doc/1.6.0/gug/sso.html - guacamole-website - Git at Google


 <!DOCTYPE html>


 <html lang="en" data-content_root="./" >

   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />

     <title>Authenticating with Guacamole using single sign-on &#8212; Apache Guacamole Manual v1.6.0</title>


   <script data-cfasync="false">
     document.documentElement.dataset.mode = localStorage.getItem("mode") || "";
     document.documentElement.dataset.theme = localStorage.getItem("theme") || "";
   </script>

   <!-- Loaded before other Sphinx assets -->
   <link href="_static/styles/theme.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />
 <link href="_static/styles/bootstrap.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />
 <link href="_static/styles/pydata-sphinx-theme.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />


   <link href="_static/vendor/fontawesome/6.5.2/css/all.min.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />
   <link rel="preload" as="font" type="font/woff2" crossorigin href="_static/vendor/fontawesome/6.5.2/webfonts/fa-solid-900.woff2" />
 <link rel="preload" as="font" type="font/woff2" crossorigin href="_static/vendor/fontawesome/6.5.2/webfonts/fa-brands-400.woff2" />
 <link rel="preload" as="font" type="font/woff2" crossorigin href="_static/vendor/fontawesome/6.5.2/webfonts/fa-regular-400.woff2" />

     <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=8f2a1f02" />
     <link rel="stylesheet" type="text/css" href="_static/styles/sphinx-book-theme.css?v=eba8b062" />
     <link rel="stylesheet" type="text/css" href="_static/copybutton.css?v=76b2166b" />
     <link rel="stylesheet" type="text/css" href="_static/tabs.css?v=4c969af8" />
     <link rel="stylesheet" type="text/css" href="_static/gug.css?v=475feb7f" />

   <!-- Pre-loaded scripts that we'll load fully later -->
   <link rel="preload" as="script" href="_static/scripts/bootstrap.js?digest=dfe6caa3a7d634c4db9b" />
 <link rel="preload" as="script" href="_static/scripts/pydata-sphinx-theme.js?digest=dfe6caa3a7d634c4db9b" />
   <script src="_static/vendor/fontawesome/6.5.2/js/all.min.js?digest=dfe6caa3a7d634c4db9b"></script>

     <script src="_static/documentation_options.js?v=9eb32ce0"></script>
     <script src="_static/doctools.js?v=9bcbadda"></script>
     <script src="_static/sphinx_highlight.js?v=dc90522c"></script>
     <script src="_static/clipboard.min.js?v=a7894cd8"></script>
     <script src="_static/copybutton.js?v=c136e461"></script>
     <script src="_static/tabs.js?v=3ee01567"></script>
     <script src="_static/scripts/sphinx-book-theme.js?v=887ef09a"></script>
     <script>DOCUMENTATION_OPTIONS.pagename = 'sso';</script>
     <link rel="index" title="Index" href="genindex.html" />
     <link rel="search" title="Search" href="search.html" />
     <link rel="next" title="Using CAS for single sign-on" href="cas-auth.html" />
     <link rel="prev" title="Using TOTP for multi-factor authentication" href="totp-auth.html" />
   <meta name="viewport" content="width=device-width, initial-scale=1"/>
   <meta name="docsearch:language" content="en"/>
   </head>


   <body data-bs-spy="scroll" data-bs-target=".bd-toc-nav" data-offset="180" data-bs-root-margin="0px 0px -60%" data-default-mode="">


   <div id="pst-skip-link" class="skip-link d-print-none"><a href="#main-content">Skip to main content</a></div>

   <div id="pst-scroll-pixel-helper"></div>

   <button type="button" class="btn rounded-pill" id="pst-back-to-top">
     <i class="fa-solid fa-arrow-up"></i>Back to top</button>


   <input type="checkbox"
           class="sidebar-toggle"
           id="pst-primary-sidebar-checkbox"/>
   <label class="overlay overlay-primary" for="pst-primary-sidebar-checkbox"></label>

   <input type="checkbox"
           class="sidebar-toggle"
           id="pst-secondary-sidebar-checkbox"/>
   <label class="overlay overlay-secondary" for="pst-secondary-sidebar-checkbox"></label>

