guacamoleService.js

Go to the documentation of this file.

/**
 * @file Guacamole Integration Service - Remote Desktop Gateway Management
 * @module services/guacamoleService
 * @description
 * Apache Guacamole integration service providing clientless remote desktop access (RDP, VNC, SSH)
 * through web browsers. Manages connections, users, authentication, and multi-tenant isolation
 * via Guacamole's REST API and PostgreSQL database.
 *
 * **Apache Guacamole Overview:**
 * 
 * Guacamole is a clientless remote desktop gateway supporting:
 * - **RDP** (Remote Desktop Protocol) - Windows remote access
 * - **VNC** (Virtual Network Computing) - Cross-platform screen sharing
 * - **SSH** (Secure Shell) - Terminal access
 * - Browser-based access via HTML5 WebSocket/HTTP
 * - No client software required
 *
 * **Architecture:**
 * ```
 * ┌──────────────┐      ┌──────────────────┐      ┌──────────────┐
 * │   Browser    │◄────►│   Guacamole      │◄────►│   RMM Agent  │
 * │   (HTML5)    │      │   Gateway        │      │   (RDP/VNC)  │
 * └──────────────┘      └──────────────────┘      └──────────────┘
 *                                │
 *                                ▼
 *                       ┌──────────────────┐
 *                       │   PostgreSQL     │
 *                       │   (Connections)  │
 *                       └──────────────────┘
 * ```
 *
 * **Multi-Tenancy Model:**
 * 
 * Implements tenant isolation using Guacamole's connection group hierarchy:
 * ```
 * ROOT/
 *   ├── tenant_1/
 *   │   ├── agent_connection_1
 *   │   └── agent_connection_2
 *   ├── tenant_2/
 *   │   └── agent_connection_3
 *   └── tenant_3/
 *       └── agent_connection_4
 * ```
 *
 * Each tenant gets:
 * - Dedicated connection group
 * - Isolated user permissions
 * - Separate connection credentials
 * - Access control per agent
 *
 * **Connection Lifecycle:**
 * 
 * 1. **Agent Registration**: Agent enrolls with RMM platform
 * 2. **Connection Creation**: Service creates Guacamole connection for agent
 * 3. **User Provisioning**: Dashboard users get Guacamole accounts
 * 4. **Permission Grant**: Users assigned READ permission to tenant connections
 * 5. **Session Initiation**: User requests remote access via dashboard
 * 6. **Token Generation**: Service generates temporary connection token
 * 7. **Browser Connect**: User opens Guacamole URL with token
 * 8. **Tunnel Establishment**: Guacamole connects to agent via persistent tunnel
 * 9. **Session Active**: User interacts with remote desktop in browser
 * 10. **Session Cleanup**: Connection closed, logs saved to database
 *
 * **Persistent Tunnels:**
 * 
 * Uses guacamoleTunnelService for persistent SSH tunnels to agents:
 * - Agent opens reverse SSH tunnel on port 45000+
 * - Guacamole connects to localhost:assigned_port
 * - Eliminates need for public RDP/VNC exposure
 * - Works through firewalls and NAT
 *
 * **Configuration:**
 * - `GUACAMOLE_URL` - Guacamole server URL (default: http://localhost:8080/guacamole)
 * - `GUACAMOLE_USERNAME` - Admin username (default: guacadmin)
 * - `GUACAMOLE_PASSWORD` - Admin password (required)
 *
 * **Database Schema:**
 * - `agent_guacamole_connections` - Agent → Connection mapping
 * - Guacamole native tables (guacamole_connection, guacamole_user, etc.)
 *
 * **API Endpoints Used:**
 * - POST `/api/tokens` - Authentication
 * - GET/POST `/api/session/data/postgresql/connectionGroups` - Groups
 * - GET/POST/PATCH `/api/session/data/postgresql/connections` - Connections
 * - GET/POST `/api/session/data/postgresql/users` - User management
 * - PATCH `/api/session/data/postgresql/users/{user}/permissions` - Permissions
 * - GET `/api/session/data/postgresql/activeConnections` - Active sessions
 *
 * **Key Features:**
 * - **Token caching**: Admin token cached for 50 minutes to reduce auth overhead
 * - **Auto-provisioning**: Users/connections created automatically on first access
 * - **Permission management**: READ permissions granted per tenant
 * - **Port allocation**: Dynamic port assignment for persistent tunnels
 * - **Connection tracking**: Database records for audit and monitoring
 * - **Idle detection**: Automatic cleanup of stale connections
 *
 * **Security:**
 * - Tenant isolation via connection groups
 * - User authentication required
 * - Permission-based access control
 * - Temporary session tokens (short-lived)
 * - Encrypted tunnels (SSH)
 * - Audit logging
 * @example
 * // Create connection for new agent
 * const guacamoleService = require('./services/guacamoleService');
 * await guacamoleService.createOrUpdateConnection({
 *   agent_uuid: '550e8400-e29b-41d4-a716-446655440000',
 *   hostname: 'WORKSTATION-01',
 *   tenant_id: 5
 * }, 5);
 * @example
 * // Generate session token for user
 * const token = await guacamoleService.generateConnectionToken(
 *   connectionId,
 *   agentUuid,
 *   tenantId,
 *   'user@example.com'
 * );
 * const url = guacamoleService.getConnectionUrl(connectionId, token);
 * // User opens URL in browser to start remote session
 * @example
 * // Provision dashboard user
 * await guacamoleService.createOrUpdateGuacamoleUser(
 *   'admin@example.com',
 *   tenantId,
 *   tenantGroupId
 * );
 * @see {@link https://guacamole.apache.org/doc/gug/} Guacamole User Guide
 * @see {@link https://guacamole.apache.org/api-documentation/} Guacamole REST API
 * @see {@link module:services/guacamoleTunnelService} for persistent tunnel management
 * @see {@link module:services/websocketManager} for RDS session alternative
 * @requires axios - HTTP client for Guacamole API
 * @requires ./db - PostgreSQL connection pool
 * @requires ./guacamoleTunnelService - SSH tunnel management
 */
 
