mysql - guacamole LDAP 用户但没有 mysql 连接参数

Question

我目前正在努力对 MS AD(服务器 2012)和 MySQL 作为连接数据库进行 LDAP 授权。使用 AD 帐户 (sAMAccountName) 登录 Guacamole 后，我无法添加任何连接。

有什么我可能错过的吗？总的来说我不太想修改我们AD的方案。

也许你可以让我知道 guacamole.properties 文件应该有哪些设置。我也是0.9.9。 LDAP 和 MySQL 两种机制都可以自行运行，但尚未建立功能组合。

感谢您提前提供的帮助

Answer 1

为了让用户能够访问 MySQL 中的连接数据(或者能够在 MySQL 中创建和管理连接)，他们必须被授予在 MySQL 中执行此操作的权限。由于 Guacamole 使用用户名来代表身份，因此有两种方法可以实现此目的:

1. 在 LDAP 中创建一个与 MySQL 中现有管理用户具有相同用户名的帐户(例如默认的 guacadmin)，并在管理事物时以该用户身份登录.
2. 以管理用户身份登录 MySQL，并创建一个新的管理帐户，该帐户的用户名与您在 LDAP 中的帐户相同。注销并以该用户身份重新登录后，您将拥有管理员权限。

相关部分位于 the chapter of the manual covering LDAP :

Associating LDAP with a database

If you install both the LDAP authentication as well as support for MySQL or PostgreSQL (following the instructions in Chapter 6, Database authentication), Guacamole will automatically attempt to authenticate against both systems whenever a user attempts to log in. That user will have access to any data associated with them via the database, as well as any visible objects within the LDAP directory. The LDAP account will be considered equivalent to the database user if the username is identical.

Data can be manually associated with LDAP users by creating corresponding user accounts within the database which each have the same usernames as valid LDAP users. As long as the username is identical, a successful login attempt against LDAP will be trusted by the database authentication, and that user's associated data will be visible.

If an administrator account (such as the default guacadmin user provided with the database authentication) has a corresponding user in the LDAP directory with permission to list and read other LDAP users, the Guacamole administrative interface will include LDAP users in the overall user list presented to the administrator, and allow connections from the database to be associated with those users directly.

(强调)