections:

$ sudo vi /etc/guacamole/guacamole.properties

The base DN of all connections defined within LDAP must be specified using the ldap-config-base-dn property. This base DN should be the DN of the portion of the LDAP directory whose subtree contains all Guacamole connections accessible via LDAP. Only connections defined within the subtree of this base DN will be visible:

##
## [LDAP-4] LDAP base DN for Guacamole connections ("guacConfigGroup")
##
## The base DN for all Guacamole connections defined directly within the LDAP
## directory using "guacConfigGroup" objects. If connections will not be stored
## within the directory, this property is unnecessary.
##
## If the glyptodon-guacamole-auth-ldap package has been installed, the LDAP
## schema for "guacConfigGroup" objects can be found at:
##
##   /usr/share/guacamole-auth-ldap/schema/guacConfigGroup.ldif
##
## Alternatively, if your LDAP directory does not accept LDIF files, the schema
## source for "guacConfigGroup" can be found at:
##
##   /usr/share/guacamole-auth-ldap/schema/guacConfigGroup.schema
##

#ldap-config-base-dn: ou=connections,dc=example,dc=net

Controlling access using group membership

It is also possible grant entire groups access to connections using the seeAlso attribute. This attribute is a standard LDAP attribute, and will be taken into account by Guacamole if the ldap-group-base-dn property is defined. This property defines the root of the subtree containing all groups which may apply to Guacamole users authenticated using LDAP:

##
## [LDAP-5] LDAP base DN for referenced user groups ("seeAlso" attribute)
##
## The base DN for all groups which may be referenced within "guacConfigGroup"
## objects using the "seeAlso" attribute, when granting access to a connection
## for an entire group of users rather than on a user-by-user basis. If
## omitted, the "seeAlso" attribute will have no effect on connection
## availability.
##

#ldap-group-base-dn: ou=groups,dc=example,dc=net

Completing installation

Changes to Guacamole’s LDAP configuration will generally only be reread from guacamole.properties during the startup process. To apply the configuration changes, Guacamole (and thus Tomcat) must be restarted:

$ sudo systemctl restart tomcat