| #!/bin/bash -e |
| # |
| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| # |
| |
| ## |
| ## @fn start.sh |
| ## |
| ## Automatically configures and starts Guacamole under Tomcat. Guacamole's |
| ## guacamole.properties file will be automatically generated based on the |
| ## linked database container (either MySQL, PostgreSQL or SQLServer) and the linked guacd |
| ## container. The Tomcat process will ultimately replace the process of this |
| ## script, running in the foreground until terminated. |
| ## |
| |
| GUACAMOLE_HOME_TEMPLATE="$GUACAMOLE_HOME" |
| |
| GUACAMOLE_HOME="$HOME/.guacamole" |
| GUACAMOLE_EXT="$GUACAMOLE_HOME/extensions" |
| GUACAMOLE_LIB="$GUACAMOLE_HOME/lib" |
| GUACAMOLE_PROPERTIES="$GUACAMOLE_HOME/guacamole.properties" |
| |
| ## |
| ## Sets the given property to the given value within guacamole.properties, |
| ## creating guacamole.properties first if necessary. |
| ## |
| ## @param NAME |
| ## The name of the property to set. |
| ## |
| ## @param VALUE |
| ## The value to set the property to. |
| ## |
| set_property() { |
| |
| NAME="$1" |
| VALUE="$2" |
| |
| # Ensure guacamole.properties exists |
| if [ ! -e "$GUACAMOLE_PROPERTIES" ]; then |
| mkdir -p "$GUACAMOLE_HOME" |
| echo "# guacamole.properties - generated `date`" > "$GUACAMOLE_PROPERTIES" |
| fi |
| |
| # Set property |
| echo "$NAME: $VALUE" >> "$GUACAMOLE_PROPERTIES" |
| |
| } |
| |
| ## |
| ## Sets the given property to the given value within guacamole.properties only |
| ## if a value is provided, creating guacamole.properties first if necessary. |
| ## |
| ## @param NAME |
| ## The name of the property to set. |
| ## |
| ## @param VALUE |
| ## The value to set the property to, if any. If omitted or empty, the |
| ## property will not be set. |
| ## |
| set_optional_property() { |
| |
| NAME="$1" |
| VALUE="$2" |
| |
| # Set the property only if a value is provided |
| if [ -n "$VALUE" ]; then |
| set_property "$NAME" "$VALUE" |
| fi |
| |
| } |
| |
| # Print error message regarding missing required variables for MySQL authentication |
| mysql_missing_vars() { |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using a MySQL database, you must provide each of the following |
| environment variables or their corresponding Docker secrets by appending _FILE |
| to the environment variable, and setting the value to the path of the |
| corresponding secret: |
| |
| MYSQL_USER The user to authenticate as when connecting to |
| MySQL. |
| |
| MYSQL_PASSWORD The password to use when authenticating with MySQL as |
| MYSQL_USER. |
| |
| MYSQL_DATABASE The name of the MySQL database to use for Guacamole |
| authentication. |
| END |
| exit 1; |
| } |
| |
| |
| ## |
| ## Adds properties to guacamole.properties which select the MySQL |
| ## authentication provider, and configure it to connect to the linked MySQL |
| ## container. If a MySQL database is explicitly specified using the |
| ## MYSQL_HOSTNAME and MYSQL_PORT environment variables, that will be used |
| ## instead of a linked container. |
| ## |
| associate_mysql() { |
| |
| # Use linked container if specified |
| if [ -n "$MYSQL_NAME" ]; then |
| MYSQL_HOSTNAME="$MYSQL_PORT_3306_TCP_ADDR" |
| MYSQL_PORT="$MYSQL_PORT_3306_TCP_PORT" |
| fi |
| |
| # Use default port if none specified |
| MYSQL_PORT="${MYSQL_PORT-3306}" |
| |
| # Verify required connection information is present |
| if [ -z "$MYSQL_HOSTNAME" -o -z "$MYSQL_PORT" ]; then |
| cat <<END |
| FATAL: Missing MYSQL_HOSTNAME or "mysql" link. |
| ------------------------------------------------------------------------------- |
| If using a MySQL database, you must either: |
| |
| (a) Explicitly link that container with the link named "mysql". |
| |
| (b) If not using a Docker container for MySQL, explicitly specify the TCP |
| connection to your database using the following environment variables: |
| |
| MYSQL_HOSTNAME The hostname or IP address of the MySQL server. If not |
| using a MySQL Docker container and corresponding link, |
| this environment variable is *REQUIRED*. |
| |
| MYSQL_PORT The port on which the MySQL server is listening for TCP |
| connections. This environment variable is option. If |
| omitted, the standard MySQL port of 3306 will be used. |
| END |
| exit 1; |
| fi |
| |
| |
| # Verify that the required Docker secrets are present, else, default to their normal environment variables |
| if [ -n "$MYSQL_USER_FILE" ]; then |
| set_property "mysql-username" "`cat "$MYSQL_USER_FILE"`" |
| elif [ -n "$MYSQL_USER" ]; then |
| set_property "mysql-username" "$MYSQL_USER" |
| else |
| mysql_missing_vars |
| exit 1; |
| fi |
| |
| if [ -n "$MYSQL_PASSWORD_FILE" ]; then |
| set_property "mysql-password" "`cat "$MYSQL_PASSWORD_FILE"`" |
| elif [ -n "$MYSQL_PASSWORD" ]; then |
| set_property "mysql-password" "$MYSQL_PASSWORD" |
| else |
| mysql_missing_vars |
| exit 1; |
| fi |
| |
| if [ -n "$MYSQL_DATABASE_FILE" ]; then |
| set_property "mysql-database" "`cat "$MYSQL_DATABASE_FILE"`" |
| elif [ -n "$MYSQL_DATABASE" ]; then |
| set_property "mysql-database" "$MYSQL_DATABASE" |
| else |
| mysql_missing_vars |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "mysql-hostname" "$MYSQL_HOSTNAME" |
| set_property "mysql-port" "$MYSQL_PORT" |
| |
| set_optional_property \ |
| "mysql-absolute-max-connections" \ |
| "$MYSQL_ABSOLUTE_MAX_CONNECTIONS" |
| |
| set_optional_property \ |
| "mysql-default-max-connections" \ |
