RHBK + AD + Guacamole Demo Complete Deployment Guide

dnf install -y podman podman-compose vim curl wget jq openldap-clients
        
        MYIP=$(hostname -I | awk '{print $1}')
        echo "${MYIP} sso.wzhlab.top" >> /etc/hosts
        echo "${MYIP} workplace.wzhlab.top" >> /etc/hosts
        
        podman network create corp-demo

mkdir -p ~/corp-rhbk-demo/{ldap-seed,linux-desktop,postgres-init,guacamole-init,nginx,keycloak-spi,guac-sync}

cat > ~/corp-rhbk-demo/postgres-init/init.sql << 'EOF'
        CREATE DATABASE keycloak;
        CREATE USER keycloak WITH PASSWORD 'KeycloakDB2024!';
        GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
        ALTER DATABASE keycloak OWNER TO keycloak;
        CREATE DATABASE guacamole;
        CREATE USER guacamole WITH PASSWORD 'GuacamoleDB2024!';
        GRANT ALL PRIVILEGES ON DATABASE guacamole TO guacamole;
        ALTER DATABASE guacamole OWNER TO guacamole;
        EOF
        
        podman run -d \
          --name postgres --network corp-demo \
          -e POSTGRES_USER=admin -e POSTGRES_PASSWORD='PgAdmin2024!' \
          -v ~/corp-rhbk-demo/postgres-init/init.sql:/docker-entrypoint-initdb.d/init.sql:Z \
          -v postgres-data:/var/lib/postgresql/data \
          -p 5432:5432 docker.io/postgres:15
        
        sleep 20
        
        # Initialize Guacamole Schema
        
        podman run --rm docker.io/guacamole/guacamole:1.6.0 \
          /opt/guacamole/bin/initdb.sh --postgresql > ~/corp-rhbk-demo/guacamole-init/initdb.sql
        podman cp ~/corp-rhbk-demo/guacamole-init/initdb.sql postgres:/tmp/initdb.sql
        podman exec postgres psql -U guacamole -d guacamole -f /tmp/initdb.sql 2>&1 | tail -3

podman run -d \
          --name samba-ad --hostname ad.wzhlab.top --network corp-demo --privileged \
          -e DOMAIN=WZHLAB.TOP -e DOMAINPASS='CorpAD2024!' \
          -e DNSFORWARDER=8.8.8.8 -e HOSTIP=0.0.0.0 \
          -v samba-data:/var/lib/samba \
          docker.io/nowsci/samba-domain
        
        sleep 40
        
        # ⚠️ Required: Disable strong TLS (lost after container restart, must be re-executed)
        
        podman exec samba-ad bash -c \
          "grep -q 'ldap server require strong auth' /etc/samba/smb.conf || \
           sed -i '/\[global\]/a\        ldap server require strong auth = no' /etc/samba/smb.conf"
        podman exec samba-ad supervisorctl restart samba
        sleep 10
        
        # Create AD users
        
        for user_info in "kim.minsoo Minsoo Kim kim.minsoo@wzhlab.top" \
                          "park.jiyeon Jiyeon Park park.jiyeon@wzhlab.top" \
                          "lee.seungho Seungho Lee lee.seungho@wzhlab.top"; do
          set -- $user_info
          podman exec samba-ad samba-tool user create $1 'Password123!' \
            --given-name=$2 --surname=$3 --mail-address=$4
        done

cat > ~/corp-rhbk-demo/ldap-seed/01-structure.ldif << 'EOF'
        dn: ou=People,dc=wzhlab,dc=top
        objectClass: organizationalUnit
        ou: People
        EOF
        
        cat > ~/corp-rhbk-demo/ldap-seed/02-users.ldif << 'EOF'
        dn: uid=kim.minsoo.dev,ou=People,dc=wzhlab,dc=top
        objectClass: inetOrgPerson
        objectClass: posixAccount
        objectClass: shadowAccount
        uid: kim.minsoo.dev
        cn: Kim Minsoo Dev
        sn: Kim
        uidNumber: 10001
        gidNumber: 10001
        homeDirectory: /home/kim.minsoo.dev
        loginShell: /bin/bash
        userPassword: DemoPass2024!
        description: vm=linux-vm-1 ad=kim.minsoo label=Personal Dev
        