   <div class="search-button__wrapper">
     <div class="search-button__overlay"></div>
     <div class="search-button__search-container">
 <form class="bd-search d-flex align-items-center"
       action="search.html"
       method="get">
   <i class="fa-solid fa-magnifying-glass"></i>
   <input type="search"
          class="form-control"
          name="q"
          id="search-input"
          placeholder="Search..."
          aria-label="Search..."
          autocomplete="off"
          autocorrect="off"
          autocapitalize="off"
          spellcheck="false"/>
   <span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd>K</kbd></span>
 </form></div>
   </div>

   <div class="pst-async-banner-revealer d-none">
   <aside id="bd-header-version-warning" class="d-none d-print-none" aria-label="Version warning"></aside>
 </div>


     <header class="bd-header navbar navbar-expand-lg bd-navbar d-print-none">
     </header>


   <div class="bd-container">
     <div class="bd-container__inner bd-page-width">


       <div class="bd-sidebar-primary bd-sidebar">


   <div class="sidebar-header-items sidebar-primary__section">


   </div>

     <div class="sidebar-primary-items__start sidebar-primary__section">
         <div class="sidebar-primary-item">


 <a class="navbar-brand logo" href="index.html">


     <p class="title logo__title">Apache Guacamole Manual v1.6.0</p>

 </a></div>
         <div class="sidebar-primary-item">

  <script>
  document.write(`
    <button class="btn search-button-field search-button__button" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
     <i class="fa-solid fa-magnifying-glass"></i>
     <span class="search-button__default-text">Search</span>
     <span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
    </button>
  `);
  </script></div>
         <div class="sidebar-primary-item"><nav class="bd-links bd-docs-nav" aria-label="Main">
     <div class="bd-toc-item navbar-nav active">
         <p aria-level="2" class="caption" role="heading"><span class="caption-text">Getting Started</span></p>
 <ul class="nav bd-sidenav">
 <li class="toctree-l1"><a class="reference internal" href="introduction.html">Introduction</a></li>
 <li class="toctree-l1"><a class="reference internal" href="guacamole-architecture.html">Implementation and architecture</a></li>
 <li class="toctree-l1 has-children"><a class="reference internal" href="installing-guacamole.html">Installing Guacamole</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
 <li class="toctree-l2"><a class="reference internal" href="guacamole-native.html">Native installation</a></li>
 <li class="toctree-l2"><a class="reference internal" href="guacamole-docker.html">Containerized (Docker) installation</a></li>
 </ul>
 </details></li>
 <li class="toctree-l1 has-children"><a class="reference internal" href="jdbc-auth.html">Database setup</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
 <li class="toctree-l2"><a class="reference internal" href="mysql-auth.html">MariaDB / MySQL</a></li>
 <li class="toctree-l2"><a class="reference internal" href="postgresql-auth.html">PostgreSQL</a></li>
 <li class="toctree-l2"><a class="reference internal" href="sqlserver-auth.html">SQL Server</a></li>
 </ul>
 </details></li>
 <li class="toctree-l1 has-children"><a class="reference internal" href="security.html">Securing a Guacamole install</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
 <li class="toctree-l2"><a class="reference internal" href="reverse-proxy.html">SSL termination</a></li>
 <li class="toctree-l2"><a class="reference internal" href="auth-ban.html">Blocking brute-force attacks</a></li>
 </ul>
 </details></li>
 </ul>
 <p aria-level="2" class="caption" role="heading"><span class="caption-text">Using Guacamole</span></p>
 <ul class="nav bd-sidenav">
 <li class="toctree-l1"><a class="reference internal" href="configuring-guacamole.html">Configuration</a></li>
 <li class="toctree-l1"><a class="reference internal" href="using-guacamole.html">General usage</a></li>
 <li class="toctree-l1 has-children"><a class="reference internal" href="administration.html">Administration</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
 <li class="toctree-l2"><a class="reference internal" href="batch-import.html">Importing connections</a></li>
 </ul>
 </details></li>
 <li class="toctree-l1"><a class="reference internal" href="troubleshooting.html">Troubleshooting</a></li>
 </ul>
 <p aria-level="2" class="caption" role="heading"><span class="caption-text">Extensions</span></p>
 <ul class="current nav bd-sidenav">
 <li class="toctree-l1"><a class="reference internal" href="ldap-auth.html">Active Directory / LDAP</a></li>
 <li class="toctree-l1 has-children"><a class="reference internal" href="mfa.html">Multi-factor authentication</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
 <li class="toctree-l2"><a class="reference internal" href="duo-auth.html">Duo</a></li>
 <li class="toctree-l2"><a class="reference internal" href="totp-auth.html">TOTP</a></li>
 </ul>
 </details></li>
 <li class="toctree-l1 current active has-children"><a class="current reference internal" href="#">Single sign-on</a><details open="open"><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
 <li class="toctree-l2"><a class="reference internal" href="cas-auth.html">CAS</a></li>
 <li class="toctree-l2"><a class="reference internal" href="openid-auth.html">OpenID Connect</a></li>
 <li class="toctree-l2"><a class="reference internal" href="saml-auth.html">SAML</a></li>
 <li class="toctree-l2"><a class="reference internal" href="ssl-auth.html">Smart cards / Certificates</a></li>
 </ul>
 </details></li>
 <li class="toctree-l1"><a class="reference internal" href="vault.html">Retrieving secrets from a vault</a></li>
 <li class="toctree-l1 has-children"><a class="reference internal" href="external-auth.html">External authentication</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
 <li class="toctree-l2"><a class="reference internal" href="json-auth.html">Encrypted, signed JSON</a></li>
 <li class="toctree-l2"><a class="reference internal" href="header-auth.html">HTTP header</a></li>
 </ul>
 </details></li>
 <li class="toctree-l1"><a class="reference internal" href="radius-auth.html">RADIUS</a></li>
 <li class="toctree-l1"><a class="reference internal" href="adhoc-connections.html">Ad-hoc connections</a></li>
 <li class="toctree-l1"><a class="reference internal" href="auth-restrict.html">Login / Connection restrictions</a></li>
 <li class="toctree-l1"><a class="reference internal" href="recording-playback.html">Session recording player</a></li>
 </ul>
 <p aria-level="2" class="caption" role="heading"><span class="caption-text">Developer's Guide</span></p>
 <ul class="nav bd-sidenav">
 <li class="toctree-l1"><a class="reference internal" href="guacamole-protocol.html">The Guacamole protocol</a></li>
 <li class="toctree-l1"><a class="reference internal" href="libguac.html">libguac</a></li>
 <li class="toctree-l1"><a class="reference internal" href="guacamole-common.html">guacamole-common</a></li>
 <li class="toctree-l1"><a class="reference internal" href="guacamole-common-js.html">guacamole-common-js</a></li>
 <li class="toctree-l1"><a class="reference internal" href="guacamole-ext.html">guacamole-ext</a></li>
 <li class="toctree-l1"><a class="reference internal" href="custom-protocols.html">Adding new protocols</a></li>
 <li class="toctree-l1"><a class="reference internal" href="custom-auth.html">Custom authentication</a></li>
 <li class="toctree-l1"><a class="reference internal" href="event-listeners.html">Event listeners</a></li>
 <li class="toctree-l1"><a class="reference internal" href="writing-you-own-guacamole-app.html">Writing your own Guacamole application</a></li>
 </ul>
 <p aria-level="2" class="caption" role="heading"><span class="caption-text">Appendices</span></p>
 <ul class="nav bd-sidenav">
 <li class="toctree-l1"><a class="reference internal" href="protocol-reference.html">Guacamole protocol reference</a></li>
 <li class="toctree-l1"><a class="reference internal" href="jdbc-auth-schema.html">Database schema reference</a></li>
 </ul>

