Add support for VMware Horizon SSO to gnome-shell

[Matthew Ruffell]

[Impact]

VMware Horizon is a VDI product that runs atop of VMware's normal virtualisation stack, and it supports SSO authentication for login.

In the past, the VMware Horizon agent has been pretty buggy, and requires SSO patches to be present to function, otherwise it breaks and causes entire outages for anyone trying to use the VDI.

To solve this, VMware had been custom compiling their own libgnome-shell.so libraries with their SSO patches, which are based on oVirt's SSO implementation. When you install VMware Horizon agent to the instance, it overwrites Ubuntu's libgnome-shell.so with their custom compiled one.

VMware don't keep their custom compiled libgnome-shell.so library up to date, so bugs that have already been fixed still live on in their library. Also, when Ubuntu updates our gnome-shell packages, it overwrites the custom libgnome-shell.so library, which then causes the Horizon agent to break, and causes outages for anyone using the VDI, which have to be solved by manually copying the custom library back.

This situation is untenable for VMware Horizon users, so I have asked VMware to upstream their SSO patches. After a long painful process, they have landed in gnome-shell master.

This SRU will significantly improve the quality of life for VMware Horizon users, and will remove the need for VMware to distribute custom libraries.

[Testcase]

You need an instance that runs on VMware Horizon, and the Horizon agent needs to be installed and running. Ideally, SSO authentication should be enabled to test all features, but it is not necessary to partially test.

Test packages are available in this ppa:
https://launchpad.net/~mruffell/+archive/ubuntu/sf247978-test

If you install the test package in a VMware Horizon VDI, the instance should come up cleanly after reboot and function properly, especially with SSO login.

The instance should be able to function without custom libgnome-shell.so libraries provided by VMware.

[Regression Potential]

The code refactors the oVirt SSO implementation into a more generalised interface, which other virtualisation platforms can use. oVirt has been transitioned to this interface as part of the refactoring, which means that any if the new oVirt SSO implementation is broken, it could break users running in oVirt.

VMware's patches also use the new generalised interface, which is much simpler than before, and it has been tested internally by VMware. There was a very long review process with upstream GNOME, which ironed out all of their concerns.

I have been reviewing the code along the way, and I am confident that it will not cause any regressions. If a regression did occur, then it would break SSO functionality only.

[Other Information]

Upstream Issue: https://gitlab.gnome.org/GNOME/gnome-shell/issues/1983
Upstream merge-request: https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/915

Commits:

commit 809f820cd4a4eebb120ab5dde3f1985d35bcb540
Author: yun341 <email address hidden>
Date: Sat, 4 Jan 2020 00:31:15 +0800
Subject: gdm: Refactor oVirt to a generic CredentialManager interface
Link: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/809f820cd4a4eebb120ab5dde3f1985d35bcb540

commit 4ea0fca4fc09ffd6e0b6994ee1354f07f7d5d2b5
Author: yun341 <email address hidden>
Date: Thu, 2 Jul 2020 06:54:55 +0800
Subject: gdm: Introduce vmware credential manager for pre-authenticated logins
Link: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/4ea0fca4fc09ffd6e0b6994ee1354f07f7d5d2b5

commit 00437750ed9c7e0982854e20be8c36c6bda7b254
Author: Andre Moreira Magalhaes <email address hidden>
Date: Mon Aug 17 18:41:04 2020 -0300
Subject: authPrompt: Properly get oVirt service name
Link: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/00437750ed9c7e0982854e20be8c36c6bda7b254

commit 3fb321fd214469130539e1e31461257a749bff21
Author: yun341 <email address hidden>
Date: Mon Sep 21 22:11:41 2020 +0800
Subject: authPrompt: set value of beginRequestType to 'DONT_PROVIDE_USERNAME'
Link: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/3fb321fd214469130539e1e31461257a749bff21

[Marco Trevisan (Treviño) (3v1n0)]

Is this something we need to get backported to focal?

As I don't think could be included in upstream's gnome-3-36 branch, so we'll have to carry the patch

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnome-shell - 3.37.91-1ubuntu1

