[GUACAMOLE-715] Permission management based on LDAP groups not working as documented

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.0
• Fix Version/s: 1.1.0
• Component/s: guacamole-auth-jdbc-mysql, guacamole-auth-ldap
• Environment: I'm running guacamole in a docker environment using the official base images and a MySQL database. Users are authenticated against an Active Directory server in combination with the MySQL database.
• Assignee: Mike Jumper
• Reporter: Micha Kohl
• Created: 24/Jan/19 15:18
• Updated: 10/Jan/20 23:53
• Resolved: 25/Apr/19 20:44

Description

From the documentation on user groups in 1.0.0 I expected to be able to manage user permissions via LDAP groups like this (using LDAP for authentication and MySQL for configuration management as documented here):

1. Create user group in MySQL with the name of a corresponding user group in the LDAP directory 
2. Create connection in MySQL 
3. Grant connection permission to the user group created in 1.
4. LDAP users that are part of the LDAP group (in the directory) are able to log in with their LDAP credentials and access that connection

This does not work at all (the user does not even see the connection). In my attempt to narrow down the problem and ensure that I'm not just doing it wrong, I tested the following scenarios:

1. Having just the LDAP group be mirrored in MySQL by creating an identically named one there
   -> Login succeeds, but no associated connections are shown.
2. Having both the LDAP group and the user be mirrored in MySQL by creating identically named entities there without manually linking the two (MySQL user is not part of MySQL user group)
   -> Login succeeds and guacamole tries to auto-connect to the only available connection/shows all available connections and fails when trying to connect with a permission error.
3. Having both the LDAP group and the user be mirrored in MySQL by creating identically named entities there and manually adding the MySQL user to the MySQL group (MySQL user is part of MySQL user group)
   -> Connections are established successfully.

Either there seems to be a big misunderstanding regarding the way the new group system is supposed to work with LDAP, or there's something going wrong 
here. It goes without saying that scenario 3 completely eliminates the purpose of relying on existing LDAP groups. Scenario 1 is the configuration I outlined above that would allow managing connections based on LDAP groups without having to create any MySQL users whatsoever. Scenario 2 in combination with similar reports on the mailing list led me to believe that this is either based on a common misconception or there's a bug.

Side-Note: While it has been suggested that this is already covered by GUACAMOLE-696, I think this could only be said if this turns out to be expected but poorly documented behavior. 

Issue Links

• is duplicated by: GUACAMOLE-920 LDAP: Populate groups with membership from Directory Service.
• is duplicated by: GUACAMOLE-908 Link LDAP Group to DB Group even if user not in DB