News for hackers. Stuff that matters.

A comment on Apache Guacamole. Parent comment

Re:Apache Guacamole by amaccuish on Saturday December 04, 2021 @07:19PM (#29445590)
Out of interest, we have SAML and OpenID Connect. How do you manage passing the SSO to Windows after displaying the web portal. I couldn't see anything in the Guacomole pages, but Citrix manages this. Where you sign in to the web portal, click a desktop, and don't have to login. Do you get a kerberos ticket, do you have something running on the Windows host or how?
[ Parent | on HN ]
Re:Apache Guacamole by NovemberWhiskey on Saturday December 04, 2021 @09:18PM (#29446191)
The users don't log in with their own identities - we don't have developer accounts on production hosts. They log into service accounts: credentials are retrieved from a vault once the user has been authorized, after which the web application dynamically configures the RDP host/account/credential.
[ Parent | on HN ]
Re:Apache Guacamole by denysvitali on Saturday December 04, 2021 @07:24PM (#29445621)
From his comment it seems like they use a service account and thus hardcoded username + password on the Guacamole side rather than doing what Citrix does
[ Parent | on HN ]