     </div>
 </nav></div>
     </div>


   <div class="sidebar-primary-items__end sidebar-primary__section">
   </div>

   <div id="rtd-footer-container"></div>


       </div>

       <main id="main-content" class="bd-main" role="main">


 <div class="sbt-scroll-pixel-helper"></div>

           <div class="bd-content">
             <div class="bd-article-container">

               <div class="bd-header-article d-print-none">
 <div class="header-article-items header-article__inner">

     <div class="header-article-items__start">

         <div class="header-article-item"><button class="sidebar-toggle primary-toggle btn btn-sm" title="Toggle primary sidebar" data-bs-placement="bottom" data-bs-toggle="tooltip">
   <span class="fa-solid fa-bars"></span>
 </button></div>

     </div>


     <div class="header-article-items__end">

         <div class="header-article-item">

 <div class="article-header-buttons">


 <button onclick="toggleFullScreen()"
   class="btn btn-sm btn-fullscreen-button"
   title="Fullscreen mode"
   data-bs-placement="bottom" data-bs-toggle="tooltip"
 >


 <span class="btn__icon-container">
   <i class="fas fa-expand"></i>
   </span>

 </button>


 <script>
 document.write(`
   <button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button" title="light/dark" aria-label="light/dark" data-bs-placement="bottom" data-bs-toggle="tooltip">
     <i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light"></i>
     <i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark"></i>
     <i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto"></i>
   </button>
 `);
 </script>


