Allow wildcard (*) for user name?

[joharri9]

Andreas,

First and for most: Thank you for guacamole-auth-pam!

I made a slight mod to the code to allow anyone who can login to the machine can login to guacamole.

<user name="*">
<config-ref name="ECE -- slow network RDP" />
<config-ref name="ECE -- slow network SFTP" />
<config-ref name="ECE -- fast network" />
</user>

The code is in UserMapping.java:

  if (userNameToConfigNames.containsKey(userName)) {
       configNames.addAll(userNameToConfigNames.get(userName));
   }

   /* Code Added */
   if (userNameToConfigNames.containsKey("*")) {
       configNames.addAll(userNameToConfigNames.get("*"));
   }

This keeps me from having to maintain a list of users. I just make accounts on the machine and they can use guacamole.

Thoughts?

[voegelas]

You can put all users, that are allowed to log in with Guacamole, into a Unix group like "users" and refer to this group from the configuration file. There's an EXTRA_GROUPS parameter in /etc/adduser.conf on Debian-based systems. New users will automatically be added to the EXTRA_GROUPS. Adding users to a group is more secure than using a wildcard.

[joharri9]

Andreas, We have over 2700 accounts. Our auth is LDAP. Our auth admins rightfully won't allow modifications to the LDAP tree. The idea of creating a group just for this is not workable. What I'm asking for is not that unreasonable, it is a very minor change to the code that would make administration of guacamole much easier. I find the lack of this feature (user="*") throughout the guacamole design very short sighted. Thoughts? John

…

On Wed, Dec 11, 2019 at 5:41 AM Andreas Vögele ***@***.***> wrote: You can put all users, that are allowed to log in with Guacamole, into a Unix group like "users" and refer to this group from the configuration file. There's an EXTRA_GROUPS parameter in /etc/adduser.conf <https://manpages.debian.org/unstable/adduser/adduser.conf.5.en.html> on Debian-based systems. New users will automatically be added to the EXTRA_GROUPS. Adding users to a group is more secure than using a wildcard. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#6?email_source=notifications&email_token=ADVB67F2M6TZQQOOWIUWL2TQYC7XBA5CNFSM4IKECAG2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGSVKOY#issuecomment-564483387>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADVB67HRTQW2H6VCVBUPR2DQYC7XBANCNFSM4IKECAGQ> .

[voegelas]

We've got an Active Directory with thousands of users too. The Guacamole users are put into dedicated AD groups in order to restrict access to different hosts. I'll add wildcard support, but it will be up to the system administrator to configure PAM properly and to deny root access via Guacamole, for example. I am not going to add a minimum uid setting or other restrictions to the extension.

[joharri9]

Ok... Yes. Great! Seems reasonable. Hmmm.... You could add (user="!root") and some "&" and "|" and make it a full boolean algebra... Ok, ok, just kidding. Thanks much! John

…

On Wed, Dec 11, 2019 at 9:18 AM Andreas Vögele ***@***.***> wrote: We've got an Active Directory with thousands of users too. The Guacamole users are put into dedicated AD groups in order to restrict access to different hosts. I'll add wildcard support, but it will be up to the system administrator to configure PAM properly and to deny root access via Guacamole, for example. I am not going to add a minimum uid setting or other restrictions to the extension. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#6?email_source=notifications&email_token=ADVB67FU6XO6LUWSAP5A7IDQYDZCHA5CNFSM4IKECAG2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGTIXWY#issuecomment-564562907>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADVB67F3BNL7GMS4ILP7L5LQYDZCHANCNFSM4IKECAGQ> .