| "$MYSQL_DEFAULT_MAX_CONNECTIONS" |
| |
| set_optional_property \ |
| "mysql-default-max-group-connections" \ |
| "$MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS" |
| |
| set_optional_property \ |
| "mysql-default-max-connections-per-user" \ |
| "$MYSQL_DEFAULT_MAX_CONNECTIONS_PER_USER" |
| |
| set_optional_property \ |
| "mysql-default-max-group-connections-per-user" \ |
| "$MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER" |
| |
| set_optional_property \ |
| "mysql-user-required" \ |
| "$MYSQL_USER_REQUIRED" |
| |
| set_optional_property \ |
| "mysql-ssl-mode" \ |
| "$MYSQL_SSL_MODE" |
| |
| set_optional_property \ |
| "mysql-ssl-trust-store" \ |
| "$MYSQL_SSL_TRUST_STORE" |
| |
| # For SSL trust store password, check secrets, first, then standard env variable |
| if [ -n "$MYSQL_SSL_TRUST_PASSWORD_FILE" ]; then |
| set_property "mysql-ssl-trust-password" "`cat "$MYSQL_SSL_TRUST_PASSWORD_FILE"`" |
| elif [ -n "$MYSQL_SSL_TRUST_PASSWORD" ]; then |
| set_property "mysql-ssl-trust-password" "$MYSQL_SSL_TRUST_PASSWORD" |
| fi |
| |
| set_optional_property \ |
| "mysql-ssl-client-store" \ |
| "$MYSQL_SSL_CLIENT_STORE" |
| |
| # For SSL trust store password, check secrets, first, then standard env variable |
| if [ -n "$MYSQL_SSL_CLIENT_PASSWORD_FILE" ]; then |
| set_property "mysql-ssl-client-password" "`cat "$MYSQL_SSL_CLIENT_PASSWORD_FILE"`" |
| elif [ -n "$MYSQL_SSL_CLIENT_PASSWORD" ]; then |
| set_property "mysql-ssl-client-password" "$MYSQL_SSL_CLIENT_PASSWORD" |
| fi |
| |
| set_optional_property \ |
| "mysql-auto-create-accounts" \ |
| "$MYSQL_AUTO_CREATE_ACCOUNTS" |
| |
| # Add required .jar files to GUACAMOLE_LIB and GUACAMOLE_EXT |
| ln -s /opt/guacamole/mysql/mysql-connector-*.jar "$GUACAMOLE_LIB" |
| ln -s /opt/guacamole/mysql/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| |
| } |
| |
| # Print error message regarding missing required variables for PostgreSQL authentication |
| postgresql_missing_vars() { |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using a PostgreSQL database, you must provide each of the following |
| environment variables or their corresponding Docker secrets by appending _FILE |
| to the environment variable, and setting the value to the path of the |
| corresponding secret: |
| |
| POSTGRESQL_USER The user to authenticate as when connecting to |
| PostgreSQL. |
| |
| POSTGRESQL_PASSWORD The password to use when authenticating with PostgreSQL |
| as POSTGRESQL_USER. |
| |
| POSTGRESQL_DATABASE The name of the PostgreSQL database to use for Guacamole |
| authentication. |
| END |
| exit 1; |
| } |
| |
| ## Provide backward compatibility on POSTGRES_* environment variables |
| ## In case of new deployment, please use POSTGRESQL_* equivalent variables. |
| for VAR_BASE in \ |
| HOSTNAME PORT \ |
| DATABASE USER PASSWORD \ |
| DATABASE_FILE USER_FILE PASSWORD_FILE \ |
| ABSOLUTE_MAX_CONNECTIONS DEFAULT_MAX_CONNECTIONS \ |
| DEFAULT_MAX_GROUP_CONNECTIONS DEFAULT_MAX_CONNECTIONS_PER_USER \ |
| DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER \ |
| DEFAULT_STATEMENT_TIMEOUT SOCKET_TIMEOUT \ |
| USER_REQUIRED \ |
| SSL_KEY_PASSWORD_FILE SSL_KEY_PASSWORD; do |
| |
| OLD_VAR="POSTGRES_$VAR_BASE" |
| NEW_VAR="POSTGRESQL_$VAR_BASE" |
| |
| if [ -n "${!OLD_VAR}" ]; then |
| printf -v "$NEW_VAR" "%s" "${!OLD_VAR}" |
| echo "WARNING: ${OLD_VAR} detected, please use ${NEW_VAR} for further deployments." |
| fi |
| |
| done |
| |
| ## |
| ## Adds properties to guacamole.properties which select the PostgreSQL |
| ## authentication provider, and configure it to connect to the linked |
| ## PostgreSQL container. If a PostgreSQL database is explicitly specified using |
| ## the POSTGRESQL_HOSTNAME and POSTGRESQL_PORT environment variables, that will be |
| ## used instead of a linked container. |
| ## |
| associate_postgresql() { |
| |
| # Use linked container if specified |
| if [ -n "$POSTGRES_NAME" ]; then |
| POSTGRESQL_HOSTNAME="$POSTGRES_PORT_5432_TCP_ADDR" |
| POSTGRESQL_PORT="$POSTGRES_PORT_5432_TCP_PORT" |
| fi |
| |
| # Use default port if none specified |
| POSTGRESQL_PORT="${POSTGRESQL_PORT-5432}" |
| |
| # Verify required connection information is present |
| if [ -z "$POSTGRESQL_HOSTNAME" -o -z "$POSTGRESQL_PORT" ]; then |
| cat <<END |
| FATAL: Missing POSTGRESQL_HOSTNAME or "postgres" link. |
| ------------------------------------------------------------------------------- |
| If using a PostgreSQL database, you must either: |
| |
| (a) Explicitly link that container with the link named "postgres". |
| |
| (b) If not using a Docker container for PostgreSQL, explicitly specify the TCP |
| connection to your database using the following environment variables: |
| |
| POSTGRESQL_HOSTNAME The hostname or IP address of the PostgreSQL server. If |
| not using a PostgreSQL Docker container and |
| corresponding link, this environment variable is |
| *REQUIRED*. |
| |
| POSTGRESQL_PORT The port on which the PostgreSQL server is listening for |
| TCP connections. This environment variable is option. If |
| omitted, the standard PostgreSQL port of 5432 will be |
| used. |
| END |
| exit 1; |
| fi |
| |
| # Verify that the required Docker secrets are present, else, default to their normal environment variables |
| if [ -n "$POSTGRESQL_USER_FILE" ]; then |
| set_property "postgresql-username" "`cat "$POSTGRESQL_USER_FILE"`" |