 <script>
 document.write(`
   <button class="btn btn-sm pst-navbar-icon search-button search-button__button" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
     <i class="fa-solid fa-magnifying-glass fa-lg"></i>
   </button>
 `);
 </script>

 </div></div>

     </div>

 </div>
 </div>


 <div id="jb-print-docs-body" class="onlyprint">
     <h1>Authenticating with Guacamole using single sign-on</h1>
     <!-- Table of contents -->
     <div id="print-main-content">
         <div id="jb-print-toc">

         </div>
     </div>
 </div>


 <div id="searchbox"></div>
                 <article class="bd-article">

   <section id="authenticating-with-guacamole-using-single-sign-on">
 <h1>Authenticating with Guacamole using single sign-on<a class="headerlink" href="#authenticating-with-guacamole-using-single-sign-on" title="Link to this heading">#</a></h1>
 <div class="toctree-wrapper compound">
 </div>
 <p>Single sign-on alows you to leverage a third-party authentication service that
 can be shared by multiple applications, including Guacamole. This has the
 benefit of streamlining and centralizing authentication when users would
 otherwise need to maintain a distinct set of credentials for each application.
 Guacamole supports the following single sign-on methods:</p>
 <dl class="simple myst">
 <dt><a class="reference internal" href="cas-auth.html"><span class="doc std std-doc">CAS</span></a></dt><dd><p>An open source single sign-on application that implements its own
 authentication protocol.</p>
 </dd>
 <dt><a class="reference internal" href="openid-auth.html"><span class="doc std std-doc">OpenID Connect</span></a> and <a class="reference internal" href="saml-auth.html"><span class="doc std std-doc">SAML</span></a></dt><dd><p>Widely supported open standards for single sign-on. It is extremely common
 for commercial identity providers to support at least one of these standards.</p>
 </dd>
 <dt><a class="reference internal" href="ssl-auth.html"><span class="doc std std-doc">Smart cards / Certificates</span></a></dt><dd><p>User identification using certificates that are installed on the user’s
 machine or within smart cards presented by the user. The user identity is
 derived from the content of the certificate presented, if valid. This
 mechanism makes use of SSL/TLS client authentication via a <a class="reference internal" href="reverse-proxy.html"><span class="doc std std-doc">reverse
 proxy</span></a>.</p>
 </dd>
 </dl>
 <div class="admonition hint">
 <p class="admonition-title">Hint</p>
 <p>OpenID Connect is commonly confused with “OAuth”, with the term “OAuth”
 sometimes used incorrectly to refer to OpenID Connect.</p>
 </div>
 </section>


                 </article>


                 <footer class="prev-next-footer d-print-none">

 <div class="prev-next-area">
     <a class="left-prev"
        href="totp-auth.html"
        title="previous page">
       <i class="fa-solid fa-angle-left"></i>
       <div class="prev-next-info">
         <p class="prev-next-subtitle">previous</p>
         <p class="prev-next-title">Using TOTP for multi-factor authentication</p>
       </div>
     </a>
     <a class="right-next"
        href="cas-auth.html"
        title="next page">
       <div class="prev-next-info">
         <p class="prev-next-subtitle">next</p>
         <p class="prev-next-title">Using CAS for single sign-on</p>
       </div>
       <i class="fa-solid fa-angle-right"></i>
     </a>
 </div>
                 </footer>

             </div>


           </div>
           <footer class="bd-footer-content">

 <div class="bd-footer-content__inner container">

   <div class="footer-item">

 <p class="component-author">
 By The Apache Software Foundation
 </p>

   </div>

   <div class="footer-item">


   <p class="copyright">

       © Copyright 2025 The Apache Software Foundation.
       <br/>

   </p>

   </div>

   <div class="footer-item">

   </div>

   <div class="footer-item">

   </div>

 </div>
           </footer>


       </main>
     </div>
   </div>

   <!-- Scripts loaded after <body> so the DOM is not blocked -->
   <script src="_static/scripts/bootstrap.js?digest=dfe6caa3a7d634c4db9b"></script>
 <script src="_static/scripts/pydata-sphinx-theme.js?digest=dfe6caa3a7d634c4db9b"></script>

