Per-user assigned Guacamole instances

[jonny-ibdr]

Hi,

I'd just like to start off by saying this package looks amazing - it looks probable that we will deploy this for our own use within the company. Well done all.

I spent a day deploying the TRE and poking around with the features, and noticed that if you create a guacamole windows instance and log in, and then take another user and connect to the same instance, it will kick off the first user.

Is there a way of disabling access to an instance until that person has logged out? I can imagine a scenario where Person A is busy doing their work and Person B comes along and kicks them off unknowingly. With a small amount of instances this can become a common occurrence.

Thanks

[tamirkamara]

Our approach is that each vm is a per user resource. When one has only the basic researcher permission, they will only be allowed to connect to their vms which means being kicked off should be rare.
A workspace owner is able to connect to all machines which is why you probably experienced that.

[marrobi]

The UI could do with splitting the view for a workspace owner, so their VMs appear separately to other researchers VMs.

[jonnyry]

Is there an issue if user A is signed into an azure service within a TRE VM (e.g. Databricks). A workspace owner then connects to that VM and can then use Databricks as user A? Or have I misunderstood?

Wondering whether Domain joined VMs are ultimately the way to go.

[marrobi]

Yes, it depends what services are used, they often have different security models. We haven't typically done domain joined VMs as AD guests cannot use their credentials to log on AFAIK - unless something has changed. It hopefully will in the future and then it would make sense to domain join the VMs.

[jonnyry]

Is it considered a big thing /undesirable to create "local" Entra accounts for users of the TRE, rather than Entra guests?

I understand that Guests are generally preferable since 1) SSO & 2) it delegates the responsibility for removing access should they leave their home organisation.

However the issue above - whereby a workspace owner can impersonate another user by accessing their VM with logged on entra credentials is not desirable either.

[marrobi]

Not at all. Just means each user needs to have a new set of credentials in the "local" Entra domain.

[jonny-ibdr]

Ah, that makes alot of sense. Thank you for such a quick response :)

On a separate note (maybe this would be better in a separate discussion) - Do you have a rough cost estimate for a month of running the TRE (lets say with 1 Guacamole VM)? We're looking at using the basic pricing for now.

Thanks

[marrobi]

Can you drop me an email to marcus.robinson at microsoft.com and I can put you in touch with someone who can give you some numbers?

Thanks.

[TonyWildish-BH]

picking up on this thread, we have use-cases where users will want to share a VM, either for pair-programming, or because they're using a high-end VM (+GPU) such that they don't want to deploy a VM per person. So we'd really like to be able to have two independent users connect to the same VM at the same time, as different users in the VM itself. How would we support that?

[marrobi]

Typically if it's a GPU machine, users connect from a lower spec virtual desktop to that remote machine. So might be Jupyter running on the remote machine, or using VSCode remoting ( https://code.visualstudio.com/docs/remote/remote-overview ). The remote machine could be a cluster, such as Kubernetes. Azure ML has the concept of compute clusters - https://learn.microsoft.com/en-us/azure/machine-learning/how-to-create-attach-compute-cluster?view=azureml-api-2&tabs=python#what-is-a-compute-cluster

As it stands our Guacamole authentication extension has a single set of credentials per VM - https://github.com/microsoft/AzureTRE/blob/cb59c99233575b096207e6afc288af9da7ee0256/templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/src/main/java/org/apache/guacamole/auth/azuretre/connection/TokenInjectingConnection.java#L78C54-L78C55 .

I guess we could store a set of credentials per user, but there would need to be a way to add/remove users to a VM. The API would need to be able to creates credentials, adds a user, saves the credentials, but not sure its the best way forward.

Another way might be if you were to Azure AD join a Windows machine, you could rely on Azure AD credentials managed at the Azure level. Similar to the way AVD works. But not sure if that works with AD external users at the moment, all users have to be real user accounts in the directory which is often a challenge.

Least friction would be the first options, also worth looking at things like https://code.visualstudio.com/learn/collaboration/live-share and https://cocalc.com/