---------------
gnome-shell (3.37.91-1ubuntu1) groovy; urgency=medium

  * Merge with debian, including new upstream release, remaining changes:
    - Replace gnome-backgrounds dep with ubuntu-wallpapers and Suggests
      gnome-themes-standard-data, gnome-backgrounds
    - Add some Recommends:
      + ubuntu-session (| gnome-session) to have the ubuntu session available
      + xserver-xorg-legacy
      + yaru-theme-gnome-shell for the default ubuntu theming
    - Update debian/gbp.conf with Ubuntu settings
    - gnome-shell-common.prerm: Remove deprecated ubuntu theme alternative
    - ubuntu/desktop_detect.patch:
      + add caching for desktop detection to avoid querying the current
        desktop env variable as iterate through the list each time. For the
        time of the Shell process, we can expect this env variable to stay
        stable.
    - ubuntu/smarter_alt_tab.patch:
      + quick alt-tab (without showing up the switcher) switch only between
        the last window of the last 2 applications to be focused instead of
        raising all windows of those apps.
    - ubuntu/lightdm-user-switching.patch:
      + Allow user switching when using LightDM.
    - ubuntu/lock_on_suspend.patch
      + Respect Ubuntu's lock-on-suspend setting.
    - ubuntu/background_login.patch
      + Change default background color as we modified the default GDM color
        for our ubuntu session.
    - ubuntu/gdm_alternatives.patch
      + Add support for GDM3 theme alternatives
    - optional-hot-corner.patch
      + enable patch proposed by upstream developer already in package (but
        not in series) to add a settings for optional hot corner activation.
    - main-show-an-error-message-on-gnome-shell-crash.patch,
      global-make-possible-to-set-debug-flags-dynamically.patch,
      main-increase-the-granularity-of-backtraces-in-SHELL_DEBU.patch,
      main-add-backtrace-crashes-all-and-backtrace-all.patch,
      sessionMode-add-support-for-debugFlags-parameter.patch:
      + Improve debug JS tracing for crash reports
    - st-scroll-view-Handle-the-case-where-scrollbars-are-NULL.patch:
      + Fix crash on theme changes
    - ubuntu/search-call-XUbuntuCancel-method-on-providers-when-no-dat.patch:
      + stop searches when requested from UI
    - magnifier-Show-cursor-when-magnifier-is-enabled-and-scale.patch:
      + Show monitor scaled cursor when magnifier is enabled
    - Break gnome-shell-extension-desktop-icons (<< 19.01.3+git20190814)
  * debian/patches: Refreshed
  * debian/control:
    - Set breaks on upcoming core extensions. This update is going to break
      them, so we need extensions updates before migra
    - Set breaks on upcoming yaru theme.
      There are not big deals using the current yaru, but better to wait for a
      suynced one.

gnome-shell (3.37.91-1) experimental; urgency=medium

  * New upstream release:
    - Inhibit remote access when disabled by session mode
    - Remove Frequent view from app picker
    - Allow rearranging items in app picker
    - Add support for parental controls filtering
    - Support pre-authenticated logins in vmware...

[Matthew Ruffell (mruffell)]

Attached is a debdiff for gnome-shell for Focal with the required patches to implement VMware Horizon SSO support.

[Matthew Ruffell (mruffell)]

Attached is a debdiff for Bionic which implements support for VMware Horizon SSO in gnome-shell.

[Brian Murray (brian-murray)]

Hello Matthew, or anyone else affected,

Accepted gnome-shell into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gnome-shell/3.36.7-0ubuntu0.20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Matthew, or anyone else affected,

Accepted gnome-shell into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gnome-shell/3.28.4-0ubuntu18.04.7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Amr Ibrahim (amribrahim1987)]

Please verify the fix in focal-proposed.

[Matthew Ruffell (mruffell)]

Performing verification for gnome-shell in Focal.

During this verification I will explain how VMware Horizon SSO works, and will prove that the gnome-shell in -proposed is equivalent to the custom gnome-shell package distributed by VMware.

I will begin by walking through the SSO workflow, based around the custom gnome-shell package distributed by VMware.

Firstly, start with a fresh Focal Desktop VM, all up to date.

Visit the VMware website, specifically this link:

https://my.vmware.com/en/web/vmware/evalcenter?p=horizon-eval-8

Sign up for a VMware account and reach the VMware Horizon 8 evaluation download page. The next step is to locate the "Linux Agent x86_64". The file is named

VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770.tar.gz

If you have difficulty in obtaining this file and want to reproduce, please message me.

Download and copy to the Focal VM.

$ scp VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770.tar.gz ubuntu@target:~/
$ ssh ubuntu@target
$ tar -xf VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770.tar.gz
$ cd VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770

Next, install the VMware Horizon Linux Agent by following the instructions at:

https://docs.vmware.com/en/VMware-Horizon-7/7.13/linux-desktops-setup/GUID-B4111821-34F2-465B-B290-FC2070EFCB5A.html

$ sudo apt install libpam-pkcs11
$ sudo apt install libnss3-tools
$ sudo apt install open-vm-tools
$ sudo ./install_viewagent.sh -T yes

Now, this will install a custom patched gnome-shell library, which contains the following patches:

https://paste.ubuntu.com/p/q4fkNrqHQT/

You can find this, and more in the VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770/sso directory.

Reboot the VM.