| elif [ -n "$POSTGRESQL_USER" ]; then |
| set_property "postgresql-username" "$POSTGRESQL_USER" |
| else |
| postgresql_missing_vars |
| exit 1; |
| fi |
| |
| if [ -n "$POSTGRESQL_PASSWORD_FILE" ]; then |
| set_property "postgresql-password" "`cat "$POSTGRESQL_PASSWORD_FILE"`" |
| elif [ -n "$POSTGRESQL_PASSWORD" ]; then |
| set_property "postgresql-password" "$POSTGRESQL_PASSWORD" |
| else |
| postgresql_missing_vars |
| exit 1; |
| fi |
| |
| if [ -n "$POSTGRESQL_DATABASE_FILE" ]; then |
| set_property "postgresql-database" "`cat "$POSTGRESQL_DATABASE_FILE"`" |
| elif [ -n "$POSTGRESQL_DATABASE" ]; then |
| set_property "postgresql-database" "$POSTGRESQL_DATABASE" |
| else |
| postgresql_missing_vars |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "postgresql-hostname" "$POSTGRESQL_HOSTNAME" |
| set_property "postgresql-port" "$POSTGRESQL_PORT" |
| |
| set_optional_property \ |
| "postgresql-absolute-max-connections" \ |
| "$POSTGRESQL_ABSOLUTE_MAX_CONNECTIONS" |
| |
| set_optional_property \ |
| "postgresql-default-max-connections" \ |
| "$POSTGRESQL_DEFAULT_MAX_CONNECTIONS" |
| |
| set_optional_property \ |
| "postgresql-default-max-group-connections" \ |
| "$POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS" |
| |
| set_optional_property \ |
| "postgresql-default-max-connections-per-user" \ |
| "$POSTGRESQL_DEFAULT_MAX_CONNECTIONS_PER_USER" |
| |
| set_optional_property \ |
| "postgresql-default-max-group-connections-per-user" \ |
| "$POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER" |
| |
| set_optional_property \ |
| "postgresql-default-statement-timeout" \ |
| "$POSTGRESQL_DEFAULT_STATEMENT_TIMEOUT" |
| |
| set_optional_property \ |
| "postgresql-user-required" \ |
| "$POSTGRESQL_USER_REQUIRED" |
| |
| set_optional_property \ |
| "postgresql-socket-timeout" \ |
| "$POSTGRESQL_SOCKET_TIMEOUT" |
| |
| set_optional_property \ |
| "postgresql-ssl-mode" \ |
| "$POSTGRESQL_SSL_MODE" |
| |
| set_optional_property \ |
| "postgresql-ssl-cert-file" \ |
| "$POSTGRESQL_SSL_CERT_FILE" |
| |
| set_optional_property \ |
| "postgresql-ssl-key-file" \ |
| "$POSTGRESQL_SSL_KEY_FILE" |
| |
| set_optional_property \ |
| "postgresql-ssl-root-cert-file" \ |
| "$POSTGRESQL_SSL_ROOT_CERT_FILE" |
| |
| # For SSL key password, check secrets, first, then standard env variable |
| if [ -n "$POSTGRESQL_SSL_KEY_PASSWORD_FILE" ]; then |
| set_property "postgresql-ssl-key-password" "`cat "$POSTGRESQL_SSL_KEY_PASSWORD_FILE"`" |
| elif [ -n "$POSTGRESQL_SSL_KEY_PASSWORD" ]; then |
| set_property "postgresql-ssl-key-password" "$POSTGRESQL_SSL_KEY_PASSWORD" |
| fi |
| |
| set_optional_property \ |
| "postgresql-auto-create-accounts" \ |
| "$POSTGRESQL_AUTO_CREATE_ACCOUNTS" |
| |
| # Add required .jar files to GUACAMOLE_LIB and GUACAMOLE_EXT |
| ln -s /opt/guacamole/postgresql/postgresql-*.jar "$GUACAMOLE_LIB" |
| ln -s /opt/guacamole/postgresql/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| |
| } |
| |
| # Print error message regarding missing required variables for SQLServer authentication |
| sqlserver_missing_vars() { |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using a SQLServer database, you must provide each of the following |
| environment variables: |
| |
| SQLSERVER_USER The user to authenticate as when connecting to |
| SQLServer. |
| |
| SQLSERVER_PASSWORD The password to use when authenticating with SQLServer |
| as SQLSERVER_USER. |
| |
| SQLSERVER_DATABASE The name of the SQLServer database to use for Guacamole |
| authentication. |
| |
| Alternatively, if you want to store database credentials using Docker secrets, |
| set the path of the corresponding secrets in the following three variables: |
| |
| SQLSERVER_DATABASE_FILE The path of the docker secret containing the name |
| of database to use for Guacamole authentication. |
| |
| SQLSERVER_USER_FILE The path of the docker secret containing the name of |
| the user that Guacamole will use to connect to SQLServer. |
| |
| SQLSERVER_PASSWORD_FILE The path of the docker secret containing the |
| password that Guacamole will provide when connecting to |
| SQLServer as SQLSERVER_USER. |
| |
| END |
| exit 1; |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which select the SQLServer |
| ## authentication provider, and configure it to connect to the linked |
| ## SQLServer container. If a SQLServer database is explicitly specified using |
| ## the SQLSERVER_HOSTNAME and SQLSERVER_PORT environment variables, that will |
| ## be used instead of a linked container. |
| ## |
| associate_sqlserver() { |
| |
| # Use linked container if specified |
| if [ -n "$SQLSERVER_NAME" ]; then |
| SQLSERVER_HOSTNAME="$SQLSERVER_PORT_1433_TCP_ADDR" |
| SQLSERVER_PORT="$SQLSERVER_PORT_1433_TCP_PORT" |
| fi |
| |
| # Use default port if none specified |
| SQLSERVER_PORT="${SQLSERVER_PORT-1433}" |
| |
| # Verify required connection information is present |
| if [ -z "$SQLSERVER_HOSTNAME" -o -z "$SQLSERVER_PORT" ]; then |
| cat <<END |
| FATAL: Missing SQLSERVER_HOSTNAME or "sqlserver" link. |
| ------------------------------------------------------------------------------- |
| If using a SQLServer database, you must either: |
| |
| (a) Explicitly link that container with the link named "sqlserver". |
| |
| (b) If not using a Docker container for SQLServer, explicitly specify the TCP |
| connection to your database using the following environment variables: |
| |
