Why clientless browser access to internal systems with Apache Guacamole changes the VPN decision
Apache Guacamole publishes RDP, SSH and VNC hosts through a browser gateway, so staff, clinicians, analysts and vendors can reach an internal system without being placed on the internal network. Identity, multi-factor authentication and session recording sit in front of each connection rather than behind a tunnel that exposes a whole subnet. The web application handles login and authorization, while the guacd daemon loads the protocol client that connects to the target host on the user's behalf. For most teams the practical result is that the user needs only an HTML5 browser, and the target host never sees a client device directly. The short answer on platforms is that Guacamole serves as the gateway, and authentik's remote access control (RAC) provider is the component to add when access must be decided by policy instead of by a static connection list. Guacamole's own extensions cover Active Directory and LDAP, Duo and TOTP, OpenID Connect, SAML and smart card single sign-on, so a team with an existing identity provider can often start there. The decision to confirm is whether you need per-user, per-host, time-bound or group-based rules that an administrator maintains in one place. Confirm with authentik's documentation and your own test environment how its RAC provider maps to the policies your auditors will ask about, because the exact behavior should be verified rather than assumed. When the gateway is a control point rather than a network tunnel, the questions change. A VPN answers whether a device may reach a network segment. A gateway answers which named person may open which session, with which second factor, for how long, and whether that session was recorded and can be reviewed later. That shift means you must plan for the gateway's own hardening, its database and logging, and the retention of recordings as records in their own right. It also means the gateway becomes a high-value target, so placement in a segmented zone and tight administrative access matter as much as the protocol choice. Treat the design as an access policy you can prove, not a connectivity service you hope is secure.
Which requirements shape the gateway design
This table maps the regulatory and evidence requirements most likely to shape a Guacamole gateway and shows what each one means for TLS termination, audit logs, recording retention and connection permissions. Read each row as a design decision to settle before the gateway is built, and confirm the final control mapping with your compliance lead and assessor. The main takeaway is that the gateway is itself a compliance control point, so its placement and logging must be designed in from the start.
| Requirement | What it asks for | What it means for the build |
|---|---|---|
| HIPAA 164.312(e)(1), transmission security | Technical measures guarding against unauthorized access to ePHI sent over electronic networks | Decide where TLS terminates: at a reverse proxy in the DMZ, on the Guacamole host, or both. Keep encrypted traffic on the guacd-to-target leg inside the protected segment and confirm this with your assessor. |
| HIPAA 164.312(b), audit controls | Mechanisms that record and examine activity in systems containing ePHI | Send Guacamole connection history, authentication events and authentik audit events to a central log store that the gateway admins cannot silently edit. Confirm which events your environment must retain. |
| Session recording retention | Evidence of what was done in a privileged session, kept for a period your policy and regulator set | Enable the session recording player extension and store recordings on a separate volume with access limits. Set retention with legal and compliance input, since the supplied rules define retention for communications, not for recordings. |
| SEC 17a-4(b)(4), communications retention (where relevant) | Preservation of business communications, including inter-office communications, for not less than three years | Applies mainly if remote session chat, notes or ticket messages count as business communications at a broker-dealer. Confirm with counsel whether session artifacts fall in scope and plan storage accordingly. |
| MFA on the gateway | Strong authentication for remote access into internal systems | Place MFA in front of Guacamole through an SSO extension or an authentik flow, so the gateway login is not the only factor. Confirm which MFA methods your identity provider and Guacamole extensions support together. |
| Per-connection permissions | Access limited to the systems each user needs, with least privilege | Model each RDP, SSH or VNC host as its own connection and grant permissions per user or group. Review grants on a schedule and remove them when roles change. |
| Vendor and privileged access | Controlled, attributable access for administrators and third parties | Use separate accounts for vendors, time-bounded grants and read-only or view-only sessions where the protocol allows. Use authentik policies to add conditions such as group, device or location checks, and confirm each condition is available in your edition. |
Which gateway and identity components fit this design
A clientless design rests on a small set of components: the Guacamole web application, the guacd daemon with its protocol plugins, a database for configuration and history, an identity layer, and optional policy control in front. Each one carries a licensing, hosting or operational decision, so confirm these choices with your own security and procurement teams before the design is fixed.