        dn: uid=kim.minsoo.test,ou=People,dc=wzhlab,dc=top
        objectClass: inetOrgPerson
        objectClass: posixAccount
        objectClass: shadowAccount
        uid: kim.minsoo.test
        cn: Kim Minsoo Test
        sn: Kim
        uidNumber: 10002
        gidNumber: 10002
        homeDirectory: /home/kim.minsoo.test
        loginShell: /bin/bash
        userPassword: DemoPass2024!
        description: vm=linux-vm-3 ad=kim.minsoo label=Personal Test
        
        dn: uid=team-ai-shared,ou=People,dc=wzhlab,dc=top
        objectClass: inetOrgPerson
        objectClass: posixAccount
        objectClass: shadowAccount
        uid: team-ai-shared
        cn: AI Team Shared Account
        sn: AI-Team
        uidNumber: 10003
        gidNumber: 10003
        homeDirectory: /home/team-ai-shared
        loginShell: /bin/bash
        userPassword: DemoPass2024!
        description: vm=linux-vm-2 ad=kim.minsoo,park.jiyeon,lee.seungho label=Team AI Shared
        
        dn: uid=park.jiyeon.dev,ou=People,dc=wzhlab,dc=top
        objectClass: inetOrgPerson
        objectClass: posixAccount
        objectClass: shadowAccount
        uid: park.jiyeon.dev
        cn: Park Jiyeon Dev
        sn: Park
        uidNumber: 10004
        gidNumber: 10004
        homeDirectory: /home/park.jiyeon.dev
        loginShell: /bin/bash
        userPassword: DemoPass2024!
        description: vm=linux-vm-1 ad=park.jiyeon label=Personal Dev
        
        dn: uid=lee.seungho.dev,ou=People,dc=wzhlab,dc=top
        objectClass: inetOrgPerson
        objectClass: posixAccount
        objectClass: shadowAccount
        uid: lee.seungho.dev
        cn: Lee Seungho Dev
        sn: Lee
        uidNumber: 10005
        gidNumber: 10005
        homeDirectory: /home/lee.seungho.dev
        loginShell: /bin/bash
        userPassword: DemoPass2024!
        description: vm=linux-vm-3 ad=lee.seungho label=Personal Dev
        EOF

podman run -d \
          --name openldap --hostname ldap.wzhlab.top --network corp-demo \
          -e LDAP_ORGANISATION="Corp" -e LDAP_DOMAIN="wzhlab.top" \
          -e LDAP_ADMIN_PASSWORD="LdapAdmin2024!" -e LDAP_BASE_DN="dc=wzhlab,dc=top" \
          -v openldap-data:/var/lib/ldap -v openldap-config:/etc/ldap/slapd.d \
          docker.io/osixia/openldap:1.5.0
        
        sleep 20
        
        LDAP_IP=$(podman inspect openldap --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
        ldapadd -x -H ldap://${LDAP_IP}:389 -D "cn=admin,dc=wzhlab,dc=top" -w "LdapAdmin2024!" \
          -f ~/corp-rhbk-demo/ldap-seed/01-structure.ldif
        ldapadd -x -H ldap://${LDAP_IP}:389 -D "cn=admin,dc=wzhlab,dc=top" -w "LdapAdmin2024!" \
          -f ~/corp-rhbk-demo/ldap-seed/02-users.ldif

LDAP_IP=$(podman inspect openldap --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
        ldapsearch -x -H ldap://${LDAP_IP}:389 -D "cn=admin,dc=wzhlab,dc=top" -w "LdapAdmin2024!" \
          -b "ou=People,dc=wzhlab,dc=top" "(objectClass=posixAccount)" uid description 2>&1 | \
          grep -E "uid:|description:"
        