| SQLSERVER_HOSTNAME The hostname or IP address of the SQLServer server. If |
| not using a SQLServer Docker container and |
| corresponding link, this environment variable is |
| *REQUIRED*. |
| |
| SQLSERVER_PORT The port on which the SQLServer server is listening for |
| TCP connections. This environment variable is option. If |
| omitted, the standard SQLServer port of 1433 will be |
| used. |
| END |
| exit 1; |
| fi |
| |
| # Verify that the required Docker secrets are present, else, default to their normal environment variables |
| if [ -n "$SQLSERVER_USER_FILE" ]; then |
| set_property "sqlserver-username" "`cat "$SQLSERVER_USER_FILE"`" |
| elif [ -n "$SQLSERVER_USER" ]; then |
| set_property "sqlserver-username" "$SQLSERVER_USER" |
| else |
| sqlserver_missing_vars |
| exit 1; |
| fi |
| |
| if [ -n "$SQLSERVER_PASSWORD_FILE" ]; then |
| set_property "sqlserver-password" "`cat "$SQLSERVER_PASSWORD_FILE"`" |
| elif [ -n "$SQLSERVER_PASSWORD" ]; then |
| set_property "sqlserver-password" "$SQLSERVER_PASSWORD" |
| else |
| sqlserver_missing_vars |
| exit 1; |
| fi |
| |
| if [ -n "$SQLSERVER_DATABASE_FILE" ]; then |
| set_property "sqlserver-database" "`cat "$SQLSERVER_DATABASE_FILE"`" |
| elif [ -n "$SQLSERVER_DATABASE" ]; then |
| set_property "sqlserver-database" "$SQLSERVER_DATABASE" |
| else |
| sqlserver_missing_vars |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "sqlserver-hostname" "$SQLSERVER_HOSTNAME" |
| set_property "sqlserver-port" "$SQLSERVER_PORT" |
| set_property "sqlserver-driver" "microsoft2005" |
| |
| set_optional_property \ |
| "sqlserver-absolute-max-connections" \ |
| "$SQLSERVER_ABSOLUTE_MAX_CONNECTIONS" |
| |
| set_optional_property \ |
| "sqlserver-default-max-connections" \ |
| "$SQLSERVER_DEFAULT_MAX_CONNECTIONS" |
| |
| set_optional_property \ |
| "sqlserver-default-max-group-connections" \ |
| "$SQLSERVER_DEFAULT_MAX_GROUP_CONNECTIONS" |
| |
| set_optional_property \ |
| "sqlserver-default-max-connections-per-user" \ |
| "$SQLSERVER_DEFAULT_MAX_CONNECTIONS_PER_USER" |
| |
| set_optional_property \ |
| "sqlserver-default-max-group-connections-per-user" \ |
| "$SQLSERVER_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER" |
| |
| set_optional_property \ |
| "sqlserver-user-required" \ |
| "$SQLSERVER_USER_REQUIRED" |
| |
| set_optional_property \ |
| "sqlserver-auto-create-accounts" \ |
| "$SQLSERVERQL_AUTO_CREATE_ACCOUNTS" |
| |
| set_optional_property \ |
| "sqlserver-instance" \ |
| "$SQLSERVERQL_INSTANCE" |
| |
| # Add required .jar files to GUACAMOLE_LIB and GUACAMOLE_EXT |
| ln -s /opt/guacamole/sqlserver/mssql-jdbc-*.jar "$GUACAMOLE_LIB" |
| ln -s /opt/guacamole/sqlserver/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which select the LDAP |
| ## authentication provider, and configure it to connect to the specified LDAP |
| ## directory. |
| ## |
| associate_ldap() { |
| |
| # Verify required parameters are present |
| if [ -z "$LDAP_HOSTNAME" -o -z "$LDAP_USER_BASE_DN" ]; then |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using an LDAP directory, you must provide each of the following environment |
| variables: |
| |
| LDAP_HOSTNAME The hostname or IP address of your LDAP server. |
| |
| LDAP_USER_BASE_DN The base DN under which all Guacamole users will be |
| located. Absolutely all Guacamole users that will |
| authenticate via LDAP must exist within the subtree of |
| this DN. |
| END |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "ldap-hostname" "$LDAP_HOSTNAME" |
| set_property "ldap-user-base-dn" "$LDAP_USER_BASE_DN" |
| |
| set_optional_property "ldap-port" "$LDAP_PORT" |
| set_optional_property "ldap-encryption-method" "$LDAP_ENCRYPTION_METHOD" |
| set_optional_property "ldap-max-search-results" "$LDAP_MAX_SEARCH_RESULTS" |
| set_optional_property "ldap-search-bind-dn" "$LDAP_SEARCH_BIND_DN" |
| set_optional_property "ldap-user-attributes" "$LDAP_USER_ATTRIBUTES" |
| set_optional_property "ldap-search-bind-password" "$LDAP_SEARCH_BIND_PASSWORD" |
| set_optional_property "ldap-username-attribute" "$LDAP_USERNAME_ATTRIBUTE" |
| set_optional_property "ldap-member-attribute" "$LDAP_MEMBER_ATTRIBUTE" |
| set_optional_property "ldap-user-search-filter" "$LDAP_USER_SEARCH_FILTER" |
| set_optional_property "ldap-config-base-dn" "$LDAP_CONFIG_BASE_DN" |
| set_optional_property "ldap-group-base-dn" "$LDAP_GROUP_BASE_DN" |
| set_optional_property "ldap-group-search-filter" "$LDAP_GROUP_SEARCH_FILTER" |
| set_optional_property "ldap-member-attribute-type" "$LDAP_MEMBER_ATTRIBUTE_TYPE" |
| set_optional_property "ldap-group-name-attribute" "$LDAP_GROUP_NAME_ATTRIBUTE" |
| set_optional_property "ldap-dereference-aliases" "$LDAP_DEREFERENCE_ALIASES" |
| set_optional_property "ldap-follow-referrals" "$LDAP_FOLLOW_REFERRALS" |
| set_optional_property "ldap-max-referral-hops" "$LDAP_MAX_REFERRAL_HOPS" |
| set_optional_property "ldap-operation-timeout" "$LDAP_OPERATION_TIMEOUT" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| ln -s /opt/guacamole/ldap/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which select the LDAP |
| ## authentication provider, and configure it to connect to the specified LDAP |
| ## directory. |
| ## |
| associate_radius() { |
| |
| # Verify required parameters are present |
| if [ -z "$RADIUS_SHARED_SECRET" -o -z "$RADIUS_AUTH_PROTOCOL" ]; then |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using RADIUS server, you must provide each of the following environment |