Apache Guacamole gateway
Guacamole is the browser-facing gateway. It is released under the Apache License 2.0, and version 1.6.0 was released on June 22, 2025. You can install it natively or run it in Docker, and the manual includes a session recording player extension for reviewing captured sessions. Confirm which version your organization will pin, how upgrades are tested, and whether your change process accepts Docker or native packaging.
guacd and protocol plugins
The Guacamole web application forwards the Guacamole protocol to guacd, a background daemon that loads the client plugin for RDP, SSH or VNC and opens the connection to the target host. The apache/guacamole-server repository holds guacd and these plugins under Apache-2.0. Confirm which protocols your targets need, and place guacd on a host that can reach those targets but is not exposed to users directly.
authentik with RAC provider
authentik can sit in front of Guacamole to handle login and apply policy, and its remote access control (RAC) provider brings connection-level access rules into the same flow. The core code is MIT licensed, but the code in the enterprise directory uses a separate license, so check which features your design depends on. Confirm which RAC policies you need, and whether the enterprise features that support your audit trail fall under your license terms.
Database backends for configuration
Guacamole stores connections, users and permissions in a relational database. The manual documents MariaDB or MySQL, PostgreSQL and SQL Server. Pick the engine your database team already backs up, patches and monitors, and confirm how connection records and audit history are retained, encrypted and restored during a recovery test.
Duo, TOTP, SAML, OIDC and LDAP extensions
Guacamole's authentication extensions cover Duo and TOTP for multi-factor authentication, SAML and OpenID Connect for single sign-on, and LDAP or Active Directory for directory lookups. Choose one primary extension per trust boundary and test failure paths, such as a lost MFA device or an identity provider outage. Confirm that the MFA method meets your regulator or assessor expectations before you build around it.
How SSO and MFA extensions change the login path
With the Active Directory or LDAP extension, Guacamole checks the username and password against your directory, so users sign in with the credentials they already use on the corporate network. The login page is Guacamole's own form, and the user is not redirected to an external identity page. This extension does not supply a second factor on its own, so MFA has to come from the Duo or TOTP extension or from a gateway placed in front of Guacamole.
- User experience: a username and password form on the Guacamole login page, followed by an MFA prompt if a second factor extension is loaded.
- Where MFA sits: usually inside Guacamole through the Duo or TOTP extension, so Guacamole performs the check and can record it.
- Directory dependency: the bind account, search base and group attributes decide who can log in and which connections they see. Confirm these with your directory team.
- Version alignment: Guacamole 1.6.0 was released on June 22, 2025, and extensions should be upgraded with the core so the versions match.
- Failure handling: test lockout behavior and what users see when the directory is unreachable.
Confirm the order in which the directory check and the second factor run, and whether a directory outage blocks every login.
Guacamole's SAML and OpenID Connect extensions hand the login to an identity provider. The user is redirected to the IdP, completes sign-in and MFA there, and returns to Guacamole with an assertion or token. Guacamole does not receive the password, and the MFA policy is managed in the IdP. This pattern fits organizations that already run a central identity provider for other applications.
- User experience: a redirect to the IdP sign-in page, then a return to the Guacamole connection list.
- Where MFA is enforced: in the IdP's policy engine. Confirm that the assertion or token carries the authentication strength you require, and that Guacamole does not accept sessions that lack it.
- Claim mapping: group or role claims decide which connections appear. Map them and test with a non-administrative account.
- Lifetime alignment: token or assertion lifetimes at the IdP and Guacamole's session timeout can differ, so set them deliberately.