        # Should show 5 uids, each with a structured description (vm=... ad=... label=...)

cat > ~/corp-rhbk-demo/linux-desktop/entrypoint.sh << 'ENTRYEOF'
        #!/bin/bash
        set -e
        LDAP_SERVER=${LDAP_SERVER:-ldap://openldap:389}
        LDAP_BASE_DN=${LDAP_BASE_DN:-dc=wzhlab,dc=top}
        LDAP_BIND_DN=${LDAP_BIND_DN:-cn=admin,dc=wzhlab,dc=top}
        LDAP_BIND_PW=${LDAP_BIND_PW:-LdapAdmin2024!}
        
        cat > /etc/nslcd.conf << EOF
        uid nslcd
        gid ldap
        uri ${LDAP_SERVER}
        base ${LDAP_BASE_DN}
        binddn ${LDAP_BIND_DN}
        bindpw ${LDAP_BIND_PW}
        ssl no
        tls_cacertdir /etc/openldap/certs
        EOF
        chmod 600 /etc/nslcd.conf
        
        cat > /etc/nsswitch.conf << EOF
        passwd:     files ldap
        shadow:     files ldap
        group:      files ldap
        hosts:      files dns
        EOF
        
        cat > /etc/pam.d/system-auth << 'PAMEOF'
        #%PAM-1.0
        auth        required      pam_env.so
        auth        sufficient    pam_unix.so try_first_pass nullok
        auth        sufficient    pam_ldap.so try_first_pass
        auth        required      pam_deny.so
        account     required      pam_unix.so
        account     sufficient    pam_ldap.so
        account     required      pam_permit.so
        password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3
        password    sufficient    pam_unix.so try_first_pass use_authtok nullok sha512 shadow
        password    sufficient    pam_ldap.so use_authtok
        password    required      pam_deny.so
        session     optional      pam_keyinit.so revoke
        session     required      pam_limits.so
        session     required      pam_unix.so
        session     optional      pam_ldap.so
        session     optional      pam_mkhomedir.so skel=/etc/skel umask=0077
        PAMEOF
        cp /etc/pam.d/system-auth /etc/pam.d/password-auth
        
        # Disable XFCE PolicyKit Agent (container has no polkitd)
        
        echo "Hidden=true" >> /etc/xdg/autostart/xfce-polkit.desktop 2>/dev/null || true
        mkdir -p /etc/skel/.config/autostart
        printf "[Desktop Entry]\nHidden=true\n" > /etc/skel/.config/autostart/xfce-polkit.desktop
        
        /usr/sbin/nslcd 2>/dev/null || true
        sleep 2
        getent passwd kim.minsoo.dev >/dev/null 2>&1 && echo "LDAP OK" || echo "WARN: LDAP not ready"
        
        [ ! -f /etc/xrdp/cert.pem ] && openssl req -x509 -newkey rsa:2048 \
          -keyout /etc/xrdp/key.pem -out /etc/xrdp/cert.pem \
          -days 365 -nodes -subj "/CN=$(hostname)" 2>/dev/null
        
        if [ -f /etc/xrdp/sesman.ini ]; then
          grep -q 'KillDisconnected' /etc/xrdp/sesman.ini || echo 'KillDisconnected=false' >> /etc/xrdp/sesman.ini
          grep -q 'DisconnectedTimeLimit' /etc/xrdp/sesman.ini || echo 'DisconnectedTimeLimit=259200' >> /etc/xrdp/sesman.ini
          grep -q 'IdleTimeLimit' /etc/xrdp/sesman.ini || echo 'IdleTimeLimit=0' >> /etc/xrdp/sesman.ini
        fi
        
        sed -i 's|DefaultWindowManager=.*|DefaultWindowManager=/etc/xrdp/startwm.sh|' /etc/xrdp/sesman.ini 2>/dev/null || true
        
        cat > /etc/xrdp/startwm.sh << 'WMEOF'
        #!/bin/bash
        unset DBUS_SESSION_BUS_ADDRESS
        unset XDG_RUNTIME_DIR
        if which dbus-launch > /dev/null 2>&1; then
          exec dbus-launch --exit-with-session startxfce4
        else
          exec startxfce4
        fi
        WMEOF
        chmod +x /etc/xrdp/startwm.sh
        