| variables: |
| |
| RADIUS_SHARED_SECRET The shared secret to use when talking to the |
| RADIUS server. |
| |
| RADIUS_AUTH_PROTOCOL The authentication protocol to use when talking |
| to the RADIUS server. |
| Supported values are: |
| pap, chap, mschapv1, mschapv2, eap-md5, |
| eap-tls and eap-ttls. |
| END |
| exit 1; |
| fi |
| |
| # Verify provided files do exist and are readable |
| if [ -n "$RADIUS_KEY_FILE" -a ! -r "$RADIUS_KEY_FILE" ]; then |
| cat <<END |
| FATAL: Provided file RADIUS_KEY_FILE=$RADIUS_KEY_FILE does not exist |
| or is not readable! |
| ------------------------------------------------------------------------------- |
| If you provide key or CA files you need to mount those into the container and |
| make sure they are readable for the user in the container. |
| END |
| exit 1; |
| fi |
| if [ -n "$RADIUS_CA_FILE" -a ! -r "$RADIUS_CA_FILE" ]; then |
| cat <<END |
| FATAL: Provided file RADIUS_CA_FILE=$RADIUS_CA_FILE does not exist |
| or is not readable! |
| ------------------------------------------------------------------------------- |
| If you provide key or CA files you need to mount those into the container and |
| make sure they are readable for the user in the container. |
| END |
| exit 1; |
| fi |
| if [ "$RADIUS_AUTH_PROTOCOL" = "eap-ttls" -a -z "$RADIUS_EAP_TTLS_INNER_PROTOCOL" ]; then |
| cat <<END |
| FATAL: Authentication protocol "eap-ttls" specified but |
| RADIUS_EAP_TTLS_INNER_PROTOCOL is not set! |
| ------------------------------------------------------------------------------- |
| When EAP-TTLS is used, this parameter specifies the inner (tunneled) |
| protocol to use talking to the RADIUS server. |
| END |
| exit 1; |
| fi |
| |
| # Update config file |
| set_optional_property "radius-hostname" "$RADIUS_HOSTNAME" |
| set_optional_property "radius-auth-port" "$RADIUS_AUTH_PORT" |
| set_property "radius-shared-secret" "$RADIUS_SHARED_SECRET" |
| set_property "radius-auth-protocol" "$RADIUS_AUTH_PROTOCOL" |
| set_optional_property "radius-key-file" "$RADIUS_KEY_FILE" |
| set_optional_property "radius-key-type" "$RADIUS_KEY_TYPE" |
| set_optional_property "radius-key-password" "$RADIUS_KEY_PASSWORD" |
| set_optional_property "radius-ca-file" "$RADIUS_CA_FILE" |
| set_optional_property "radius-ca-type" "$RADIUS_CA_TYPE" |
| set_optional_property "radius-ca-password" "$RADIUS_CA_PASSWORD" |
| set_optional_property "radius-trust-all" "$RADIUS_TRUST_ALL" |
| set_optional_property "radius-retries" "$RADIUS_RETRIES" |
| set_optional_property "radius-timeout" "$RADIUS_TIMEOUT" |
| set_optional_property "radius-eap-ttls-inner-protocol" "$RADIUS_EAP_TTLS_INNER_PROTOCOL" |
| set_optional_property "radius-nas-ip" "$RADIUS_NAS_IP" |
| |
| set_optional_property \ |
| "radius-eap-ttls-inner-protocol" \ |
| "$RADIUS_EAP_TTLS_INNER_PROTOCOL" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| ln -s /opt/guacamole/radius/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| } |
| |
| ## Adds properties to guacamole.properties which select the OPENID |
| ## authentication provider, and configure it to connect to the specified OPENID |
| ## provider. |
| ## |
| associate_openid() { |
| |
| # Verify required parameters are present |
| if [ -z "$OPENID_AUTHORIZATION_ENDPOINT" ] || \ |
| [ -z "$OPENID_JWKS_ENDPOINT" ] || \ |
| [ -z "$OPENID_ISSUER" ] || \ |
| [ -z "$OPENID_CLIENT_ID" ] || \ |
| [ -z "$OPENID_REDIRECT_URI" ] |
| then |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using an openid authentication, you must provide each of the following |
| environment variables: |
| |
| OPENID_AUTHORIZATION_ENDPOINT The authorization endpoint (URI) of the OpenID service. |
| |
| OPENID_JWKS_ENDPOINT The endpoint (URI) of the JWKS service which defines |
| how received ID tokens (JSON Web Tokens or JWTs) |
| shall be validated. |
| |
| OPENID_ISSUER The issuer to expect for all received ID tokens. |
| |
| OPENID_CLIENT_ID The OpenID client ID which should be submitted |
| to the OpenID service when necessary. |
| This value is typically provided to you by the OpenID |
| service when OpenID credentials are generated for your application. |
| |
| OPENID_REDIRECT_URI The URI that should be submitted to the OpenID service such that |
| they can redirect the authenticated user back to Guacamole after |
| the authentication process is complete. This must be the full URL |
| that a user would enter into their browser to access Guacamole. |
| END |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "openid-authorization-endpoint" "$OPENID_AUTHORIZATION_ENDPOINT" |
| set_property "openid-jwks-endpoint" "$OPENID_JWKS_ENDPOINT" |
| set_property "openid-issuer" "$OPENID_ISSUER" |
| set_property "openid-client-id" "$OPENID_CLIENT_ID" |
| set_property "openid-redirect-uri" "$OPENID_REDIRECT_URI" |
| set_optional_property "openid-username-claim-type" "$OPENID_USERNAME_CLAIM_TYPE" |
| set_optional_property "openid-groups-claim-type" "$OPENID_GROUPS_CLAIM_TYPE" |
| set_optional_property "openid-scope" "$OPENID_SCOPE" |
| set_optional_property "openid-allowed-clock-skew" "$OPENID_ALLOWED_CLOCK_SKEW" |
| set_optional_property "openid-max-token-validity" "$OPENID_MAX_TOKEN_VALIDITY" |
| set_optional_property "openid-max-nonce-validity" "$OPENID_MAX_NONCE_VALIDITY" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| # "1-{}" make it sorted as a first provider (only authentication) |