   <footer class="bd-footer">
   </footer>
   </body>
 </html>

	<!DOCTYPE html>


	<html lang="en" data-content_root="./" >

	<head>
	<meta charset="utf-8" />
	<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />

	<title>Authenticating with Guacamole using single sign-on — Apache Guacamole Manual v1.6.0</title>



	<script data-cfasync="false">
	document.documentElement.dataset.mode = localStorage.getItem("mode") \|\| "";
	document.documentElement.dataset.theme = localStorage.getItem("theme") \|\| "";
	</script>

	<!-- Loaded before other Sphinx assets -->
	<link href="_static/styles/theme.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />
	<link href="_static/styles/bootstrap.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />
	<link href="_static/styles/pydata-sphinx-theme.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />


	<link href="_static/vendor/fontawesome/6.5.2/css/all.min.css?digest=dfe6caa3a7d634c4db9b" rel="stylesheet" />
	<link rel="preload" as="font" type="font/woff2" crossorigin href="_static/vendor/fontawesome/6.5.2/webfonts/fa-solid-900.woff2" />
	<link rel="preload" as="font" type="font/woff2" crossorigin href="_static/vendor/fontawesome/6.5.2/webfonts/fa-brands-400.woff2" />
	<link rel="preload" as="font" type="font/woff2" crossorigin href="_static/vendor/fontawesome/6.5.2/webfonts/fa-regular-400.woff2" />

	<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=8f2a1f02" />
	<link rel="stylesheet" type="text/css" href="_static/styles/sphinx-book-theme.css?v=eba8b062" />
	<link rel="stylesheet" type="text/css" href="_static/copybutton.css?v=76b2166b" />
	<link rel="stylesheet" type="text/css" href="_static/tabs.css?v=4c969af8" />
	<link rel="stylesheet" type="text/css" href="_static/gug.css?v=475feb7f" />

	<!-- Pre-loaded scripts that we'll load fully later -->
	<link rel="preload" as="script" href="_static/scripts/bootstrap.js?digest=dfe6caa3a7d634c4db9b" />
	<link rel="preload" as="script" href="_static/scripts/pydata-sphinx-theme.js?digest=dfe6caa3a7d634c4db9b" />
	<script src="_static/vendor/fontawesome/6.5.2/js/all.min.js?digest=dfe6caa3a7d634c4db9b"></script>

	<script src="_static/documentation_options.js?v=9eb32ce0"></script>
	<script src="_static/doctools.js?v=9bcbadda"></script>
	<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
	<script src="_static/clipboard.min.js?v=a7894cd8"></script>
	<script src="_static/copybutton.js?v=c136e461"></script>
	<script src="_static/tabs.js?v=3ee01567"></script>
	<script src="_static/scripts/sphinx-book-theme.js?v=887ef09a"></script>
	<script>DOCUMENTATION_OPTIONS.pagename = 'sso';</script>
	<link rel="index" title="Index" href="genindex.html" />
	<link rel="search" title="Search" href="search.html" />
	<link rel="next" title="Using CAS for single sign-on" href="cas-auth.html" />
	<link rel="prev" title="Using TOTP for multi-factor authentication" href="totp-auth.html" />
	<meta name="viewport" content="width=device-width, initial-scale=1"/>
	<meta name="docsearch:language" content="en"/>
	</head>


	<body data-bs-spy="scroll" data-bs-target=".bd-toc-nav" data-offset="180" data-bs-root-margin="0px 0px -60%" data-default-mode="">



	<div id="pst-skip-link" class="skip-link d-print-none"><a href="#main-content">Skip to main content</a></div>

	<div id="pst-scroll-pixel-helper"></div>

	<button type="button" class="btn rounded-pill" id="pst-back-to-top">
	<i class="fa-solid fa-arrow-up"></i>Back to top</button>


	<input type="checkbox"
	class="sidebar-toggle"
	id="pst-primary-sidebar-checkbox"/>
	<label class="overlay overlay-primary" for="pst-primary-sidebar-checkbox"></label>

	<input type="checkbox"
	class="sidebar-toggle"
	id="pst-secondary-sidebar-checkbox"/>
	<label class="overlay overlay-secondary" for="pst-secondary-sidebar-checkbox"></label>

	<div class="search-button__wrapper">
	<div class="search-button__overlay"></div>
	<div class="search-button__search-container">
	<form class="bd-search d-flex align-items-center"
	action="search.html"
	method="get">
	<i class="fa-solid fa-magnifying-glass"></i>
	<input type="search"
	class="form-control"
	name="q"
	id="search-input"
	placeholder="Search..."
	aria-label="Search..."
	autocomplete="off"
	autocorrect="off"
	autocapitalize="off"
	spellcheck="false"/>
	<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd>K</kbd></span>
	</form></div>
	</div>

