Re: Username is case sensitive and allows TOTP bypass

2025-05-06 Thread Nick Couchman
On Tue, May 6, 2025 at 8:04 AM Peter Kronfuss wrote: > sorry, there is a typo in the sql-batch (copy&paste error): > > CREATE COLLATION public.case_insensitive (provider = icu, locale = > 'und-u-ks-level2', deterministic = false); > ALTER TABLE guacamole_entity ALTER COLUMN name TYPE varchar(128)

Re: Username is case sensitive and allows TOTP bypass

2025-05-06 Thread Peter Kronfuss
sorry, there is a typo in the sql-batch (copy&paste error): CREATE COLLATION public.case_insensitive (provider = icu, locale = 'und-u-ks-level2', deterministic = false); ALTER TABLE guacamole_entity ALTER COLUMN name TYPE varchar(128) COLLATE "case_insensitive"; Am 2025-05-06 13:59, schrieb Pet

Re: Username is case sensitive and allows TOTP bypass

2025-05-06 Thread Peter Kronfuss
Hi there again! I may have found a workaround, but I am not sure if it has any side effects. I have changed the collation of the name column in the guacamole_entity table to be case-insensitive, so that logging in with different usernames will result in the same entry. Maybe someone can check

Username is case sensitive and allows TOTP bypass

2025-05-06 Thread Peter Kronfuss
Hi there! We are using Guacamole 1.5.5 and I have also tested it on 1.6.0 with the same result. We are using the guacamole-auth-jdbc-postgresql-1.6.0.jar extension, as well as guacamole-auth-ldap-1.6.0.jar and guacamole-auth-totp-1.6.0.jar to get TOTP 2 factor authentication. In guacamole.pro