add Apache Guacamole support for RDP / VNC / SSH

[darkedges]

Is your feature request related to a problem? Please describe.
There is SSH support already, adding in RDP / VNC should not be too much to add. This would allow Windows Services to be accessed in the same way.

Describe the solution you'd like
Being able to define Apache Guacamole config or a pointer to said config where the passwords for RDP are managed via a Boundary request. i.e a user could request access to a RDP Session and get said access if they are authorized to. Behind the scenes it is using Hashicop Vault Active Directory Library support to roll the passwords for the request session.

Describe alternatives you've considered
I have started coding this for Hashicorp Vault, but going slowly due to other commitments. I have developed this previously for ForgeRock Identity Manager, but since Vault already has this functionality and Boundary now exists this makes an ideal place to move the functionality too.

Explain any additional use-cases
Apache Guacamole has the ability for VNC/RDP/SSH session recording already available, but this would fit in nicely for authentication.

Additional context
take a look at https://guacamole.apache.org/

[jefferai]

Keeping in mind I know nothing about Guacamole, can you explain this a bit more in terms of the flow? Right now Boundary can handle all of these as it's doing TCP proxying. I'm not sure where Guacamole fits into this -- it looks like it's a server that proxies a web app to remove machines. In that regard it seems like if you wanted Boundary to fit into the mix you'd have Guacamole invoke a Boundary authorization request and proxy as its transport to the endpoint.

[darkedges]

Perhaps I have misunderstood Boundary. Guacamole is a HTML 5 interface for RDP / VNC so it replaces the need to use a client to interface a machine, and therefore can be used by anybody with a HTML 5 compliant web browser.

However it relies on it knowing the credentials of the connection before hand, so this is where I see Boundary or Vault coming into the mix, as at least one of them has the ability to talk to Active Directory and change the password before it can be used. This is useful in break glass scenarios where I don;t want to give to admin 24/7 access to production machines, instead I can issue the password silently on demand to Guacamole to allow them to access the RDP Service.

I thought Boundary supplied that break glass / library capability, but I could be wrong, so that i can authorised users with an admin account access to services. I did not truly realise it was a proxy, instead thinking it updated the account details on the remote host to allow the service to jump start the authentication process with details of credentials on demand.

Perhaps this is more suited to Vault with its Check In / Out capability.

[jefferai]

Yep, based on your comment I think you're looking for Vault, not Boundary :-)

[LoboHacks]

Guacamoles in-browser SSH,RDP and VNC with session recording is what Boundary is missing IMHO.

Build that into Boundary and it can replace most PAM solutions out there.

[jboero]

Agreed. Guacamole added to the desktop UI also would be very useful and add support to any platform needed. This is the platform used by our Vault Professional exams and WWT's HashiCorp labs.

[AdamBouhmad]

Hey folks! Wanted to x-post to those in this thread that Boundary SSH Session Recording was released today: #695 (comment)

[adb014]

For those interested I’ve made a pull request to Guacamole for Hashicorp Vault integration