        /usr/sbin/xrdp-sesman --nodaemon &
        sleep 2
        exec /usr/sbin/xrdp --nodaemon
        ENTRYEOF

cat > ~/corp-rhbk-demo/linux-desktop/Dockerfile << 'DOCKEREOF'
        FROM docker.io/rockylinux:9
        RUN dnf install -y epel-release && dnf update -y
        RUN dnf groupinstall -y "Xfce" && \
            dnf install -y xrdp xorgxrdp tigervnc-server dbus-x11 \
            nss-pam-ldapd openldap-clients oddjob-mkhomedir sudo vim passwd openssl && \
            dnf clean all
        RUN sed -i 's/^max_bpp=.*/max_bpp=24/' /etc/xrdp/xrdp.ini 2>/dev/null || true
        COPY entrypoint.sh /entrypoint.sh
        RUN chmod +x /entrypoint.sh
        EXPOSE 3389
        CMD ["/entrypoint.sh"]
        DOCKEREOF

cd ~/corp-rhbk-demo/linux-desktop
        nohup podman build -t corp-linux-desktop:latest . > /tmp/docker-build.log 2>&1 &
        echo "Build PID: $! - Monitor: tail -f /tmp/docker-build.log"
        
        # Wait 5-15 minutes
        
        # Start 3 VMs after build completes
        
        for name in linux-vm-1 linux-vm-2 linux-vm-3; do
          hostname_map=("dev-workstation-01" "ai-gpu-server-02" "test-env-03")
          idx=0; [[ $name == "linux-vm-2" ]] && idx=1; [[ $name == "linux-vm-3" ]] && idx=2
          podman run -d \
            --name $name --hostname ${hostname_map[$idx]} --network corp-demo --privileged \
            -e LDAP_SERVER=ldap://openldap:389 \
            -e LDAP_BASE_DN=dc=wzhlab,dc=top \
            -e LDAP_BIND_DN=cn=admin,dc=wzhlab,dc=top \
            -e LDAP_BIND_PW=LdapAdmin2024! \
            corp-linux-desktop:latest
        done
        sleep 25

podman run -d --name guacd --network corp-demo docker.io/guacamole/guacd:1.6.0

podman run -d \
          --name guacamole --hostname workplace.wzhlab.top --network corp-demo \
          -e GUACD_HOSTNAME=guacd -e GUACD_PORT=4822 \
          -e POSTGRESQL_HOSTNAME=postgres -e POSTGRESQL_PORT=5432 \
          -e POSTGRESQL_DATABASE=guacamole -e POSTGRESQL_USER=guacamole \
          -e POSTGRESQL_PASSWORD='GuacamoleDB2024!' \
          -e POSTGRESQL_AUTO_CREATE_ACCOUNTS=true \
          -e OPENID_ENABLED=true \
          -e OPENID_AUTHORIZATION_ENDPOINT=http://sso.wzhlab.top:8080/realms/corp/protocol/openid-connect/auth \
          -e OPENID_JWKS_ENDPOINT=http://keycloak:8080/realms/corp/protocol/openid-connect/certs \
          -e OPENID_ISSUER=http://sso.wzhlab.top:8080/realms/corp \
          -e OPENID_CLIENT_ID=guacamole \
          -e OPENID_REDIRECT_URI=http://workplace.wzhlab.top:8888/guacamole/ \
          -e "OPENID_SCOPE=openid email profile" \
          -e OPENID_USERNAME_CLAIM_TYPE=preferred_username \
          -e EXTENSION_PRIORITY=openid \
          docker.io/guacamole/guacamole:1.6.0
        sleep 20