When it comes back up, run "ps aux". You will see:

oot 1410 0.0 0.1 345920 10840 ? Sl 15:09 0:00 /usr/lib/vmware/viewagent/DesktopDaemon/desktopDaemon
root 1411 2.1 0.1 77128 9208 ? Sl 15:09 0:00 /usr/lib/vmware/viewagent/VMwareBlastServer/BlastServer
root 1463 0.0 0.0 107056 6812 ? Sl 15:09 0:00 desktopWorker -x /usr/lib/vmware/viewagent/bin/StartXServer.sh -d :100 -s 1 -p 13
root 1477 1.4 0.7 1129928 61244 ? Sl 15:09 0:00 /usr/lib/xorg/Xorg :100 -auth /var/vmware/viewagent/xauth/.xauth:100 -once -query 127.0.0.1 -config /usr/lib/vmware/viewagent/resour
root 1530 0.0 0.1 177392 9172 ? Sl 15:09 0:00 gdm-session-worker [pam/gdm-launch-environment]
gdm 1535 0.0 0.0 5300 1108 ? Ss 15:09 0:00 dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
gdm 1536 0.2 0.0 7556 4672 ? S 15:09 0:00 dbus-daemon --nofork --print-address 4 --session
gdm 1537 0.3 0.2 568700 16920 ? Sl 15:09 0:00 /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

Now, the SSO desktop for the VDI is on xorg display :100, and all of this is launched by /usr/lib/vmware/viewagent/DesktopDaemon/desktopDaemon.

The dbus-run-session runs a bunch of autostart scripts in /usr/share/gdm/greeter/autostart, one of which starts up SsoDBusNotify.py.

Now, when /usr/lib/vmware/viewage...

[Matthew Ruffell (mruffell)]

Performing verification for gnome-shell in Bionic.

During this verification I will explain how VMware Horizon SSO works, and will prove that the gnome-shell in -proposed is equivalent to the custom gnome-shell package distributed by VMware.

I will begin by walking through the SSO workflow, based around the custom gnome-shell package distributed by VMware.

Firstly, start with a fresh Focal Desktop VM, all up to date.

Visit the VMware website, specifically this link:

https://my.vmware.com/en/web/vmware/evalcenter?p=horizon-eval-8

Sign up for a VMware account and reach the VMware Horizon 8 evaluation download page. The next step is to locate the "Linux Agent x86_64". The file is named

VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770.tar.gz

If you have difficulty in obtaining this file and want to reproduce, please message me.

Download and copy to the Focal VM.

$ scp VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770.tar.gz ubuntu@target:~/
$ ssh ubuntu@target
$ tar -xf VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770.tar.gz
$ cd VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770

Next, install the VMware Horizon Linux Agent by following the instructions at:

https://docs.vmware.com/en/VMware-Horizon-7/7.13/linux-desktops-setup/GUID-B4111821-34F2-465B-B290-FC2070EFCB5A.html

$ sudo apt install libpam-pkcs11
$ sudo apt install libnss3-tools
$ sudo apt install open-vm-tools
$ sudo apt install python python-dbus python-gobject
$ sudo ./install_viewagent.sh -T yes

Now, this will install a custom patched gnome-shell library, which contains the following patches:

https://paste.ubuntu.com/p/q4fkNrqHQT/

You can find this, and more in the VMware-horizonagent-linux-x86_64-2012-8.1.0-17336770/sso directory.

Reboot the VM.

When it comes back up, run "ps aux". You will see:

root 1406 0.0 0.0 4904 2020 ? S 15:53 0:00 /bin/sh /usr/lib/vmware/viewagent/bin/GetMachineId.sh
root 1447 0.0 0.2 404328 10968 ? Sl 15:53 0:00 /usr/lib/vmware/viewagent/DesktopDaemon/desktopDaemon
root 1449 2.2 0.2 102060 9060 ? Sl 15:53 0:02 /usr/lib/vmware/viewagent/VMwareBlastServer/BlastServer
root 1479 0.0 0.1 139968 6528 ? Sl 15:53 0:00 desktopWorker -x /usr/lib/vmware/viewagent/bin/StartXServer.sh -d :100 -s 1 -p 13
root 1488 0.2 1.4 611572 56464 ? Sl 15:53 0:00 /usr/lib/xorg/Xorg :100 -auth /var/vmware/viewagent/xauth/.xauth:100 -once -query 127.0.0.1 -config /usr/lib/vmware/viewagent/resource
root 1532 0.0 0.2 258560 8088 ? Sl 15:53 0:00 gdm-session-worker [pam/gdm-launch-environment]
gdm 1535 0.0 0.0 25464 1528 ? Ss 15:53 0:00 dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
gdm 1536 0.0 0.1 50244 4528 ? S 15:53 0:00 dbus-daemon --nofork --print-address 4 --session
gdm 1537 0.0 0.3 551880 13892 ? Sl 15:53 0:00 /usr/lib/gnome-session/gnome-session-binary --autostart /usr/share/gdm/greeter/autostart

Now, the SSO desktop for the VDI is on xorg display :100, and all of this is launched by /usr/lib/vmware/viewagent/DesktopDaemon/desktopDaemon.