	<div class="pst-async-banner-revealer d-none">
	<aside id="bd-header-version-warning" class="d-none d-print-none" aria-label="Version warning"></aside>
	</div>


	<header class="bd-header navbar navbar-expand-lg bd-navbar d-print-none">
	</header>


	<div class="bd-container">
	<div class="bd-container__inner bd-page-width">



	<div class="bd-sidebar-primary bd-sidebar">



	<div class="sidebar-header-items sidebar-primary__section">




	</div>

	<div class="sidebar-primary-items__start sidebar-primary__section">
	<div class="sidebar-primary-item">





	<a class="navbar-brand logo" href="index.html">






	<p class="title logo__title">Apache Guacamole Manual v1.6.0</p>

	</a></div>
	<div class="sidebar-primary-item">

	<script>
	document.write(`
	<button class="btn search-button-field search-button__button" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
	<i class="fa-solid fa-magnifying-glass"></i>
	<span class="search-button__default-text">Search</span>
	<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
	</button>
	`);
	</script></div>
	<div class="sidebar-primary-item"><nav class="bd-links bd-docs-nav" aria-label="Main">
	<div class="bd-toc-item navbar-nav active">
	<p aria-level="2" class="caption" role="heading"><span class="caption-text">Getting Started</span></p>
	<ul class="nav bd-sidenav">
	<li class="toctree-l1"><a class="reference internal" href="introduction.html">Introduction</a></li>
	<li class="toctree-l1"><a class="reference internal" href="guacamole-architecture.html">Implementation and architecture</a></li>
	<li class="toctree-l1 has-children"><a class="reference internal" href="installing-guacamole.html">Installing Guacamole</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
	<li class="toctree-l2"><a class="reference internal" href="guacamole-native.html">Native installation</a></li>
	<li class="toctree-l2"><a class="reference internal" href="guacamole-docker.html">Containerized (Docker) installation</a></li>
	</ul>
	</details></li>
	<li class="toctree-l1 has-children"><a class="reference internal" href="jdbc-auth.html">Database setup</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
	<li class="toctree-l2"><a class="reference internal" href="mysql-auth.html">MariaDB / MySQL</a></li>
	<li class="toctree-l2"><a class="reference internal" href="postgresql-auth.html">PostgreSQL</a></li>
	<li class="toctree-l2"><a class="reference internal" href="sqlserver-auth.html">SQL Server</a></li>
	</ul>
	</details></li>
	<li class="toctree-l1 has-children"><a class="reference internal" href="security.html">Securing a Guacamole install</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
	<li class="toctree-l2"><a class="reference internal" href="reverse-proxy.html">SSL termination</a></li>
	<li class="toctree-l2"><a class="reference internal" href="auth-ban.html">Blocking brute-force attacks</a></li>
	</ul>
	</details></li>
	</ul>
	<p aria-level="2" class="caption" role="heading"><span class="caption-text">Using Guacamole</span></p>
	<ul class="nav bd-sidenav">
	<li class="toctree-l1"><a class="reference internal" href="configuring-guacamole.html">Configuration</a></li>
	<li class="toctree-l1"><a class="reference internal" href="using-guacamole.html">General usage</a></li>
	<li class="toctree-l1 has-children"><a class="reference internal" href="administration.html">Administration</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
	<li class="toctree-l2"><a class="reference internal" href="batch-import.html">Importing connections</a></li>
	</ul>
	</details></li>
	<li class="toctree-l1"><a class="reference internal" href="troubleshooting.html">Troubleshooting</a></li>
	</ul>
	<p aria-level="2" class="caption" role="heading"><span class="caption-text">Extensions</span></p>
	<ul class="current nav bd-sidenav">
	<li class="toctree-l1"><a class="reference internal" href="ldap-auth.html">Active Directory / LDAP</a></li>
	<li class="toctree-l1 has-children"><a class="reference internal" href="mfa.html">Multi-factor authentication</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
	<li class="toctree-l2"><a class="reference internal" href="duo-auth.html">Duo</a></li>
	<li class="toctree-l2"><a class="reference internal" href="totp-auth.html">TOTP</a></li>
	</ul>
	</details></li>
	<li class="toctree-l1 current active has-children"><a class="current reference internal" href="#">Single sign-on</a><details open="open"><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
	<li class="toctree-l2"><a class="reference internal" href="cas-auth.html">CAS</a></li>
	<li class="toctree-l2"><a class="reference internal" href="openid-auth.html">OpenID Connect</a></li>
	<li class="toctree-l2"><a class="reference internal" href="saml-auth.html">SAML</a></li>
	<li class="toctree-l2"><a class="reference internal" href="ssl-auth.html">Smart cards / Certificates</a></li>
	</ul>
	</details></li>
	<li class="toctree-l1"><a class="reference internal" href="vault.html">Retrieving secrets from a vault</a></li>
	<li class="toctree-l1 has-children"><a class="reference internal" href="external-auth.html">External authentication</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
	<li class="toctree-l2"><a class="reference internal" href="json-auth.html">Encrypted, signed JSON</a></li>
	<li class="toctree-l2"><a class="reference internal" href="header-auth.html">HTTP header</a></li>
	</ul>
	</details></li>
	<li class="toctree-l1"><a class="reference internal" href="radius-auth.html">RADIUS</a></li>
	<li class="toctree-l1"><a class="reference internal" href="adhoc-connections.html">Ad-hoc connections</a></li>
	<li class="toctree-l1"><a class="reference internal" href="auth-restrict.html">Login / Connection restrictions</a></li>
	<li class="toctree-l1"><a class="reference internal" href="recording-playback.html">Session recording player</a></li>
	</ul>
	<p aria-level="2" class="caption" role="heading"><span class="caption-text">Developer's Guide</span></p>
	<ul class="nav bd-sidenav">
	<li class="toctree-l1"><a class="reference internal" href="guacamole-protocol.html">The Guacamole protocol</a></li>
	<li class="toctree-l1"><a class="reference internal" href="libguac.html">libguac</a></li>
	<li class="toctree-l1"><a class="reference internal" href="guacamole-common.html">guacamole-common</a></li>
	<li class="toctree-l1"><a class="reference internal" href="guacamole-common-js.html">guacamole-common-js</a></li>
	<li class="toctree-l1"><a class="reference internal" href="guacamole-ext.html">guacamole-ext</a></li>
	<li class="toctree-l1"><a class="reference internal" href="custom-protocols.html">Adding new protocols</a></li>
	<li class="toctree-l1"><a class="reference internal" href="custom-auth.html">Custom authentication</a></li>
	<li class="toctree-l1"><a class="reference internal" href="event-listeners.html">Event listeners</a></li>
	<li class="toctree-l1"><a class="reference internal" href="writing-you-own-guacamole-app.html">Writing your own Guacamole application</a></li>
	</ul>
	<p aria-level="2" class="caption" role="heading"><span class="caption-text">Appendices</span></p>
	<ul class="nav bd-sidenav">
	<li class="toctree-l1"><a class="reference internal" href="protocol-reference.html">Guacamole protocol reference</a></li>
	<li class="toctree-l1"><a class="reference internal" href="jdbc-auth-schema.html">Database schema reference</a></li>
	</ul>