- Certificate and key handling: confirm the signing and encryption settings with the identity team and the extension version against your Guacamole release.
Check what happens when the IdP is unreachable and whether break-glass local accounts exist, with their access documented and monitored.
The smart card extension authenticates users with a certificate held on a card or token. It is typically used where card-based credentials are already issued, such as government agencies and some regulated sites. The user inserts the card, enters a PIN, and Guacamole maps the certificate to a user identity. The card and PIN together often satisfy the second factor, but this depends on how your policy counts them.
- User experience: a certificate selection prompt in the browser and a PIN entry through the card middleware, rather than a password field.
- Where MFA is enforced: the card and PIN usually provide two factors (possession and knowledge). Confirm with your security team whether policy also requires an additional extension.
- Trust configuration: the certificate authority chain, revocation checking and the certificate-to-user mapping must match your PKI. Confirm each setting with the PKI owner.
- Browser and reader support: test each browser, operating system and reader model in use, since certificate handling varies by platform.
- Version alignment: confirm the smart card extension version against the Guacamole release in use and the matching section of the Guacamole manual.
Test revoked and expired certificates, and document the fallback process for lost or failed cards before production use.
Guacamole's encrypted JSON and HTTP header authentication extensions let a trusted front end decide who the user is and pass that identity to Guacamole. In this design, authentik sits in front and its remote access control (RAC) provider applies policy to each connection. Login, MFA and authorization all happen in authentik, and Guacamole trusts only the assertions that come from the gateway.
- User experience: the authentik login flow, including its MFA stages, appears before any Guacamole page loads.
- Where MFA is enforced: in authentik's flows and policies, so the same factor rules can apply to every RAC application.
- Enterprise-only features: mTLS client certificate authentication and enhanced audit logging are enterprise-only on the authentik pricing page, as are Google Workspace and Microsoft Entra ID integrations. The Open Source edition does not include them, so confirm which features you need before choosing an edition.
- Trust boundary: Guacamole must reject requests that do not pass through authentik. Test this by sending a direct request to the Guacamole port.
- Version alignment: authentik's security policy lists 2026.5.x and 2026.8.x as supported lines, so confirm your version falls within one of them.
Confirm the header or token trust settings with your security team, and record how the gateway and Guacamole are kept in sync during upgrades.
How authentik's RAC provider adds policy-based access
The RAC provider lets authentik decide who may open which connection before Guacamole starts a session. In this design, authentik sits in front of the Guacamole web application as the identity and policy layer. Each RDP, SSH or VNC target is published as its own application in authentik with a remote access control provider, and policies bound to that application are evaluated when a user signs in. Only a user who passes those policies receives a session handed to Guacamole. Decide the grouping before you build: map each connection to one application and one set of group-based policies, then test with a user who is denied to confirm that no Guacamole session is created at all.
The authentik deployment has three parts you must size: a server container that runs core with an embedded outpost, a worker container for background tasks, and PostgreSQL, which stores all configuration and data except uploaded files. The 2025.10 release notes state that authentik no longer uses Redis, so caching, background tasks, sessions and WebSocket functions moved to PostgreSQL. The same notes warn of roughly 50% more PostgreSQL connections after upgrading. If you are moving from an older release that depended on Redis, measure connection counts in a staging environment and set PostgreSQL connection limits and pooling before cutover. The Docker Compose guide's minimum of 2 CPU cores and 2 GB of RAM applies to test and small-scale setups, so confirm production sizing with your own load tests.
Choose the authentik release branch before you build. The security policy lists 2026.5.x and 2026.8.x as the supported versions receiving security fixes, and security releases are announced at least 24 hours in advance. The latest release on the GitHub releases page at the time of research was 2026.8.4, published October 14, 2026. Confirm the current version at build time and pin the branch you will patch within that notice window. Also confirm which features your edition includes. The pricing page places mTLS client certificate authentication, privileged access management and enhanced audit logging in the Enterprise tier, so verify that the RAC provider and the audit trail you need are available at the tier you select, because session recordings in Guacamole are a separate control.