        # Use Python to write the file (avoids shell quote nesting issues)
        
        cat << 'PYEOF' | base64 | ssh root@<server-ip> 'base64 -d > /tmp/mk_nginx.py && python3 /tmp/mk_nginx.py'
        import os
        js = (
            "(function(){var _o=XMLHttpRequest.prototype.open,_s=XMLHttpRequest.prototype.send;"
            "XMLHttpRequest.prototype.open=function(m,u){this._lg=(m==='DELETE'&&u&&u.indexOf('api/session')!==-1);return _o.apply(this,arguments);};"
            "XMLHttpRequest.prototype.send=function(){if(this._lg){"
            "var u='http://sso.wzhlab.top:8080/realms/corp/protocol/openid-connect/logout?client_id=guacamole&post_logout_redirect_uri='+encodeURIComponent('http://workplace.wzhlab.top:8888/guacamole/');"
            "_s.apply(this,arguments);setTimeout(function(){window.location.replace(u);},200);return;}"
            "return _s.apply(this,arguments);};}());"
        )
        sf = "<head><script>" + js + "</script>"
        content = r"""events { worker_connections 1024; }
        http { server { listen 80; server_name _;
          sub_filter '<head>' '""" + sf.replace("'", "\\'") + r"""';
          sub_filter_once on; sub_filter_types text/html;
          location /guacamole/ {
            proxy_pass http://guacamole:8080/guacamole/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Accept-Encoding "";
            proxy_read_timeout 3600; proxy_send_timeout 3600;
            proxy_buffering off;
          }
          location = / { return 301 /guacamole/; }
        } }
        """
        os.makedirs('/root/corp-rhbk-demo/nginx', exist_ok=True)
        with open('/root/corp-rhbk-demo/nginx/nginx.conf', 'w') as f: f.write(content)
        print('nginx.conf created')
        PYEOF
        
        podman run -d \
          --name nginx-proxy --network corp-demo \
          -v ~/corp-rhbk-demo/nginx/nginx.conf:/etc/nginx/nginx.conf:ro,Z \
          -p 8888:80 docker.io/nginx:alpine

scp -r files/keycloak-guac-webhook/ root@<server-ip>:~/corp-rhbk-demo/keycloak-spi/
        
        mkdir -p ~/.m2
        podman run --rm \
          -v ~/corp-rhbk-demo/keycloak-spi:/project:Z \
          -v ~/.m2:/root/.m2:Z \
          docker.io/maven:3.9-eclipse-temurin-21 \
          mvn -f /project/pom.xml package -q -DskipTests 2>&1
        
        cp ~/corp-rhbk-demo/keycloak-spi/target/keycloak-guac-webhook.jar \
           ~/corp-rhbk-demo/keycloak-spi/keycloak-guac-webhook.jar
        ls -lh ~/corp-rhbk-demo/keycloak-spi/keycloak-guac-webhook.jar  # Should be ~5-6K

podman run -d \
          --name keycloak --hostname sso.wzhlab.top --network corp-demo \
          -e KEYCLOAK_ADMIN=admin \
          -e KEYCLOAK_ADMIN_PASSWORD='KeycloakAdmin2024!' \
          -e KC_DB=postgres \
          -e KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak \
          -e KC_DB_USERNAME=keycloak -e KC_DB_PASSWORD='KeycloakDB2024!' \
          -e KC_HOSTNAME_STRICT=false -e KC_HTTP_ENABLED=true \
          -e KC_PROXY_HEADERS=xforwarded \
          -e KC_WEBHOOK_URL=http://guac-ldap-sync:5000 \
          -v ~/corp-rhbk-demo/keycloak-spi/keycloak-guac-webhook.jar:/opt/keycloak/providers/keycloak-guac-webhook.jar:Z,ro \
          -p 8080:8080 \
          quay.io/keycloak/keycloak:26.4 start-dev
        
        sleep 60
        
        # Verify SPI is loaded
        
        podman logs keycloak 2>&1 | grep "guac-webhook"
        
        # Should see: [guac-webhook] Initialized. Webhook base URL: http://guac-ldap-sync:5000

podman exec keycloak /opt/keycloak/bin/kcadm.sh config credentials \
          --server http://localhost:8080 --realm master \
          --user admin --password 'KeycloakAdmin2024!'
        