| # so it can work together with the database providers (authorization) |
| find /opt/guacamole/openid/ -name "*.jar" | awk -F/ '{print $NF}' | \ |
| xargs -I '{}' ln -s "/opt/guacamole/openid/{}" "${GUACAMOLE_EXT}/1-{}" |
| |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which select the SAML |
| ## authentication provider, and configure it to connect to the specified SAML |
| ## provider. |
| ## |
| |
| associate_saml() { |
| |
| # Verify required parameters are present |
| if [ -z "$SAML_IDP_METADATA_URL" ] && \ |
| [ -z "$SAML_ENTITY_ID" -o -z "$SAML_CALLBACK_URL" -o -z "$SAML_IDP_URL" ] |
| then |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using a SAML authentication, you must provide either SAML_IDP_METADATA_URL |
| or SAML_IDP_URL, SAML_ENTITY_ID and SAML_CALLBACK_URL environment variables: |
| |
| SAML_IDP_METADATA_URL The URI of the XML metadata file that from the SAML Identity |
| Provider that contains all of the information the SAML |
| extension needs in order to know how to authenticate with |
| the IdP. This URI can either be a remote server (e.g. https://) |
| or a local file on the filesystem (e.g. file://). |
| |
| SAML_IDP_URL The URL of the Identity Provider (IdP), which the user |
| will be redirected to in order to authenticate. |
| |
| SAML_ENTITY_ID The entity ID of the Guacamole SAML client, which is |
| generally the URL of the Guacamole server. |
| |
| SAML_CALLBACK_URL The URL that the IdP will use once authentication has |
| succeeded to return to the Guacamole web application and |
| provide the authentication details to the SAML extension. |
| END |
| exit 1; |
| fi |
| |
| # Update config file |
| set_optional_property "saml-idp-metadata-url" "$SAML_IDP_METADATA_URL" |
| set_optional_property "saml-idp-url" "$SAML_IDP_URL" |
| set_optional_property "saml-entity-id" "$SAML_ENTITY_ID" |
| set_optional_property "saml-callback-url" "$SAML_CALLBACK_URL" |
| set_optional_property "saml-strict" "$SAML_STRICT" |
| set_optional_property "saml-debug" "$SAML_DEBUG" |
| set_optional_property "saml-compress-request" "$SAML_COMPRESS_REQUEST" |
| set_optional_property "saml-compress-response" "$SAML_COMPRESS_RESPONSE" |
| set_optional_property "saml-group-attribute" "$SAML_GROUP_ATTRIBUTE" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| # "1-{}" make it sorted as a first provider (only authentication) |
| # so it can work together with the database providers (authorization) |
| find /opt/guacamole/saml/ -name "*.jar" | awk -F/ '{print $NF}' | \ |
| xargs -I '{}' ln -s "/opt/guacamole/saml/{}" "${GUACAMOLE_EXT}/1-{}" |
| |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which configure the TOTP two-factor |
| ## authentication mechanism. |
| ## |
| associate_totp() { |
| # Update config file |
| set_optional_property "totp-issuer" "$TOTP_ISSUER" |
| set_optional_property "totp-digits" "$TOTP_DIGITS" |
| set_optional_property "totp-period" "$TOTP_PERIOD" |
| set_optional_property "totp-mode" "$TOTP_MODE" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| ln -s /opt/guacamole/totp/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which configure the Duo two-factor |
| ## authentication service. Checks to see if all variables are defined and makes sure |
| ## DUO_APPLICATION_KEY is >= 40 characters. |
| ## |
| associate_duo() { |
| # Verify required parameters are present |
| if [ -z "$DUO_INTEGRATION_KEY" ] || \ |
| [ -z "$DUO_SECRET_KEY" ] || \ |
| [ ${#DUO_APPLICATION_KEY} -lt 40 ] |
| then |
| cat <<END |
| FATAL: Missing required environment variables |
| ------------------------------------------------------------------------------- |
| If using the Duo authentication extension, you must provide each of the |
| following environment variables: |
| |
| DUO_API_HOSTNAME The hostname of the Duo API endpoint. |
| |
| DUO_INTEGRATION_KEY The integration key provided for Guacamole by Duo. |
| |
| DUO_SECRET_KEY The secret key provided for Guacamole by Duo. |
| |
| DUO_APPLICATION_KEY An arbitrary, random key. |
| This value must be at least 40 characters. |
| END |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "duo-api-hostname" "$DUO_API_HOSTNAME" |
| set_property "duo-integration-key" "$DUO_INTEGRATION_KEY" |
| set_property "duo-secret-key" "$DUO_SECRET_KEY" |
| set_property "duo-application-key" "$DUO_APPLICATION_KEY" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| ln -s /opt/guacamole/duo/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which configure the header |
| ## authentication provider. |
| ## |
| associate_header() { |
| # Update config file |
| set_optional_property "http-auth-header" "$HTTP_AUTH_HEADER" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| ln -s /opt/guacamole/header/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties witch configure the CAS |
| ## authentication service. |
| ## |
| associate_cas() { |
| # Verify required parameters are present |
| if [ -z "$CAS_AUTHORIZATION_ENDPOINT" ] || \ |
| [ -z "$CAS_REDIRECT_URI" ] |
| then |
| cat <<END |
| FATAL: Missing required environment variables |
| ----------------------------------------------------------------------------------- |
| If using the CAS authentication extension, you must provide each of the |
| following environment variables: |
| |
| CAS_AUTHORIZATION_ENDPOINT The URL of the CAS authentication server. |
| |