How a Guacamole rollout moves from pilot to recorded production access
The sequence turns a Guacamole gateway from a test host into a production access point where every session is authenticated, authorized, and recorded. Each phase closes with a deliverable your team can check before the next phase starts.
Scope protocols and target hosts
Your team and the implementation partner list every system that needs browser access, the protocol each one uses (RDP, SSH or VNC), the operating system and version, and who needs it. Guacamole reaches these hosts through guacd and protocol plugins, so each protocol must be confirmed on each target before design begins. The output is a signed host inventory with owners, protocols, and the user groups that will connect. You know it is done when every host in scope has a named owner and a tested protocol path.
Integrate identity and MFA
The team connects Guacamole to the identity provider, using one of the documented extensions for Active Directory or LDAP, SAML, OpenID Connect, or a multi-factor method such as Duo or TOTP. Where an authentik deployment fronts access, the partner configures its Remote Access Control provider so policy decisions happen before Guacamole sees the request. The output is a test login that requires the agreed factors and maps directory groups to Guacamole user groups. You know it is done when a test account without the required factor is refused and a group change in the directory changes access.
Place the gateway and configure TLS
The partner decides where the Guacamole web application, guacd, and the database sit relative to target hosts, usually in a segment that users reach over HTTPS and that reaches the internal hosts on only the required ports. Certificates, TLS termination, and the database backend (MariaDB or MySQL, PostgreSQL, or SQL Server) are set during this phase. The output is a network diagram with the allowed flows and a configuration record for TLS. You know it is done when a scan from outside the gateway segment finds no direct path to the target hosts.
Build the connection permission model
Connections are grouped by system and environment, and each group receives only the permissions its users need, such as view, connect, or administer. Privileged accounts for target hosts are kept out of user-visible connection parameters where the design allows it. The output is a permission matrix that maps each directory group to connections and actions. You know it is done when each test user can see only the connections in their matrix and an attempt outside it is denied and logged.
Enable session recording and set retention
The team turns on session recording for the connection types in scope, stores recordings on a dedicated volume with access restricted to reviewers, and installs the session recording player extension so reviewers can replay sessions. Retention periods come from the regulation or internal policy that applies to each system, not from the gateway default. The output is a recording configuration, a retention schedule, and a test recording reviewed end to end. You know it is done when a test session is recorded, replays correctly, and is deleted only by the agreed rule.
Run a pilot with one team
One team uses the gateway for real work on a limited set of hosts while the partner watches authentication failures, permission denials, and session quality. Feedback is logged against the permission matrix and the host inventory, and every change goes through the same review as the original design. The output is a pilot report listing issues, fixes, and open decisions. You know it is done when the pilot team completes its normal tasks through the gateway without needing a VPN fallback for those hosts.
Harden and set up monitoring
The partner applies the hardening baseline to the gateway host, database, and containers, restricts administrative access, and confirms that audit logging captures logins, connection starts, and permission changes. Monitoring covers gateway health, failed logins, and recording storage capacity, and alerts route to the team that will operate the system. The output is a hardening record and a monitoring runbook. You know it is done when a planned failure of the database or the gateway produces an alert and the runbook restores service.
Hand over to operations
The partner transfers configuration, runbooks, permission matrix, recording procedures, and upgrade steps to your operations staff, then supports the first production changes. Upgrade and security-fix handling are agreed in writing, including how the team tracks Guacamole and authentik releases. The output is a handover pack and a recorded walkthrough of common tasks. You know it is done when your staff add a user, add a connection, and retrieve a recording without partner help.