/**
 * Guacamole Service
 * Manages Guacamole connections via API and database
 */
 
const axios = require('axios');
const pool = require('./db');
const tunnelService = require('./guacamoleTunnelService');
 
const GUACAMOLE_URL = process.env.GUACAMOLE_URL || 'http://localhost:8080/guacamole';
const GUACAMOLE_USERNAME = process.env.GUACAMOLE_USERNAME || 'guacadmin';
const GUACAMOLE_PASSWORD = process.env.GUACAMOLE_PASSWORD;
 
let cachedToken = null;
let tokenExpiry = 0;
 
/**
 * Authenticate with Guacamole and get auth token (admin)
 */
async function getAuthToken() {
  // Return cached token if still valid
  if (cachedToken && Date.now() < tokenExpiry) {
    return cachedToken;
  }
 
  try {
    const response = await axios.post(
      `${GUACAMOLE_URL}/api/tokens`,
      `username=${encodeURIComponent(GUACAMOLE_USERNAME)}&password=${encodeURIComponent(GUACAMOLE_PASSWORD)}`,
      {
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded'
        }
      }
    );
 
    cachedToken = response.data.authToken;
    // Token expires after 60 minutes, cache for 50 minutes to be safe
    tokenExpiry = Date.now() + (50 * 60 * 1000);
    
    return cachedToken;
  } catch (error) {
    console.error('[Guacamole] Authentication failed:', error.response?.data || error.message);
    throw new Error('Failed to authenticate with Guacamole');
  }
}
 
/**
 * Authenticate as a specific user and get their token
 * @param username
 * @param password
 */
async function getUserAuthToken(username, password) {
  try {
    const response = await axios.post(
      `${GUACAMOLE_URL}/api/tokens`,
      `username=${encodeURIComponent(username)}&password=${encodeURIComponent(password)}`,
      {
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded'
        }
      }
    );
 
    return response.data.authToken;
  } catch (error) {
    console.error('[Guacamole] User authentication failed:', error.response?.data || error.message);
    throw new Error('Failed to authenticate user with Guacamole');
  }
}
 
/**
 * Create or get a connection group for a tenant
 * @param {string} tenantId - Tenant ID
 * @param {string} tenantName - Tenant name for display
 * @returns {Promise<string>} Group identifier
 */
async function createOrGetTenantGroup(tenantId, tenantName) {
  try {
    const token = await getAuthToken();
    
    // Check if group already exists
    const groupsResponse = await axios.get(
      `${GUACAMOLE_URL}/api/session/data/postgresql/connectionGroups/ROOT/tree`,
      {
        headers: {
          'Guacamole-Token': token
        }
      }
    );
    
