CLOUDRON 10 - OpenID Broken for Guacamole

[SDEInfo]

Hello,

Following the auto update of Cloudron to version 10, my external Guacamole instance (connection via OpenID) has become inaccessible.

I am receiving the following error: error=invalid_request&error_description=requested+response_type+is+not+allowed+for+this+client&iss=https://my.sdeinfo.com/openid

This error is preventing any external connection.
I request a quick intervention to resolve or a simple answer this configuration issue following the update.

Sincerely.

[girish]

@sdeinfo Thanks for reporting. The fix for this is already in Cloudron 10.1.6 which we hope to push out later today. After updating Cloudron, you have to update Guacamole (2.5.3) which will fix the login.

For some background: We have been doing lots of security audits around our SSO. OpenID has various login flows. The so-called "implicit flow" is insecure and deprecated in OpenID. I think Guacamole is the only app which is still using this flow, and we have added an exception in 10.1.6 just to keep it working.

[SDEInfo]

Hello,

Thank you for your response, I understand there is a compatibility issue, but disabling it during an update significantly handicapped me.

I use Guacamole on a server external to Cloudron (for historical reasons), how can I extend this exception to my instance? We need to be able to restore this (very quickly) for my users.

[joseph]

@sdeinfo 10.1.6 is already available. Update to it and then update guacamole.

[SDEInfo]

I performed the update and updated my Guacamole instance.

I even created a new OpenID profile and updated the external Docker Guacamole instance.

Same incident

How do I fix this?

[girish]

@SDEInfo sorry my bad, I am just reading your initial report correctly now. The issue is not related to Cloudron's guacamole package but the custom OIDC Client that you are using with an external guacamole.

Indeed, this is broken. I assumed such clients don't exist anymore and removed support for it. But I can give you a patch, give me some time.

[girish]

@sdeinfo you can try this. Edit the file /home/yellowtent/platform/box/src/oidcserver.js . Around line 167, change this block with these two lines:

} else {
    tmp.redirect_uris = client.loginRedirectUri.split(',').map(s => s.trim());
    // ADD THESE TWO LINES
    tmp.response_types = [ 'code', 'id_token' ];
    tmp.grant_types = [ 'authorization_code', 'implicit', 'refresh_token' ];
}

After that, systemctl restart box . It should work after. Can you please check?

[SDEInfo]

@girish Thank you for the patch, I applied it to my server and it is now operational.

I was very surprised by the removal of implicit mode because my reference is based on the ".well-known/openid-configuration" file which still contains "implicit" in the options.

Will this patch be permanent or do I have to panic every time I update Cloudron?

[girish]

@sdeinfo OIDC Implicit flow has been deprecated for a while now and should not be used in new applications - https://oauth.net/2/grant-types/implicit/ . In fact, in the over 200 packages we maintain only one app uses implicit flow. Yup, guacamole. I very reluctantly added a hack in the manifest to get that package working.

I found that a fix is being worked on upstream - https://github.com/apache/guacamole-client/pull/1219 . You can also try https://github.com/Gerry9000/guacamole-auth-sso-oauth2 which fixes this exact issue . We will be moving to that repo shortly if upstream doesn't fix it soonish.