What auditors ask for from a browser gateway and which component produces it
This table maps each evidence type an assessor typically requests for a Guacamole gateway to the component that produces it and where it is stored. Read it as a checklist to confirm before the assessment starts, since the independent auditor decides whether the evidence is sufficient. DeployOpen prepares and organizes the evidence, but does not issue the audit conclusion.
| Evidence requested | Component that produces it | Where it lives and what to confirm |
|---|---|---|
| Authentication and MFA logs | authentik (identity provider and proxy in front of Guacamole) | Events stored in the authentik PostgreSQL database. Confirm which events are logged, the retention period you set, and that MFA outcomes are captured. |
| Connection and permission configuration | Guacamole connection and user group settings, exported from the Guacamole database | Stored in the MariaDB, MySQL, PostgreSQL or SQL Server backend. Export dated snapshots so the auditor can see who could reach which host at a given time. |
| Session recordings | Guacamole session recording, played back with the recording player extension | Recordings are written to the path set in the gateway configuration. Confirm the storage location, access controls on that path, and the retention rule the auditor will test. |
| Audit trail of gateway administration | authentik audit logging and Guacamole database history | authentik audit entries sit in PostgreSQL. Confirm whether administrative changes to Guacamole are logged in a form that survives a database restore. |
| Change records for the gateway version | Release and deployment records for Guacamole, guacd and authentik | Keep the deployed versions, change tickets and the source of each package. Confirm the supported authentik release line and when each upgrade was applied. |
| Evidence of time-bound vendor access | authentik policy and Guacamole permissions tied to named accounts | Named accounts, approval records and removal dates. Confirm how access ends at contract close and where that removal is recorded. |
What buyers ask before hiring a Guacamole partner
How much effort does a single-site Guacamole deployment take?
Effort depends on the number of hosts, the protocols in use, how much identity integration is needed and how much session recording you keep. A small set of RDP or SSH hosts behind existing single sign-on is a much smaller job than dozens of Windows and Linux targets with group-based permissions, MFA and recorded sessions. Ask the partner for a written scope that lists each host group, protocol, identity source, MFA method and recording requirement, then compare the quote against that list. Fixed-scope work is agreed in writing before it starts, so the scope document is the thing to negotiate.
Can our own team deploy Guacamole without a partner?
Often yes, if you have engineers comfortable with Linux, Docker or native packages, a database backend and an identity provider. Guacamole itself is open source under the Apache License, Version 2.0, and its manual covers native and containerized installation. The harder parts are usually identity integration, hardening the gateway, placing it correctly on the network, and producing the audit and recording evidence your auditors will ask for. Decide which of those your team can own for the full life of the system, not only the first build, and hire a partner for the gaps.
What does our team need to provide during the project?
Expect to supply an identity administrator who can create groups, service accounts and MFA enrollment, a network owner who can approve firewall and routing changes, and a named contact who signs off on the connection inventory. You will also need a test host that mirrors a production target, so permissions and recordings can be checked without touching live systems. Confirm these responsibilities in the written scope, with named roles and expected turnaround for approvals. Delays in change approval are one of the most common reasons remote access projects run late.
How does the authentik edition choice change the cost?
The choice mainly changes which identity features you can use. The authentik pricing page lists an Open Source edition at no cost, an Enterprise edition at $5 per user per month billed annually plus $0.02 per external user per month, and Enterprise Plus starting at $20k annually. Enterprise adds features such as Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history and enhanced audit logging. Check whether your identity needs fall inside the open-source feature set, then ask the partner to price each edition separately in the quote, including support terms.
How should we size storage for Guacamole session recordings?
Recording storage grows with the number of sessions, their length, the protocols and the retention period your policies set. Sessions that run all day on busy administrative hosts generate far more data than short maintenance windows. Start from an inventory of who connects, how often and for how long, then multiply by your retention requirement and add headroom for growth. Ask the partner to show the sizing assumptions in the quote, where recordings are stored, how they are encrypted, who can play them back and how old recordings are removed. Retention periods should come from your own legal and regulatory review, not from the gateway default.