| CAS_REDIRECT_URI The URI to redirect back to upon successful authentication. |
| |
| END |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "cas-authorization-endpoint" "$CAS_AUTHORIZATION_ENDPOINT" |
| set_property "cas-redirect-uri" "$CAS_REDIRECT_URI" |
| set_optional_property "cas-clearpass-key" "$CAS_CLEARPASS_KEY" |
| set_optional_property "cas-group-attribute" "$CAS_GROUP_ATTRIBUTE" |
| set_optional_property "cas-group-format" "$CAS_GROUP_FORMAT" |
| set_optional_property "cas-group-ldap-base-dn" "$CAS_GROUP_LDAP_BASE_DN" |
| set_optional_property "cas-group-ldap-attribute" "$CAS_GROUP_LDAP_ATTRIBUTE" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| ln -s /opt/guacamole/cas/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| } |
| |
| ## |
| ## Adds properties to guacamole.properties which configure the json |
| ## authentication provider. |
| ## |
| associate_json() { |
| # Update config file |
| set_property "json-secret-key" "$JSON_SECRET_KEY" |
| set_optional_property "json-trusted-networks" "$JSON_TRUSTED_NETWORKS" |
| |
| # Add required .jar files to GUACAMOLE_EXT |
| ln -s /opt/guacamole/json/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| } |
| ## |
| ## Sets up Tomcat's remote IP valve that allows gathering the remote IP |
| ## from headers set by a remote proxy |
| ## Upstream documentation: https://tomcat.apache.org/tomcat-8.5-doc/api/org/apache/catalina/valves/RemoteIpValve.html |
| ## |
| enable_remote_ip_valve() { |
| # Add <Valve> element |
| xmlstarlet edit --inplace \ |
| --insert '/Server/Service/Engine/Host/*' --type elem -n Valve \ |
| --insert '/Server/Service/Engine/Host/Valve[not(@className)]' --type attr -n className -v org.apache.catalina.valves.RemoteIpValve \ |
| $CATALINA_BASE/conf/server.xml |
| |
| # Allowed IPs |
| if [ -z "$PROXY_ALLOWED_IPS_REGEX" ]; then |
| echo "Using default Tomcat allowed IPs regex" |
| else |
| xmlstarlet edit --inplace \ |
| --insert '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.RemoteIpValve"]' \ |
| --type attr -n internalProxies -v "$PROXY_ALLOWED_IPS_REGEX" \ |
| $CATALINA_BASE/conf/server.xml |
| fi |
| |
| # X-Forwarded-For |
| if [ -z "$PROXY_IP_HEADER" ]; then |
| echo "Using default Tomcat proxy IP header" |
| else |
| xmlstarlet edit --inplace \ |
| --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \ |
| --type attr -n remoteIpHeader -v "$PROXY_IP_HEADER" \ |
| $CATALINA_BASE/conf/server.xml |
| fi |
| |
| # X-Forwarded-Proto |
| if [ -z "$PROXY_PROTOCOL_HEADER" ]; then |
| echo "Using default Tomcat proxy protocol header" |
| else |
| xmlstarlet edit --inplace \ |
| --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \ |
| --type attr -n protocolHeader -v "$PROXY_PROTOCOL_HEADER" \ |
| $CATALINA_BASE/conf/server.xml |
| fi |
| |
| # X-Forwarded-By |
| if [ -z "$PROXY_BY_HEADER" ]; then |
| echo "Using default Tomcat proxy forwarded by header" |
| else |
| xmlstarlet edit --inplace \ |
| --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \ |
| --type attr -n remoteIpProxiesHeader -v "$PROXY_BY_HEADER" \ |
| $CATALINA_BASE/conf/server.xml |
| fi |
| } |
| |
| ## |
| ## Adds api-session-timeout to guacamole.properties |
| ## |
| associate_apisessiontimeout() { |
| set_optional_property "api-session-timeout" "$API_SESSION_TIMEOUT" |
| } |
| |
| ## |
| ## Starts Guacamole under Tomcat, replacing the current process with the |
| ## Tomcat process. As the current process will be replaced, this MUST be the |
| ## last function run within the script. |
| ## |
| start_guacamole() { |
| |
| # User-only writable CATALINA_BASE |
| export CATALINA_BASE=$HOME/tomcat |
| for dir in logs temp webapps work; do |
| mkdir -p $CATALINA_BASE/$dir |
| done |
| cp -R /usr/local/tomcat/conf $CATALINA_BASE |
| |
| # Set up Tomcat RemoteIPValve |
| if [ "$REMOTE_IP_VALVE_ENABLED" = "true" ]; then |
| enable_remote_ip_valve |
| fi |
| |
| # Install webapp |
| ln -sf /opt/guacamole/guacamole.war $CATALINA_BASE/webapps/${WEBAPP_CONTEXT:-guacamole}.war |
| |
| # Start tomcat |
| cd /usr/local/tomcat |
| exec catalina.sh run |
| |
| } |
| |
| # |
| # Start with a fresh GUACAMOLE_HOME |
| # |
| |
| rm -Rf "$GUACAMOLE_HOME" |
| |
| # |
| # Copy contents of provided GUACAMOLE_HOME template, if any |
| # |
| |
| if [ -n "$GUACAMOLE_HOME_TEMPLATE" ]; then |
| cp -a "$GUACAMOLE_HOME_TEMPLATE/." "$GUACAMOLE_HOME/" |
| fi |
| |
| # |
| # Create and define Guacamole lib and extensions directories |
| # |
| |
| mkdir -p "$GUACAMOLE_EXT" |
| mkdir -p "$GUACAMOLE_LIB" |
| |
| # |
| # Point to associated guacd |
| # |
| |
| # Use linked container for guacd if specified |
| if [ -n "$GUACD_NAME" ]; then |
| GUACD_HOSTNAME="$GUACD_PORT_4822_TCP_ADDR" |
| GUACD_PORT="$GUACD_PORT_4822_TCP_PORT" |
| fi |
| |
| # Use default guacd port if none specified |
| GUACD_PORT="${GUACD_PORT-4822}" |
| |
| # Verify required guacd connection information is present |
| if [ -z "$GUACD_HOSTNAME" -o -z "$GUACD_PORT" ]; then |
| cat <<END |
| FATAL: Missing GUACD_HOSTNAME or "guacd" link. |
| ------------------------------------------------------------------------------- |
| Every Guacamole instance needs a corresponding copy of guacd running. To |
| provide this, you must either: |
| |
| (a) Explicitly link that container with the link named "guacd". |
| |
| (b) If not using a Docker container for guacd, explicitly specify the TCP |