        # Create corp Realm
        
        podman exec keycloak /opt/keycloak/bin/kcadm.sh create realms \
          -s realm=corp -s enabled=true -s displayName="Corp SSO" \
          -s loginWithEmailAllowed=false -s registrationAllowed=false
        
        # AD Federation (use container DNS name; no issue if IP changes after restart)
        
        COMP_ID=$(podman exec keycloak /opt/keycloak/bin/kcadm.sh create components \
          -r corp \
          -s name="Corp Active Directory" \
          -s providerId=ldap \
          -s providerType=org.keycloak.storage.UserStorageProvider \
          -s 'config.vendor=["ad"]' \
          -s 'config.usernameLDAPAttribute=["sAMAccountName"]' \
          -s 'config.rdnLDAPAttribute=["cn"]' \
          -s 'config.uuidLDAPAttribute=["objectGUID"]' \
          -s 'config.userObjectClasses=["person, organizationalPerson, user"]' \
          -s 'config.connectionUrl=["ldap://samba-ad:389"]' \
          -s 'config.usersDn=["CN=Users,DC=WZHLAB,DC=TOP"]' \
          -s 'config.authType=["simple"]' \
          -s 'config.bindDn=["CN=Administrator,CN=Users,DC=WZHLAB,DC=TOP"]' \
          -s 'config.bindCredential=["CorpAD2024!"]' \
          -s 'config.searchScope=["2"]' \
          -s 'config.editMode=["READ_ONLY"]' \
          -s 'config.importEnabled=["true"]' \
          -s 'config.connectionPooling=["true"]' \
          -i 2>&1)
        echo "Federation ID: $COMP_ID"
        podman exec keycloak /opt/keycloak/bin/kcadm.sh create \
          "user-storage/${COMP_ID}/sync?action=triggerFullSync" -r corp 2>&1
        
        # Guacamole OIDC Client (⚠️ implicitFlowEnabled must be true)
        
        podman exec keycloak /opt/keycloak/bin/kcadm.sh create clients -r corp \
          -s clientId=guacamole -s name="Virtual Workplace Demo" \
          -s enabled=true -s publicClient=true \
          -s 'standardFlowEnabled=true' -s 'implicitFlowEnabled=true' \
          -s 'rootUrl=http://workplace.wzhlab.top:8888/guacamole/' \
          -s 'baseUrl=http://workplace.wzhlab.top:8888/guacamole/' \
          -s 'redirectUris=["http://workplace.wzhlab.top:8888/*"]' \
          -s 'webOrigins=["*"]'
        
        # Configure post_logout_redirect_uris
        
        python3 -c "
        import urllib.request, urllib.parse, json
        td = urllib.parse.urlencode({'client_id':'admin-cli','username':'admin',
          'password':'KeycloakAdmin2024!','grant_type':'password'}).encode()
        req = urllib.request.Request('http://localhost:8080/realms/master/protocol/openid-connect/token',data=td,method='POST')
        with urllib.request.urlopen(req) as r: token = json.loads(r.read())['access_token']
        req = urllib.request.Request('http://localhost:8080/admin/realms/corp/clients?clientId=guacamole',
          headers={'Authorization':f'Bearer {token}'})
        with urllib.request.urlopen(req) as r: client = json.loads(r.read())[0]
        client['attributes']['post.logout.redirect.uris'] = 'http://workplace.wzhlab.top:8888/*'
        data = json.dumps(client).encode()
        req = urllib.request.Request(f'http://localhost:8080/admin/realms/corp/clients/{client[\"id\"]}',
          data=data, method='PUT', headers={'Authorization':f'Bearer {token}','Content-Type':'application/json'})
        with urllib.request.urlopen(req) as r: print('Update:', r.status)
        "
        