How are Guacamole upgrades and security releases handled?
Ask for a written upgrade procedure that covers Guacamole, its database, the operating system, Docker images if used, and the identity component. For authentik, the security policy lists 2026.5.x and 2026.8.x as supported versions receiving security fixes, and security releases are announced at least 24 hours in advance, so your change process needs to allow for short notice. Confirm who monitors release announcements, who tests in staging, how rollbacks work and whether backups are verified before each change. Upgrades and continuous monitoring can be covered by a retainer, so ask whether that is in the quote or a separate agreement.
What should we verify before signing a Guacamole implementation scope?
Check that the scope names each protocol and host group, the identity sources and MFA methods, the network placement and the recording and retention rules. Confirm the deliverables, including configuration documentation, connection permission model, runbooks, backup and restore tests and the evidence pack for your assessors. DeployOpen implements, hardens, documents and supports self-hosted platforms inside your environment, and prepares evidence for compliance assessments, but it does not issue audit reports or certifications. Ask how acceptance is tested and who signs it off.
What to ask an implementation partner before signing
Start by asking the partner to show the DMZ placement of the Guacamole web application, guacd and the authentik server on a diagram, with the firewall rules that allow only the intended paths. Ask which hosts can reach the RDP, SSH and VNC targets, whether guacd sits on the same segment as the targets or in a separate zone, and who owns each rule. Ask for the exact list of extensions in scope (for example, the authentication extension for SAML or OpenID Connect, and the TOTP or Duo extension if used) and the version of each, pinned to the Guacamole release being deployed. Ask how each extension will be upgraded when a security fix ships.
Ask where MFA is enforced. Authentication can happen in authentik, in a Guacamole extension, or both, and the answer determines what a stolen Guacamole password is worth. Ask the partner to write down which factor is checked at the identity provider, which is checked at the gateway, and what happens when a user bypasses the proxy path. Ask also where session recordings are written, which storage volume or object store holds them, who can read them, how long they are kept, and how deletion is logged. For PostgreSQL, ask for sizing based on your connection count and session volume, since the authentik 2025.10 release notes warn of roughly 50% more PostgreSQL connections after upgrading. Ask who runs the backups and restore test for the database.
Finally, ask for the hardening baseline as a written document covering operating system, container images, TLS settings, admin accounts and logging. Ask how high availability is delivered for the gateway, guacd, authentik and PostgreSQL, and what a failover test looks like. Ask which metrics and alerts are wired to your monitoring stack, including failed logins, guacd errors and recording failures. At handover, require the configuration in version control, the runbooks for adding a connection, revoking a vendor and restoring a recording, and a named list of the people trained to operate it. Confirm each item in the signed scope before work starts.
How DeployOpen scopes, builds and supports browser access
DeployOpen plans, implements, hardens, documents and supports self-hosted Apache Guacamole gateways inside your own cloud accounts, data centers or air-gapped networks. Each engagement starts with a written scope covering the hosts, protocols, identity sources and recording rules that your browser access must meet.
How we scope
- Inventory the RDP, SSH and VNC targets and name the owners who approve access to each one.
- Confirm the identity source, SSO protocol and MFA method for Guacamole and any policy layer in front of it.
- Agree in writing which sessions are recorded, where recordings are stored and how long they are kept.
How we build
- Deploy the Guacamole web application, guacd and the chosen authentication backend in your environment.
- Configure connection permissions by user group, and place authentik's RAC provider in front where policy-based access is required.
- Test login, MFA enforcement, permission boundaries and recording playback against the scope before go-live.
How we hand over
- Document the architecture, network placement, connection inventory and permission model for your own team.
- Provide runbooks for adding hosts, onboarding vendor accounts, revoking access and reviewing session recordings.
- Deliver test evidence and configuration records that your auditors can review alongside your control narrative.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Confirm with us the upgrade cadence for Guacamole, authentik and PostgreSQL, and who approves security patches.