    // Search for existing tenant group
    const existingGroup = groupsResponse.data.childConnectionGroups?.find(
      g => g.identifier === `tenant_${tenantId}` || g.name === `Tenant: ${tenantName}`
    );
    
    if (existingGroup) {
      console.log(`[Guacamole] Found existing group for tenant ${tenantId}: ${existingGroup.identifier}`);
      return existingGroup.identifier;
    }
    
    // Create new connection group for tenant
    const createResponse = await axios.post(
      `${GUACAMOLE_URL}/api/session/data/postgresql/connectionGroups`,
      {
        parentIdentifier: 'ROOT',
        name: `Tenant: ${tenantName}`,
        type: 'ORGANIZATIONAL',
        attributes: {
          'max-connections': '',
          'max-connections-per-user': ''
        }
      },
      {
        headers: {
          'Guacamole-Token': token
        }
      }
    );
    
    const groupId = createResponse.data.identifier;
    console.log(`[Guacamole] Created connection group ${groupId} for tenant ${tenantId}`);
    
    return groupId;
  } catch (error) {
    console.error('[Guacamole] Error creating/getting tenant group:', error.response?.data || error.message);
    throw error;
  }
}
 
/**
 * Create or update a Guacamole user for a dashboard user
 * @param {string} userEmail - User email
 * @param {string} tenantId - Tenant ID
 * @param {string} tenantGroupId - Tenant group identifier
 * @returns {Promise<{username: string, password: string}>}
 */
async function createOrUpdateGuacamoleUser(userEmail, tenantId, tenantGroupId) {
  try {
    const token = await getAuthToken();
    const crypto = require('crypto');
    
    // Handle undefined userEmail gracefully
    if (!userEmail) {
      userEmail = `user_${Date.now()}@tenant.local`;
    }
    
    // Generate username from email (sanitize)
    const username = `tenant_${tenantId}_${userEmail.split('@')[0].replace(/[^a-zA-Z0-9]/g, '_')}`;
    
    // Check if user exists
    let userExists = false;
    try {
      await axios.get(
        `${GUACAMOLE_URL}/api/session/data/postgresql/users/${username}`,
        {
          headers: {
            'Guacamole-Token': token
          }
        }
      );
      userExists = true;
    } catch (err) {
      // User doesn't exist
    }
    
    // Generate or retrieve password (store in database)
    let password;
    const passwordResult = await pool.query(
      'SELECT guac_password FROM users WHERE email = $1',
      [userEmail]
    );
    
    if (passwordResult.rows.length > 0 && passwordResult.rows[0].guac_password) {
      password = passwordResult.rows[0].guac_password;
    } else {
      // Generate new password
      password = crypto.randomBytes(32).toString('hex');
      
      // Store password in database
      await pool.query(
        `UPDATE users SET guac_password = $1 WHERE email = $2`,
        [password, userEmail]
      );
    }
    
    if (userExists) {
      // Update existing user permissions
      await axios.put(
        `${GUACAMOLE_URL}/api/session/data/postgresql/users/${username}/permissions`,
        [{
          op: 'add',
          path: `/connectionGroupPermissions/${tenantGroupId}`,
          value: 'READ'
        }],
        {
          headers: {
            'Guacamole-Token': token,
            'Content-Type': 'application/json'
          }
        }
      );
      
      console.log(`[Guacamole] Updated permissions for user ${username}`);
    } else {
      // Create new user
      await axios.post(
        `${GUACAMOLE_URL}/api/session/data/postgresql/users`,
        {
          username,
          password,
          attributes: {
            'disabled': '',
            'expired': '',
            'access-window-start': '',
            'access-window-end': '',
            'valid-from': '',
            'valid-until': '',
            'timezone': null
          }
        },
        {
          headers: {
            'Guacamole-Token': token
          }
        }
      );
      
      // Grant READ permission on tenant group
      await axios.patch(
        `${GUACAMOLE_URL}/api/session/data/postgresql/users/${username}/permissions`,
        [{
          op: 'add',
          path: `/connectionGroupPermissions/${tenantGroupId}`,
          value: 'READ'
        }],
        {
          headers: {
            'Guacamole-Token': token,
            'Content-Type': 'application/json'
          }
        }
      );
      
      console.log(`[Guacamole] Created user ${username} with access to group ${tenantGroupId}`);
    }
    
    return { username, password };
  } catch (error) {
    console.error('[Guacamole] Error creating/updating user:', error.response?.data || error.message);
    throw error;
  }
}
 
