TOTP in Janua

[jabofh]

Problem / Use case

One of the few advantages Guacamole has over Janua, is the ability to add TOTP as a second level of authentication. This secures the system to a great extent, even when users choose weaker-than-desired passwords.

Proposed solution

I see that TOTP is already part of the Docker Image used by Guacamole, so it might be easy enough for Skylark to pull that into their own Docker image and use it.

Alternatives considered

I have attempted to use the Apache solution directly, but I suspect that there might be missing hooks in the Skylark Janua implementation.

[bramej]

Thanks for the report — good news: nothing is missing. janua-web is built directly on guacamole/guacamole:1.6.0, so the TOTP extension and its configuration mechanism are already in the image.

Enable it with two environment variables on the web (guacamole) service:

    environment:
      TOTP_ENABLED: "true"
      TOTP_ISSUER: "Janua"   # optional — otherwise authenticator apps show "Apache Guacamole"

Then docker compose up -d. Each user is prompted to enroll (QR code) on their next login, and logins after that require the 6-digit code alongside the password. An admin can reset a user's enrollment from that user's settings page if a device is lost.

Verified on janua-web:latest — the extension loads and the login API returns the enrollment challenge.

If you were copying the guacamole-auth-totp jar into a mounted GUACAMOLE_HOME/extensions instead: that route works too, but the jar version must match the webapp (1.6.0) and the JDBC extension has to be in the same effective home. The env-var route sidesteps all of that. The README now documents both variables.