Need help with Entra ID and OIDC

[klglitch]

Hi,

I have troubles setting up entra id as oidc.
I get the following error:

OIDC callback error from provider: invalid_client -AADSTS650053: The application 'RUSTGUAC SSO' asked for scope 'groups' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the app vendor. Trace ID: 1060792c-113e-4ffa-a1a0-f41529fe5c00 Correlation ID:ffe2e6d1-24e1-4868-9bc0-1f9aeaf04a39 Timestamp:2026-05-29 10:14:36Z

It's my first time using entra id with OIDC.
Maybe you can explain me what I need to change.

Thanks for your support and this great application.

[davekempe]

Thanks @klglitch, this is an entra-side config thing rather than a rustguac issue. Entra doesn't actually have a groups scope - groups come back as a claim in the ID token, not via a scope request. AADSTS650053 is entra telling us exactly that. Our example in docs/integrations.md uses extra_scopes = ["groups"] which works for Authentik / Keycloak / JumpCloud but trips up entra setups, sorry, that's a docs gap on our side.

Two things to fix it:

1. In your config.toml, drop the extra_scopes = ["groups"] line (or set it to []). Leave groups_claim = "groups" as the default.
2. In the entra portal, go to your app registration → Token configuration → Add groups claim, tick ID token, and pick Security groups (or All groups if you also use distribution lists). By default the claim emits group object IDs. If you'd rather have group names, expand the optional settings and pick sAMAccountName, but then any group-to-role mappings you set up in rustguac admin need to reference those names.

Restart rustguac after the config change and login should work. Seen groups will populate in admin so you can wire up role mappings from there.

I'll add an entra-specific section to docs/integrations.md so the next person doesn't trip on the same example. Let us know how you go.

[klglitch]

Thank you Dave!
It works now like a charm.
But now i have troubles with the drive mapping... i get the following errors:

Jun 01 09:54:49 datsvguac01 guacd[51057]: Cannot create static channel "rdpdr": failed to load "guac-common-svc" plugin for FreeRDP.
Jun 01 09:54:49 datsvguac01 guacd[51057]: guacd[51057]: WARNING: Cannot create static channel "rdpdr": failed to load "guac-common-svc" plugin for FreeRDP.
Jun 01 09:54:49 datsvguac01 guacd[51057]: guacd[51057]: WARNING: Support for the RDPDR channel (device redirection) could not be loaded. Drive redirection and printing will not work. Sound MAY not work.
Jun 01 09:54:49 datsvguac01 guacd[51057]: guacd[51057]: WARNING: Cannot create static channel "rdpsnd": failed to load "guac-common-svc" plugin for FreeRDP.
Jun 01 09:54:49 datsvguac01 guacd[51057]: guacd[51057]: WARNING: Support for the RDPSND channel (audio output) could not be loaded. Sound will not work. Drive redirection and printing MAY not work.
Jun 01 09:54:49 datsvguac01 guacd[51057]: Support for the RDPDR channel (device redirection) could not be loaded. Drive redirection and printing will not work. Sound MAY not work.
Jun 01 09:54:49 datsvguac01 guacd[51057]: Cannot create static channel "rdpsnd": failed to load "guac-common-svc" plugin for FreeRDP.
Jun 01 09:54:49 datsvguac01 guacd[51057]: Support for the RDPSND channel (audio output) could not be loaded. Sound will not work. Drive redirection and printing MAY not work.

from old issues i found you wrote this happens when freerdp3 is not installed but it is:

root@datsvguac01:/opt/rustguac# sudo apt-get install freerdp3-dev
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
freerdp3-dev is already the newest version (3.5.1+dfsg1-0ubuntu1.5).
0 upgraded, 0 newly installed, 0 to remove and 5 not upgraded.

what I am missing?

here the logs from rustguac:

Jun 01 09:54:49 datsvguac01 rustguac[50650]: 2026-06-01T09:54:49.689954Z INFO rustguac::session: Creating new RDP session session_id=f5702ee2-ffec-4d0f-b04a-ccd4b711ac67 hostname=10.121.220.51 username=XXXXX width=2548 height=1307 dpi=96
Jun 01 09:54:49 datsvguac01 rustguac[50650]: 2026-06-01T09:54:49.689961Z INFO rustguac::session: Drive configuration session_id=f5702ee2-ffec-4d0f-b04a-ccd4b711ac67 drive_enabled=true entry_enable_drive=Some(true) has_drive_config=true drive_path="/mnt/rustguac-drives"
Jun 01 09:54:49 datsvguac01 rustguac[50650]: 2026-06-01T09:54:49.690049Z INFO rustguac::drive: Created session drive directory: "/mnt/rustguac-drives/f5702ee2-ffec-4d0f-b04a-ccd4b711ac67" session_id=f5702ee2-ffec-4d0f-b04a-ccd4b711ac67
Jun 01 09:54:49 datsvguac01 rustguac[50650]: 2026-06-01T09:54:49.690054Z INFO rustguac::session: RDP session params session_id=f5702ee2-ffec-4d0f-b04a-ccd4b711ac67 ignore_cert=true security=None enable_drive=true drive_path=Some("/mnt/rustguac-drives/f5702ee2-ffec-4d0f-b04a-ccd4b711ac67") domain=None has_password=true
Jun 01 09:54:49 datsvguac01 rustguac[50650]: 2026-06-01T09:54:49.741801Z INFO rustguac::guacd: guacd handshake complete, connection_id=$79447ea7-32b6-4c40-8360-6b3a04ea599f
Jun 01 09:54:49 datsvguac01 rustguac[50650]: 2026-06-01T09:54:49.741829Z INFO rustguac::session: guacd connection established session_id=f5702ee2-ffec-4d0f-b04a-ccd4b711ac67 connection_id=$79447ea7-32b6-4c40-8360-6b3a04ea599f
Jun 01 09:54:49 datsvguac01 rustguac[50650]: 2026-06-01T09:54:49.746405Z INFO rustguac::api: Address book session created user=XXXXXXX session_id=f5702ee2-ffec-4d0f-b04a-ccd4b711ac67

Installation is Bare-metal on Ubuntu 24.04 LTS

[davekempe]

Glad OIDC's sorted! The drive/audio error is a separate thing and unfortunately it's a known mismatch when running our .deb on Ubuntu 24.04.

Short version: Ubuntu 24.04 ships FreeRDP 3.5.1, but our .deb is built on Debian 13 against FreeRDP 3.15+. The two have different ABIs. The guac-common-svc plugin loads at runtime via FreeRDP's plugin loader, which silently fails symbol resolution against the wrong FreeRDP version. Display works (different code path), drive + audio don't. That's exactly what you're seeing in the logs.

Two ways forward:

1. Run the Docker image instead (recommended). It bundles guacd, FreeRDP, and everything else as a self-contained artifact, so it runs cleanly on Ubuntu without the ABI dance:

   docker pull sol1/rustguac:latest

   This is the supported path for non-Debian-13 hosts.

2. Build from source on your Ubuntu 24.04 box against system FreeRDP 3.5. This is doable but untested by us. The trick is to skip our patches/ directory (those target 3.15+ deprecations that don't exist in 3.5) and build guacd directly against the system libfreerdp. Full recipe is in docs/installation.md > Other Linux distributions.

Both options are now documented in v1.7.2's installation docs.

We don't officially support Ubuntu 24.04 as a bare-metal target (no CI coverage, no testing) and won't be shipping a 24.04-specific .deb. The Docker image is the way for any non-Debian-13 host. Sorry for the rough edge here, and thanks for the detailed report - it prompted us to write the docs section.