3 ms·
We adopted Guacamole for access to some of our Windows server production environments; the great thing about it is you can put your corporate SSO / authorizatio
by NovemberWhiskey 5y ago
We adopted Guacamole for access to some of our Windows server production environments; the great thing about it is you can put your corporate SSO / authorization model into a web app to control access and not have to disclose credentials to service accounts to developers. You can also tap off a feed from the guacd that represents a complete screen recording and save it for audit trail purposes.
The only issue we've had is that FreeRDP (that underlies it for connectivity to Window servers) is a bit fussier than the native RDP environment, or at least we've had challenges getting equivalent compatibility across old/odd Windows configurations.
- amaccuish 5y agoOut of interest, we have SAML and OpenID Connect. How do you manage passing the SSO to Windows after displaying the web portal. I couldn't see anything in the Guacomole pages, but Citrix manages this. Where you sign in to the web portal, click a desktop, and don't have to login. Do you get a kerberos ticket, do you have something running on the Windows host or how?
- NovemberWhiskey 5y agoThe users don't log in with their own identities - we don't have developer accounts on production hosts. They log into service accounts: credentials are retrieved from a vault once the user has been authorized, after which the web application dynamically configures the RDP host/account/credential.
- denysvitali 5y agoFrom his comment it seems like they use a service account and thus hardcoded username + password on the Guacamole side rather than doing what Citrix does
- 2Gkashmiri 5y agoi have a question. i could "never" understand guacamole. i mean i currently use zerotier for clients/server and rdpwrap to get a bulletproof setup. is there some sort of foss "server" implementation of rdp so as to avoid using rdpwrap? i know vnc but i need multiple users connected at the same time...