        # Enable guac-webhook Event Listener (one-time; persisted in PostgreSQL)
        
        podman exec keycloak /opt/keycloak/bin/kcadm.sh update realms/corp \
          -r corp -s 'eventsListeners=["jboss-logging","guac-webhook"]'

scp -r files/keycloak-guac-webhook/guac-sync/ root@<server-ip>:~/corp-rhbk-demo/
        
        cd ~/corp-rhbk-demo/guac-sync
        cat > requirements.txt << 'EOF'
        flask>=3.0
        ldap3>=2.9
        psycopg2-binary>=2.9
        requests>=2.31
        EOF
        podman build -t guac-ldap-sync:latest .
        
        podman run -d \
          --name guac-ldap-sync --network corp-demo \
          -e LDAP_URL=ldap://openldap:389 \
          -e LDAP_BIND_DN=cn=admin,dc=wzhlab,dc=top \
          -e LDAP_BIND_PW=LdapAdmin2024! \
          -e LDAP_BASE=ou=People,dc=wzhlab,dc=top \
          -e PG_HOST=postgres -e PG_DB=guacamole \
          -e PG_USER=guacamole -e PG_PASS=GuacamoleDB2024! \
          -e RDP_PASSWORD=DemoPass2024! \
          -e GUAC_BACKEND=http://guacamole:8080 \
          -p 5000:5000 guac-ldap-sync:latest
        
        sleep 15
        curl -s http://localhost:5000/health

echo "=== Container Status (should be 11) ==="
        podman ps --format "table {{.Names}}\t{{.Status}}" | sort
        
        echo "=== AD Authentication Test ==="
        for u in kim.minsoo park.jiyeon lee.seungho; do
          R=$(curl -s -X POST http://localhost:8080/realms/corp/protocol/openid-connect/token \
            -d "client_id=guacamole&grant_type=password&username=$u&password=Password123!" | \
            python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token_type',d.get('error')))")
          echo "  $u: $R"
        done
        
        echo "=== SPI Verification ==="
        podman logs keycloak 2>&1 | grep "guac-webhook" | tail -3
        
        echo "=== Guacamole HTTP ==="
        curl -s -o /dev/null -w "HTTP %{http_code}" http://localhost:8888/guacamole/
        
        echo "=== Logout JS Injection ==="
        curl -s http://localhost:8888/guacamole/ | grep -c "api/session"
        
        # Should output 1
        
        echo "=== Manual Sync Trigger (test) ==="
        curl -s -X POST http://localhost:5000/sync/kim.minsoo | python3 -m json.tool
        
        echo "=== Demo Laptop hosts ==="
        PUB_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4 2>/dev/null || echo "35.93.145.230")
        echo "Add to laptop /etc/hosts:"
        echo "  ${PUB_IP}  sso.wzhlab.top  workplace.wzhlab.top"

        # Add a new LDAP account
        
        LDAP_IP=$(podman inspect openldap --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
        ldapadd -x -H ldap://${LDAP_IP}:389 -D "cn=admin,dc=wzhlab,dc=top" -w "LdapAdmin2024!" << 'EOF'
        dn: uid=kim.minsoo.prod,ou=People,dc=wzhlab,dc=top
        objectClass: inetOrgPerson
        objectClass: posixAccount
        objectClass: shadowAccount
        uid: kim.minsoo.prod
        cn: Kim Minsoo Prod
        sn: Kim
        uidNumber: 10006
        gidNumber: 10006
        homeDirectory: /home/kim.minsoo.prod
        loginShell: /bin/bash
        userPassword: DemoPass2024!
        description: vm=linux-vm-2 ad=kim.minsoo label=Prod GPU Server
        EOF
        
