Out of interest, we have SAML and OpenID Connect. How do you manage passing the SSO to Windows after displaying the web portal. I couldn't see anything in the Guacomole pages, but Citrix manages this. Where you sign in to the web portal, click a desktop, and don't have to login. Do you get a kerberos ticket, do you have something running on the Windows host or how?
Re:Apache Guacamole
by NovemberWhiskey on Saturday December 04, 2021 @09:18PM
(#29446191)
The users don't log in with their own identities - we don't have developer accounts on production hosts. They log into service accounts: credentials are retrieved from a vault once the user has been authorized, after which the web application dynamically configures the RDP host/account/credential.
Re:Apache Guacamole
by denysvitali on Saturday December 04, 2021 @07:24PM
(#29445621)
From his comment it seems like they use a service account and thus hardcoded username + password on the Guacamole side rather than doing what Citrix does
Re:Apache Guacamole
by 2Gkashmiri on Sunday December 05, 2021 @03:29AM
(#29447722)
i have a question. i could "never" understand guacamole. i mean i currently use zerotier for clients/server and rdpwrap to get a bulletproof setup.
is there some sort of foss "server" implementation of rdp so as to avoid using rdpwrap? i know vnc but i need multiple users connected at the same time...
The only issue we've had is that FreeRDP (that underlies it for connectivity to Window servers) is a bit fussier than the native RDP environment, or at least we've had challenges getting equivalent compatibility across old/odd Windows configurations.