/**
 * Create or update a Guacamole connection for an agent
 * @param {object} agent - Agent object with uuid, hostname, ip_address, os
 * @param {string} tenantId - Tenant ID
 * @returns {object} Connection details
 */
async function createOrUpdateConnection(agent, tenantId) {
  try {
    const token = await getAuthToken();
    
    // Get tenant info for group creation
    const tenantResult = await pool.query(
      'SELECT name FROM tenants WHERE id = $1',
      [tenantId]
    );
    
    const tenantName = tenantResult.rows.length > 0 ? tenantResult.rows[0].name : tenantId;
    
    // Create or get tenant connection group
    const tenantGroupId = await createOrGetTenantGroup(tenantId, tenantName);
    
    // Determine connection protocol based on OS
    const protocol = agent.os?.toLowerCase().includes('windows') ? 'rdp' : 'vnc';
    const remotePort = protocol === 'rdp' ? 3389 : 5900;
    
    // Check if connection already exists in our database
    const existingResult = await pool.query(
      'SELECT guac_connection_id FROM agent_guacamole_connections WHERE agent_uuid = $1',
      [agent.agent_uuid]
    );
    
    let connectionId = existingResult.rows.length > 0 ? existingResult.rows[0].guac_connection_id : null;
    
    // Don't create tunnel here - tunnels are created on-demand when "Request Access" is clicked
    // Initial connection points to a placeholder (will be updated when tunnel is active)
    const connectionName = `${agent.hostname || agent.agent_uuid}`;
    
    if (existingResult.rows.length > 0) {
      // Update existing connection metadata only (don't change host/port)
      connectionId = existingResult.rows[0].guac_connection_id;
      
      // Get current connection to preserve host/port
      const token = await getAuthToken();
      const currentResponse = await axios.get(
        `${GUACAMOLE_URL}/api/session/data/postgresql/connections/${connectionId}`,
        { headers: { 'Guacamole-Token': token } }
      );
      
      await axios.put(
        `${GUACAMOLE_URL}/api/session/data/postgresql/connections/${connectionId}`,
        {
          name: connectionName,
          protocol: protocol,
          parameters: {
            ...currentResponse.data.parameters,  // Preserve existing host/port
            hostname: currentResponse.data.parameters.hostname || '0.0.0.0',  // Placeholder if not set
            port: currentResponse.data.parameters.port || remotePort.toString(),
            'ignore-cert': 'true',
            'security': 'any',
            'enable-wallpaper': 'false',
            'enable-theming': 'false',
            'enable-font-smoothing': 'true',
            'resize-method': 'display-update',
            // System-level access - no authentication required  
            username: '',          // Blank username for system access
            password: '',          // Blank password for system access
            domain: ''             // No domain required
          },
          attributes: {
            'max-connections': '2',
            'max-connections-per-user': '1'
          }
        },
        {
          headers: {
            'Guacamole-Token': token
          }
        }
      );
      
      console.log(`[Guacamole] Updated connection ${connectionId} for agent ${agent.agent_uuid}`);
    } else {
      // Create new connection under tenant group with placeholder address
      const token = await getAuthToken();
      const response = await axios.post(
        `${GUACAMOLE_URL}/api/session/data/postgresql/connections`,
        {
          parentIdentifier: tenantGroupId,  // Place in tenant-specific group
          name: connectionName,
          protocol: protocol,
          parameters: {
            hostname: '0.0.0.0',  // Placeholder - will be updated when tunnel is created
            port: remotePort.toString(),
            'ignore-cert': 'true',
            'security': 'any',
            'enable-wallpaper': 'false',
            'enable-theming': 'false',
            'enable-font-smoothing': 'true',
            'resize-method': 'display-update',
            // System-level access - no authentication required
            username: '',          // Blank username for system access
            password: '',          // Blank password for system access
            domain: ''             // No domain required
          },
          attributes: {
            'max-connections': '2',
            'max-connections-per-user': '1'
          }
        },
        {
          headers: {
            'Guacamole-Token': token
          }
        }
      );
      
      connectionId = response.data.identifier;
      
