I got this working. The issue seems more to be with permissions. Is there a way to assign Update/Delete and Administer privileges to a connection group and/or connections based on group memberships other then thru the backend mysql database?
It seems if I authenticate with SAML, SAML authorizes based on group membership with an exact matching group named in the mysql database the user only gets read access to a connection group. It seems the only way around that is to either update the privileges with a mysql insert command make the group/user an administrator. I don’t want the user to be administrator. I would like a group to have add/update and delete privileges over their assigned connection group(s). From: Eric Koons via user <[email protected]> Date: Tuesday, September 15, 2026 at 7:23 PM To: [email protected] <[email protected]> Cc: Eric Koons <[email protected]> Subject: [EXTERNAL]Problem with authorization via SAML Groups I was wondering if I could get some help on troubleshooting authorization using SAML. I’m running guacamole in docker behind Nginx. It’s guacamole version 1.6.0. I’m successfully able to authenticate via SAML using our IDP. My understanding is that if we create a local group in guacamole, as long as it matches the group passed by the IDP you can enforce privileges and connections based upon the group membership. The issue I’m having is that it seems that Guacamole is not picking up the group from the SAML assertion. I’ve verified that our IDP is sending the group name in the assertion via a Chrome browser SAML Tracer. I had it working for a moment, although it didn’t seem like it was enforcing privilege and now it stopped working. I’ve attached some logs and my relevant parts of my docker-compose.yml file, I’ve sanitized portions of both. Any help or guidance would be greatly appreciated. Thanks, Eric I have a local group created in guacamole named cn=Engineering Log entries from when it worked: 18:39:13.366 [http-nio-8080-exec-4] INFO o.a.g.event.EventLoggingListener - User "ek***[email protected]" (authenticated by "saml") successfully created user group "cn=Engineering" within “mysql" 18:39:21.704 [http-nio-8080-exec-10] INFO o.a.g.event.EventLoggingListener - User "ek***[email protected]" (authenticated by "saml") successfully updated user group "cn=Engineering" within "mysql" Log entries from when it’s not working: 9:00:06.902 [main] INFO o.a.g.extension.ExtensionModule - Multiple extensions are installed and will be loaded in order of decreasing priority: 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [saml] "SAML Authentication Extension" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-auth-sso-saml.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [mysql] "MySQL Authentication" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-auth-jdbc-mysql.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [ban] "Brute-force Authentication Detection/Prevention" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-auth-ban.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - - [recording-storage] "Session Recording Storage" (/tmp/guacamole-home.7JbkGpqVao/extensions/guacamole-history-recording-storage.jar) 19:00:06.903 [main] INFO o.a.g.extension.ExtensionModule - To change this order, set the "extension-priority" property or rename the extension files. The default priority of extensions is dictated by the sort order of their filenames. 19:00:07.050 [main] INFO o.a.g.extension.ExtensionModule - Extension "SAML Authentication Extension" (saml) loaded. …… 22:59:17.092 [http-nio-8080-exec-2] INFO o.a.g.event.EventLoggingListener - User "ek***[email protected]" (authenticated by "saml") successfully authenticated from 10.1.4.65 Docker-compose.yml guacamole-local: image: guacamole/guacamole:latest container_name: guacamole-local restart: unless-stopped group_add: - "1000" volumes: # HOST PATH : CONTAINER PATH (set to read-only 'ro' for safety) - /home/guac_recordings:/var/lib/guacamole/recordings:ro - /opt/guacamole/tomcat/server.xml:/usr/local/tomcat/conf/server.xml:ro #- /opt/guacamole/extensions:/etc/guacamole/extensions depends_on: - guacdb - guacd ports: - "127.0.0.1:8081:8080" environment: GUACD_HOSTNAME: guacd MYSQL_HOSTNAME: guacdb MYSQL_DATABASE: guacamole_db MYSQL_USER: guacamole_user MYSQL_PASSWORD: password RECORDING_SEARCH_PATH: /var/lib/guacamole/recordings EXTENSION_PRIORITY: saml, mysql EXTENSIONS: auth-jdbc-mysql, history-recording-storage SAML_IDP_METADATA_URL: https://app.myidp.com/saml/metadata/metadata-string SAML_ENTITY_ID: guardian SAML_CALLBACK_URL: https://callbackurl.mydomain.io:8080/guacamole/ SAML_GROUP_ATTRIBUTE: groups SAML_DEBUG: "true" SAML_STRICT: "false" MYSQL_AUTO_CREATE_ACCOUNTS: "true" MYSQL_DISABLE_AUTH: "false" JAVA_OPTS: "-Dguacamole.log.level=DEBUG" CASE_SENSITIVE_AUTH: "false" Caution: This email originated from outside the Service Electric Network. Do not click on any links or open attachments unless the sender is known, and the content is verified as safe.