        # Trigger sync (or let user re-login to trigger SPI)
        
        curl -X POST http://localhost:5000/sync/kim.minsoo
        
        # Verify new connection
        
        podman exec postgres psql -U guacamole -d guacamole -t -c \
          "SELECT connection_name FROM guacamole_connection WHERE connection_name LIKE '%Prod%';"

        # Step 1: Restart in dependency order
        
        podman restart postgres; sleep 10
        podman restart samba-ad openldap; sleep 15
        podman restart keycloak; sleep 60
        podman restart guacd linux-vm-1 linux-vm-2 linux-vm-3; sleep 15
        podman restart guacamole; sleep 10
        podman restart nginx-proxy; sleep 5
        
        # Step 2: Fix Samba AD (⚠️ Required after every restart; smb.conf is not persistent)
        
        podman exec samba-ad bash -c \
          "grep -q 'ldap server require strong auth' /etc/samba/smb.conf || \
           sed -i '/\[global\]/a\        ldap server require strong auth = no' /etc/samba/smb.conf"
        podman exec samba-ad supervisorctl restart samba
        sleep 
        
        # `
        
        # Step 3: Keycloak AD Sync (fix users that may have been marked as disabled)
        
        podman exec keycloak /opt/keycloak/bin/kcadm.sh config credentials \
          --server http://localhost:8080 --realm master --user admin --password 'KeycloakAdmin2024!'
        COMP_ID=$(podman exec keycloak /opt/keycloak/bin/kcadm.sh get components \
          -r corp -q type=org.keycloak.storage.UserStorageProvider \
          --fields id 2>&1 | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])")
        podman exec keycloak /opt/keycloak/bin/kcadm.sh create \
          "user-storage/${COMP_ID}/sync?action=triggerFullSync" -r corp
        
        # Step 4: Restart guac-ldap-sync
        
        podman stop guac-ldap-sync 2>/dev/null; podman rm guac-ldap-sync 2>/dev/null || true
        podman run -d \
          --name guac-ldap-sync --network corp-demo \
          -e LDAP_URL=ldap://openldap:389 \
          -e LDAP_BIND_DN=cn=admin,dc=wzhlab,dc=top -e LDAP_BIND_PW=LdapAdmin2024! \
          -e LDAP_BASE=ou=People,dc=wzhlab,dc=top \
          -e PG_HOST=postgres -e PG_DB=guacamole \
          -e PG_USER=guacamole -e PG_PASS=GuacamoleDB2024! \
          -e RDP_PASSWORD=DemoPass2024! -e GUAC_BACKEND=http://guacamole:8080 \
          -p 5000:5000 guac-ldap-sync:latest
        
        # Step 5: Validate
        
        sleep 15
        for u in kim.minsoo park.jiyeon lee.seungho; do
          R=$(curl -s -X POST http://localhost:8080/realms/corp/protocol/openid-connect/token \
            -d "client_id=guacamole&grant_type=password&username=$u&password=Password123!" | \
            python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token_type','FAIL'))" 2>/dev/null)
          echo "$u: $R"
        done
        PUB_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4 2>/dev/null || echo "unknown")
        echo "Public IP: ${PUB_IP} | Demo Entry: http://workplace.wzhlab.top:8888/guacamole/"

@Override
        public void onEvent(Event event) {
            if (event.getType() == EventType.LOGIN) {
                String username = event.getDetails().get("username");
                // HTTP POST to guac-ldap-sync
                callWebhook(username);  // POST http://guac-ldap-sync:5000/sync/<username>
            }
        }

def sync_single_user(ad_username):
            accounts = query_ldap_for_user(ad_username)  # Query accounts where description contains ad=<username>
            for acct in accounts:
                gid = upsert_group(cur, ad_username + " Workstations")  # Create connection group
                cid = upsert_conn(cur, acct['label'], gid, acct['uid'], acct['vm'])  # Create RDP connection
                ensure_perm(cur, entity_id, cid)  # Grant READ permission