The dbu...

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnome-shell - 3.36.7-0ubuntu0.20.04.1

---------------
gnome-shell (3.36.7-0ubuntu0.20.04.1) focal; urgency=medium

  [ Marco Trevisan (Treviño) ]
  * New upstream release (LP: #1903764)
    - Fix potential stack overflow in libcroco
    - Fix system action search regressions
    - Fix week number alignment when using font-scaling
    - Misc. bug fixes and cleanups
  * debian/patches:
    - Refresh
    - Handle screenshot failures gracefully (LP: #1908187)

  [ Matthew Ruffell ]
  * authPrompt-Properly-get-oVirt-service-name.patch,
    authPrompt-set-value-of-beginRequestType-to-DONT_PROVIDE_.patch,
    gdm-Introduce-vmware-credential-manager-for-pre-authentic.patch,
    gdm-Refactor-oVirt-to-a-generic-CredentialManager-interfa.patch:
    - Enable support for VMware Horizon SSO to ensure compatibility
      with the Horizon Agent (LP: #1886592)

gnome-shell (3.36.6-1ubuntu0.20.04.1) focal; urgency=medium

  * Merge with debian, containing new stable release (LP: #1896334)
  * debian/patches: Refresh, drop merged CVE-2020-17489.patch

gnome-shell (3.36.6-1) unstable; urgency=medium

  * Team upload

  * New upstream release

gnome-shell (3.36.5-1) unstable; urgency=medium

  * Team upload
  * New upstream release
    - Fix password briefly showing on login dialog during logout if it
      was previously made visible (CVE-2020-17489, Closes: #968311)
  * Drop most patches, applied upstream

 -- Marco Trevisan (Treviño) <email address hidden> Tue, 15 Dec 2020 05:54:44 +0100

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for gnome-shell has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnome-shell - 3.28.4-0ubuntu18.04.7

---------------
gnome-shell (3.28.4-0ubuntu18.04.7) bionic; urgency=medium

  [ Matthew Ruffell ]
  * d/p/authPrompt-Properly-get-oVirt-service-name.patch,
    d/p/authPrompt-set-value-of-beginRequestType-to-DONT_PROVIDE_.patch,
    d/p/gdm-Introduce-vmware-credential-manager-for-pre-authentic.patch,
    d/p/gdm-Refactor-oVirt-to-a-generic-CredentialManager-interfa.patch:
    - Enable support for VMware Horizon SSO to ensure compatibility
      with the Horizon Agent (LP: #1886592)

  [ Marco Trevisan (Treviño) ]
  * debian/patches: Rename VMWare OVirt patches to use Gbp-Pq format

gnome-shell (3.28.4-0ubuntu18.04.6) bionic; urgency=medium

  - d/p/util-cache-local-GTimeZone.patch
    d/p/ShellAppCache-add-cache-to-help-keep-I-O-off-main-thread.patch,
    d/p/appDisplay-use-ShellAppCache-to-translate-folder-names.patch,
    d/p/appDisplay-use-ShellAppCache-to-access-GAppInfo.patch,
    d/p/Revert-appDisplay-use-ShellAppCache-to-access-GAppInfo.patch,
    d/p/Revert-appDisplay-use-ShellAppCache-to-translate-folder-n.patch,
    d/p/Revert-ShellAppCache-add-cache-to-help-keep-I-O-off-main-.patch,
    d/p/Revert-util-cache-local-GTimeZone.patch:
    + Include all the upstream patches to fix notification freezes
      (LP: #1838152).
  - d/p/series: Reorder so that upstream fixes come first

gnome-shell (3.28.4-0ubuntu18.04.5) bionic; urgency=medium

  * d/p/keyboardManager_apply-added-input-sources-instantly.patch:
    - Renamed to keyboardManager-Avoid-idempotent-calls-to-meta_backend_se.patch
    - Fixed DEP-3 tagging, and update them as per upstream cherry-pick
  * d/p/shell-global-Make-saving-of-persistent-state-asynchronous.patch:
    - Make saving of persistent state asynchronous (LP: #1838152)

gnome-shell (3.28.4-0ubuntu18.04.4) bionic; urgency=medium

  * d/p/keyboardManager_apply-added-input-sources-instantly.patch:
    - Make added input sources work instantly without relogin/reboot
      or other tricks (LP: #1890875).

 -- Marco Trevisan (Treviño) <email address hidden> Wed, 16 Dec 2020 01:24:41 +0100