      // Store connection ID in our database
      await pool.query(
        `INSERT INTO agent_guacamole_connections (agent_uuid, tenant_id, guac_connection_id, protocol, created_at, updated_at)
         VALUES ($1, $2, $3, $4, NOW(), NOW())`,
        [agent.agent_uuid, tenantId, connectionId, protocol]
      );
      
      console.log(`[Guacamole] Created connection ${connectionId} for agent ${agent.agent_uuid}`);
    }
    
    return {
      connectionId,
      protocol,
      name: connectionName
    };
  } catch (error) {
    console.error('[Guacamole] Error creating/updating connection:', error.response?.data || error.message);
    throw error;
  }
}
 
/**
 * Delete a Guacamole connection
 * @param {string} agentUuid - Agent UUID
 */
async function deleteConnection(agentUuid) {
  try {
    // Get connection ID from database
    const result = await pool.query(
      'SELECT guac_connection_id FROM agent_guacamole_connections WHERE agent_uuid = $1',
      [agentUuid]
    );
    
    if (result.rows.length === 0) {
      return; // No connection to delete
    }
    
    const connectionId = result.rows[0].guac_connection_id;
    const token = await getAuthToken();
    
    // Delete from Guacamole
    await axios.delete(
      `${GUACAMOLE_URL}/api/session/data/postgresql/connections/${connectionId}`,
      {
        headers: {
          'Guacamole-Token': token
        }
      }
    );
    
    // Delete from our database
    await pool.query(
      'DELETE FROM agent_guacamole_connections WHERE agent_uuid = $1',
      [agentUuid]
    );
    
    console.log(`[Guacamole] Deleted connection ${connectionId} for agent ${agentUuid}`);
  } catch (error) {
    console.error('[Guacamole] Error deleting connection:', error.response?.data || error.message);
    // Don't throw - best effort deletion
  }
}
 
/**
 * Get connection details for an agent
 * @param {string} agentUuid - Agent UUID
 * @returns {object | null} Connection details
 */
async function getConnection(agentUuid) {
  const result = await pool.query(
    'SELECT * FROM agent_guacamole_connections WHERE agent_uuid = $1',
    [agentUuid]
  );
  
  return result.rows.length > 0 ? result.rows[0] : null;
}
 
/**
 * Get connections URL for embedding in dashboard
 * @param {string} connectionId - Guacamole connection ID
 * @param {string} authToken - Authentication token
 * @returns {string} Complete Guacamole client URL with token
 */
function getConnectionUrl(connectionId, authToken) {
  // Use external URL for dashboard/frontend access
  const externalUrl = process.env.GUACAMOLE_EXTERNAL_URL || 'https://guacamole.everydaytech.au';
  
  // Standard Guacamole client URL format
  // The token should be passed as a URL parameter for auto-login
  return `${externalUrl}/guacamole/#/client/${connectionId}?token=${authToken}`;
}
 
/**
 * Generate a connection token for auto-login
 * IMPORTANT: This generates a user-specific token with ONLY access to their tenant's connections
 * This prevents cross-tenant access and ensures proper tenant isolation
 * @param {string} connectionId - Guacamole connection ID
 * @param {string} agentUuid - Agent UUID for tenant verification
 * @param {string} tenantId - Tenant ID for isolation
 * @param {string} userEmail - User email for audit logging
 * @returns {Promise<string>} Token for auto-login URL
 */
async function generateConnectionToken(connectionId, agentUuid, tenantId, userEmail) {
  try {
    // Ensure userEmail has a fallback value
    if (!userEmail || userEmail === 'undefined') {
      userEmail = `user_${Date.now()}@tenant${tenantId}.local`;
    }
    
    // Verify this connection belongs to the tenant
    const verifyResult = await pool.query(
      `SELECT agc.guac_connection_id, agc.tenant_id, a.hostname, t.name as tenant_name
       FROM agent_guacamole_connections agc
       JOIN agents a ON a.agent_uuid = agc.agent_uuid
       JOIN tenants t ON t.tenant_id = agc.tenant_id
       WHERE agc.agent_uuid = $1 AND agc.tenant_id = $2`,
      [agentUuid, tenantId]
    );
    
    if (verifyResult.rows.length === 0) {
      throw new Error('Connection not found or access denied');
    }
    
