[GUACAMOLE-1333] Force second auth

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.3.0
• Component/s: guacamole-auth-jdbc-mysql, guacamole-auth-ldap, guacamole-auth-radius
• Assignee: Unassigned
• Reporter: Nicolas Baudrand
• Created: 24/Apr/21 15:49
• Updated: 28/Apr/21 12:20

Description

Hi !

We're using Guacamole Auth ldap and then map returned groups with existing mysql groups to assign profiles.

Now, we want to ask for TOTP to our central server that is reachable by radius.

So, I have enabled auth-jdbc, auth-ldap and auth-radius

With username+pass (ldap), I access to my AD group profile.

With username+otp or username+pass+otp (radius), I have an empty profile because no groups are returned by radius.

Is it possible to force a second auth after LDAP (returning GuacamoleInsufficientCredentialsException) so that we can ask for OTP after LDAP.

Guacamole TOTP is great but not centralized and I don't want to ask my users to register a new Token for each application.

 

Thanks a lot for this great product