| connection information using the following environment variables: |
| |
| GUACD_HOSTNAME The hostname or IP address of guacd. If not using a guacd |
| Docker container and corresponding link, this environment |
| variable is *REQUIRED*. |
| |
| GUACD_PORT The port on which guacd is listening for TCP connections. |
| This environment variable is optional. If omitted, the |
| standard guacd port of 4822 will be used. |
| END |
| exit 1; |
| fi |
| |
| # Update config file |
| set_property "guacd-hostname" "$GUACD_HOSTNAME" |
| set_property "guacd-port" "$GUACD_PORT" |
| |
| # A comma-separated list of the identifiers of authentication providers that |
| # should be allowed to fail internally without aborting the authentication process |
| set_optional_property "skip-if-unavailable" "$SKIP_IF_UNAVAILABLE" |
| |
| |
| # |
| # Track which authentication backends are installed |
| # |
| |
| INSTALLED_AUTH="" |
| |
| # Use MySQL if database specified |
| if [ -n "$MYSQL_DATABASE" -o -n "$MYSQL_DATABASE_FILE" ]; then |
| associate_mysql |
| INSTALLED_AUTH="$INSTALLED_AUTH mysql" |
| fi |
| |
| # Use PostgreSQL if database specified |
| if [ -n "$POSTGRESQL_DATABASE" -o -n "$POSTGRESQL_DATABASE_FILE" ]; then |
| associate_postgresql |
| INSTALLED_AUTH="$INSTALLED_AUTH postgresql" |
| fi |
| |
| # Use SQLServer if database specified |
| if [ -n "$SQLSERVER_DATABASE" -o -n "$SQLSERVER_DATABASE_FILE" ]; then |
| associate_sqlserver |
| INSTALLED_AUTH="$INSTALLED_AUTH sqlserver" |
| fi |
| |
| # Use LDAP directory if specified |
| if [ -n "$LDAP_HOSTNAME" ]; then |
| associate_ldap |
| INSTALLED_AUTH="$INSTALLED_AUTH ldap" |
| fi |
| |
| # Use RADIUS server if specified |
| if [ -n "$RADIUS_SHARED_SECRET" ]; then |
| associate_radius |
| INSTALLED_AUTH="$INSTALLED_AUTH radius" |
| fi |
| |
| # Use OPENID if specified |
| if [ -n "$OPENID_AUTHORIZATION_ENDPOINT" ]; then |
| associate_openid |
| INSTALLED_AUTH="$INSTALLED_AUTH openid" |
| fi |
| |
| # Use SAML if specified |
| if [ -n "$SAML_IDP_METADATA_URL" ] || [ -n "$SAML_ENTITY_ID" -a -n "$SAML_CALLBACK_URL" ]; then |
| associate_saml |
| INSTALLED_AUTH="$INSTALLED_AUTH saml" |
| fi |
| |
| # Use TOTP if specified. |
| if [ "$TOTP_ENABLED" = "true" ]; then |
| associate_totp |
| fi |
| |
| # Use Duo if specified. |
| if [ -n "$DUO_API_HOSTNAME" ]; then |
| associate_duo |
| fi |
| |
| # Use header if specified. |
| if [ "$HEADER_ENABLED" = "true" ]; then |
| associate_header |
| fi |
| |
| # Use CAS if specified. |
| if [ -n "$CAS_AUTHORIZATION_ENDPOINT" ]; then |
| associate_cas |
| fi |
| |
| # Use json-auth if specified. |
| if [ -n "$JSON_SECRET_KEY" ]; then |
| associate_json |
| INSTALLED_AUTH="$INSTALLED_AUTH json" |
| fi |
| |
| # |
| # Validate that at least one authentication backend is installed |
| # |
| |
| if [ -z "$INSTALLED_AUTH" -a -z "$GUACAMOLE_HOME_TEMPLATE" ]; then |
| cat <<END |
| FATAL: No authentication configured |
| ------------------------------------------------------------------------------- |
| The Guacamole Docker container needs at least one authentication mechanism in |
| order to function, such as a MySQL database, PostgreSQL database, SQLServer |
| database, LDAP directory or RADIUS server. Please specify at least the |
| MYSQL_DATABASE or POSTGRESQL_DATABASE or SQLSERVER_DATABASE environment variables, |
| or check Guacamole's Docker documentation regarding configuring LDAP and/or |
| custom extensions. |
| END |
| exit 1; |
| fi |
| |
| # Set extension priority if specified |
| set_optional_property "extension-priority" "$EXTENSION_PRIORITY" |
| |
| # Use api-session-timeout if specified. |
| if [ -n "$API_SESSION_TIMEOUT" ]; then |
| associate_apisessiontimeout |
| fi |
| |
| # Maximum number of bytes to accept within the entity body of any particular HTTP request |
| set_optional_property "api-max-request-size" "$API_MAX_REQUEST_SIZE" |
| |
| # A comma-separated list of language keys to allow as display language |
| # choices within the Guacamole interface |
| set_optional_property "allowed-languages" "$ALLOWED_LANGUAGES" |
| |
| # If set to “true”, Guacamole will first evaluate its environment to obtain the value |
| # for any given configuration property, before using a value specified in |
| # guacamole.properties or falling back to a default value |
| set_optional_property "enable-environment-properties" "$ENABLE_ENVIRONMENT_PROPERTIES" |
| |
| |
| # Apply any overrides for default address ban behavior |
| set_optional_property "ban-address-duration" "$BAN_ADDRESS_DURATION" |
| set_optional_property "ban-max-addresses" "$BAN_MAX_ADDRESSES" |
| set_optional_property "ban-max-invalid-attempts" "$BAN_MAX_INVALID_ATTEMPTS" |
| |
| # Always load guacamole-auth-ban extension (automatic banning can be disabled |
| # through seting BAN_ADDRESS_DURATION to 0). As guacamole-auth-ban performs |
| # its banning by handling a pre-authentication event, it is guaranteed to |
| # perform its checks before all other auth processing and load order does not |
| # matter. |
| ln -s /opt/guacamole/ban/guacamole-auth-*.jar "$GUACAMOLE_EXT" |
| |
| # Set logback level if specified |
| if [ -n "$LOGBACK_LEVEL" ]; then |
| unzip -o -j /opt/guacamole/guacamole.war WEB-INF/classes/logback.xml -d $GUACAMOLE_HOME |
| sed -i "s/level=\"info\"/level=\"$LOGBACK_LEVEL\"/" $GUACAMOLE_HOME/logback.xml |
| fi |
| |
| # |
| # Finally start Guacamole (under Tomcat) |
| # |
| |
| start_guacamole |