    // Get tenant info
    const tenantName = verifyResult.rows[0].tenant_name;
    
    // Create or get tenant connection group
    const tenantGroupId = await createOrGetTenantGroup(tenantId, tenantName);
    
    // Create or update Guacamole user for this dashboard user
    // This user will ONLY have access to their tenant's connection group
    const { username, password } = await createOrUpdateGuacamoleUser(userEmail, tenantId, tenantGroupId);
    
    // Authenticate as the tenant-specific user (not admin)
    const userToken = await getUserAuthToken(username, password);
    
    // Log access for audit trail
    await pool.query(
      `INSERT INTO activity_logs (agent_uuid, tenant_id, action, details, user_email)
       VALUES ($1, $2, $3, $4, $5)`,
      [
        agentUuid,
        tenantId,
        'guacamole_token_generated',
        JSON.stringify({
          connection_id: connectionId,
          hostname: verifyResult.rows[0].hostname,
          guacamole_user: username
        }),
        userEmail
      ]
    );
    
    console.log(`[Guacamole] Generated user-specific token for ${userEmail} (${username}) to access connection ${connectionId} (tenant ${tenantId})`);
    
    // Return user-specific token - this user can ONLY see their tenant's connections
    return userToken;
  } catch (error) {
    console.error('[Guacamole] Error generating connection token:', error.message);
    throw error;
  }
}
 
/**
 * Create a new Guacamole connection (wrapper for createOrUpdateConnection)
 * @param {string} agentUuid - Agent UUID
 * @param {object} config - Connection configuration
 * @returns {object} Connection details with identifier
 */
async function createConnection(agentUuid, config) {
  const token = await getAuthToken();
  
  // Create connection via Guacamole API
  const response = await axios.post(
    `${GUACAMOLE_URL}/api/session/data/postgresql/connections`,
    {
      parentIdentifier: 'ROOT',
      name: config.name,
      protocol: config.protocol || 'rdp',
      parameters: config.parameters,
      attributes: {
        'max-connections': '2',
        'max-connections-per-user': '1'
      }
    },
    {
      headers: {
        'Guacamole-Token': token
      }
    }
  );
  
  return {
    identifier: response.data.identifier,
    name: config.name,
    protocol: config.protocol || 'rdp'
  };
}
 
/**
 * Update Guacamole connection with new tunnel port
 * @param {string} agentUuid - Agent UUID
 * @param {number} port - Local tunnel port
 * @param {string} protocol - Connection protocol (rdp/vnc/ssh)
 */
async function updateConnectionPort(agentUuid, port, protocol) {
  try {
    // Get connection ID from database
    const result = await pool.query(
      'SELECT guac_connection_id FROM agent_guacamole_connections WHERE agent_uuid = $1',
      [agentUuid]
    );
    
    if (result.rows.length === 0) {
      throw new Error('Connection not found');
    }
    
    const connectionId = result.rows[0].guac_connection_id;
    const token = await getAuthToken();
    
    // Get current connection details first
    const currentResponse = await axios.get(
      `${GUACAMOLE_URL}/api/session/data/postgresql/connections/${connectionId}`,
      {
        headers: {
          'Guacamole-Token': token
        }
      }
    );
    
    const currentConnection = currentResponse.data;
    
    // Update connection with new port using Docker gateway IP
    // 172.19.0.1 is the host IP accessible from inside Docker containers
    await axios.put(
      `${GUACAMOLE_URL}/api/session/data/postgresql/connections/${connectionId}`,
      {
        ...currentConnection,
        parameters: {
          ...currentConnection.parameters,
          hostname: '172.19.0.1',  // Docker gateway to reach host
          port: port.toString()
        }
      },
      {
        headers: {
          'Guacamole-Token': token
        }
      }
    );
    
    console.log(`[Guacamole] Updated connection ${connectionId} to use tunnel port ${port}`);
  } catch (error) {
    console.error('[Guacamole] Error updating connection port:', error.response?.data || error.message);
    throw error;
  }
}
 
module.exports = {
  getAuthToken,
  getUserAuthToken,
  createOrGetTenantGroup,
  createOrUpdateGuacamoleUser,
  createConnection,
  createOrUpdateConnection,
  deleteConnection,
  getConnection,
  getConnectionUrl,
  generateConnectionToken,
  updateConnectionPort
};