Additional properties must be added to guacamole.properties for Guacamole to load the LDAP support and for the LDAP support to properly connect to your LDAP server:

# Auth provider class
auth-provider: net.sourceforge.guacamole.net.auth.ldap.LDAPAuthenticationProvider

# LDAP properties
ldap-hostname:           localhost
ldap-port:               389
ldap-user-base-dn:       ou=people,dc=example,dc=net
ldap-username-attribute: uid
ldap-config-base-dn:     ou=groups,dc=example,dc=net

The LDAP support depends on the following properties, as shown in the example above:

With the above properties properly set, Guacamole will connect to your LDAP server after you restart Tomcat (or whatever servlet container you are using). You will still need to install the schema modifications to your LDAP server such that you can create new configurations and associated them with users.

Guacamole's LDAP support requires modifications to the standard LDAP schema, adding support for an additional object called guacConfigGroup. This object and its use will be explained in more detail later. For now, we must add support for this object to the LDAP directory through the provided schema file.

The schema/ directory contains two files: guacConfigGroup.schema, a standards-compliant file describing the schema, and guacConfigGroup.ldif, an LDIF file which was automatically generated from the .schema file specifically for update the schema of an OpenLDAP server. We will be working with guacConfigGroup.ldif. If you are not using OpenLDAP, your LDAP server should provide documentation for modifying its schema.

The guacConfigGroup object can be created using the ldapadd utility and the provided .ldif file:

# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f schema/guacConfigGroup.ldif
adding new entry "cn=guacConfigGroup,cn=schema,cn=config"

#

If the guacConfigGroup object was added successfully, you should see output as above. You can confirm the presence of the new object class using the ldapsearch utility:

# ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=schema,cn=config dn
dn: cn=schema,cn=config

dn: cn={0}core,cn=schema,cn=config

dn: cn={1}cosine,cn=schema,cn=config

dn: cn={2}nis,cn=schema,cn=config

dn: cn={3}inetorgperson,cn=schema,cn=config

dn: cn={4}guacConfigGroup,cn=schema,cn=config

#

All Guacamole users, as far as the LDAP support is concerned, are LDAP users with standard LDAP credentials. When a user signs in to Guacamole, their username and password will be used to bind to the LDAP server. If this bind operation is successful, the available connections are queried from the directory and the user is allowed in.

Each connection is represented by an instance of the guacConfigGroup object class, which is simply an extended version of the standard LDAP groupOfNames which provides a protocol and set of parameters. Only members of the guacConfigGroup will have access to the corresponding connection.

The guacConfigGroup object class provides two new attributes in addition to those provided by groupOfNames:

For example, to create a new VNC connection which connects to localhost at port 5900, while granting access to user1 and user2, you could create an .ldif file like the following:

dn: cn=Example Connection,ou=groups,dc=example,dc=net
objectClass: guacConfigGroup
objectClass: groupOfNames
cn: Example Connection
guacConfigProtocol: vnc
guacConfigParameter: hostname=localhost
guacConfigParameter: port=5900
guacConfigParameter: password=secret
member: cn=user1,ou=people,dc=example,dc=net
member: cn=user2,ou=people,dc=example,dc=net

The new connection can then be created using the ldapadd utility:

$ ldapadd -x -D cn=admin,dc=example,dc=net -W -f example-connection.ldif
Enter LDAP Password: 
adding new entry "cn=Example Connection,ou=groups,dc=example,dc=net"

$

Where cn=admin,dc=example,dc=net is an administrator account with permission to create new entries, and example-connection.ldif is the name of the .ldif file you just created.

There is, of course, no need to use only the standard LDAP utilities to create connections and users. There are useful graphical environments for manipulating LDAP directories, such as Apache Directory Studio, which make many of the tasks given above much easier.