	</div>
	</nav></div>
	</div>


	<div class="sidebar-primary-items__end sidebar-primary__section">
	</div>

	<div id="rtd-footer-container"></div>


	</div>

	<main id="main-content" class="bd-main" role="main">



	<div class="sbt-scroll-pixel-helper"></div>

	<div class="bd-content">
	<div class="bd-article-container">

	<div class="bd-header-article d-print-none">
	<div class="header-article-items header-article__inner">

	<div class="header-article-items__start">

	<div class="header-article-item"><button class="sidebar-toggle primary-toggle btn btn-sm" title="Toggle primary sidebar" data-bs-placement="bottom" data-bs-toggle="tooltip">
	<span class="fa-solid fa-bars"></span>
	</button></div>

	</div>


	<div class="header-article-items__end">

	<div class="header-article-item">

	<div class="article-header-buttons">



	<button onclick="toggleFullScreen()"
	class="btn btn-sm btn-fullscreen-button"
	title="Fullscreen mode"
	data-bs-placement="bottom" data-bs-toggle="tooltip"
	>


	<span class="btn__icon-container">
	<i class="fas fa-expand"></i>
	</span>

	</button>



	<script>
	document.write(`
	<button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button" title="light/dark" aria-label="light/dark" data-bs-placement="bottom" data-bs-toggle="tooltip">
	<i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light"></i>
	<i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark"></i>
	<i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto"></i>
	</button>
	`);
	</script>


