0.5.0

deploy/.env.example

@@ -6,4 +6,5 @@ SESSIONGUARD_DB_PASSWORD=generate-a-long-random-password
 SESSIONGUARD_ENROLLMENT_TOKEN=generate-a-long-random-token
 SESSIONGUARD_BROKER_API_KEY=generate-a-separate-long-random-token
 SESSIONGUARD_OIDC_CLIENT_SECRET=pocketid-sessionguard-client-secret
+SESSIONGUARD_ACCESS_OIDC_CLIENT_SECRET=pocketid-sessionguard-access-client-secret
 SESSIONGUARD_ALERT_WEBHOOK_URL=

deploy/docker-compose.yml

@@ -32,6 +32,7 @@ services:
       SESSIONGUARD_ENROLLMENT_TOKEN: ${SESSIONGUARD_ENROLLMENT_TOKEN:?SESSIONGUARD_ENROLLMENT_TOKEN is required}
       SESSIONGUARD_BROKER_API_KEY: ${SESSIONGUARD_BROKER_API_KEY:?SESSIONGUARD_BROKER_API_KEY is required}
       SESSIONGUARD_OIDC_CLIENT_SECRET: ${SESSIONGUARD_OIDC_CLIENT_SECRET:?SESSIONGUARD_OIDC_CLIENT_SECRET is required}
+      SESSIONGUARD_ACCESS_OIDC_CLIENT_SECRET: ${SESSIONGUARD_ACCESS_OIDC_CLIENT_SECRET:-}
       SESSIONGUARD_ALERT_WEBHOOK_URL: ${SESSIONGUARD_ALERT_WEBHOOK_URL:-}
     ports:
       - "127.0.0.1:8080:8080"

deploy/guacamole/CI-CD.md

@@ -37,8 +37,7 @@ services:
       SESSIONGUARD_BROKER_TIMEOUT_MS: "2500"
 ```
 
-Keep all existing Guacamole/PostgreSQL/header-auth environment variables and
-Traefik labels unchanged.
+Keep the existing Guacamole/PostgreSQL/header-auth environment variables. For SessionGuard 0.5.0 Access Auth, replace the old ForwardAuth middleware labels as described in `docs/ACCESS-AUTH.md`.
 
 ## Versioning
 
@@ -48,9 +47,9 @@ Traefik labels unchanged.
 git describe --tags --always | sed 's/^v//'
 ```
 
-A commit tagged `v0.4.0` therefore publishes `0.4.0`; later commits are named
-like `0.4.0-1-g0123456` until the next tag.
+A commit tagged `v0.5.0` therefore publishes `0.5.0`; later commits are named
+like `0.5.0-1-g0123456` until the next tag.
 
-The extension Dockerfile no longer hardcodes `sessionguard-guacamole-0.4.0.jar`.
+The extension Dockerfile no longer hardcodes `sessionguard-guacamole-0.5.0.jar`.
 Maven may therefore change the project version without requiring a Dockerfile
 change.

deploy/guacamole/README.md

@@ -48,3 +48,27 @@ With `single_session_per_user=true`, the lease key is global per username. With
 ## 4. Header-auth boundary
 
 If Guacamole uses `HTTP_AUTH_HEADER=X-Guacamole-User`, untrusted traffic must not be able to reach Guacamole directly and supply that header. Keep the reverse proxy/header scrubber as the only trusted ingress path. Prefer a dedicated proxy network instead of sharing Guacamole's port with unrelated containers.
+
+## 5. SessionGuard Access Auth (0.5.0+)
+
+SessionGuard Master can replace the separate `traefik-forward-auth` service for Guacamole. Keep Guacamole's header-auth extension (`HTTP_AUTH_HEADER=X-Guacamole-User`), but configure Traefik to call:
+
+```text
+http://sessionguard-master:8080/auth/verify
+```
+
+Expose the Master's `/auth/*` routes on the Guacamole hostname through the reserved public prefix `/_sessionguard/auth/*`, with that router excluded from ForwardAuth. The recommended PocketID callback is therefore:
+
+```text
+https://guacamole.example.org/_sessionguard/auth/oidc/callback
+```
+
+and the PocketID logout/back-channel callback is:
+
+```text
+https://guacamole.example.org/_sessionguard/auth/backchannel-logout
+```
+
+Before ForwardAuth, strip any client-provided `X-Guacamole-User` and `X-SessionGuard-*` identity headers. After successful ForwardAuth, copy only SessionGuard's auth response headers to Guacamole.
+
+See `docs/ACCESS-AUTH.md` for complete labels and migration steps.

deploy/guacamole/docker-compose.sessionguard.example.yml

@@ -2,7 +2,7 @@
 # Build context must point at the SessionGuard repository root.
 services:
   guacamole:
-    image: sessionguard-guacamole:${SESSIONGUARD_VERSION:-0.4.0}
+    image: sessionguard-guacamole:${SESSIONGUARD_VERSION:-0.5.0}
     build:
       context: ../..
       dockerfile: deploy/guacamole/Dockerfile.guacamole