	<script>
	document.write(`
	<button class="btn btn-sm pst-navbar-icon search-button search-button__button" title="Search" aria-label="Search" data-bs-placement="bottom" data-bs-toggle="tooltip">
	<i class="fa-solid fa-magnifying-glass fa-lg"></i>
	</button>
	`);
	</script>

	</div></div>

	</div>

	</div>
	</div>



	<div id="jb-print-docs-body" class="onlyprint">
	<h1>Authenticating with Guacamole using single sign-on</h1>
	<!-- Table of contents -->
	<div id="print-main-content">
	<div id="jb-print-toc">

	</div>
	</div>
	</div>



	<div id="searchbox"></div>
	<article class="bd-article">

	<section id="authenticating-with-guacamole-using-single-sign-on">
	<h1>Authenticating with Guacamole using single sign-on<a class="headerlink" href="#authenticating-with-guacamole-using-single-sign-on" title="Link to this heading">#</a></h1>
	<div class="toctree-wrapper compound">
	</div>
	<p>Single sign-on alows you to leverage a third-party authentication service that
	can be shared by multiple applications, including Guacamole. This has the
	benefit of streamlining and centralizing authentication when users would
	otherwise need to maintain a distinct set of credentials for each application.
	Guacamole supports the following single sign-on methods:</p>
	<dl class="simple myst">
	<dt><a class="reference internal" href="cas-auth.html"><span class="doc std std-doc">CAS</span></a></dt><dd><p>An open source single sign-on application that implements its own
	authentication protocol.</p>
	</dd>
	<dt><a class="reference internal" href="openid-auth.html"><span class="doc std std-doc">OpenID Connect</span></a> and <a class="reference internal" href="saml-auth.html"><span class="doc std std-doc">SAML</span></a></dt><dd><p>Widely supported open standards for single sign-on. It is extremely common
	for commercial identity providers to support at least one of these standards.</p>
	</dd>
	<dt><a class="reference internal" href="ssl-auth.html"><span class="doc std std-doc">Smart cards / Certificates</span></a></dt><dd><p>User identification using certificates that are installed on the user’s
	machine or within smart cards presented by the user. The user identity is
	derived from the content of the certificate presented, if valid. This
	mechanism makes use of SSL/TLS client authentication via a <a class="reference internal" href="reverse-proxy.html"><span class="doc std std-doc">reverse
	proxy</span></a>.</p>
	</dd>
	</dl>
	<div class="admonition hint">
	<p class="admonition-title">Hint</p>
	<p>OpenID Connect is commonly confused with “OAuth”, with the term “OAuth”
	sometimes used incorrectly to refer to OpenID Connect.</p>
	</div>
	</section>


	</article>






	<footer class="prev-next-footer d-print-none">

	<div class="prev-next-area">
	<a class="left-prev"
	href="totp-auth.html"
	title="previous page">
	<i class="fa-solid fa-angle-left"></i>
	<div class="prev-next-info">
	<p class="prev-next-subtitle">previous</p>
	<p class="prev-next-title">Using TOTP for multi-factor authentication</p>
	</div>
	</a>
	<a class="right-next"
	href="cas-auth.html"
	title="next page">
	<div class="prev-next-info">
	<p class="prev-next-subtitle">next</p>
	<p class="prev-next-title">Using CAS for single sign-on</p>
	</div>
	<i class="fa-solid fa-angle-right"></i>
	</a>
	</div>
	</footer>

	</div>




	</div>
	<footer class="bd-footer-content">

	<div class="bd-footer-content__inner container">

	<div class="footer-item">

	<p class="component-author">
	By The Apache Software Foundation
	</p>

	</div>

	<div class="footer-item">


	<p class="copyright">

	© Copyright 2025 The Apache Software Foundation.
	<br/>

	</p>

	</div>

	<div class="footer-item">

	</div>

	<div class="footer-item">

	</div>

	</div>
	</footer>


	</main>
	</div>
	</div>

	<!-- Scripts loaded after <body> so the DOM is not blocked -->
	<script src="_static/scripts/bootstrap.js?digest=dfe6caa3a7d634c4db9b"></script>
	<script src="_static/scripts/pydata-sphinx-theme.js?digest=dfe6caa3a7d634c4db9b"></script>

	<footer class="bd-footer">
	</footer>
	</body>
	</html>