Hi there. My place of employment recently deployed a Palo Alto GobalProtect device. It's set up with SAML and Two-Factor authentication. Looking through a bunch of posts on the internet including: https://github.com/dlenski/openconnect/blob/globalprotect/PAN_GlobalProtect_protocol_doc.md https://github.com/dlenski/openconnect/issues/149 https://github.com/dlenski/gp-saml-gui/ http://www.infradead.org/openconnect/globalprotect.html I got to the point where I can go through the following: - Go to https://vpn.example.com/global-protect/prelogin.esp - Follow the login SAML trail back to https://vpn.example.com/SAML20/SP/ACS + See the result in that response (formatted for readability): <html><body>Login Successful!</body> <!-- <saml-auth-status>1</saml-auth-status> <prelogin-cookie>C4xyzzyxyzzy...</prelogin-cookie> <saml-username>joe@xxxxxxxxxxx</saml-username> <saml-slo>no</saml-slo> --> </html> - Go to https://vpn.example.com/global-protect/getconfig.esp, passing in the user=joe@xxxxxxxxxxx and prelogin-cookie=C4xyzzyxyzzy... which gives me a big XML file, which includes towards the end <portal-userauthcookie>ABCAverylargestringindeed=</portal-userauthcookie> <portal-prelogonuserauthcookie>empty</portal-prelogonuserauthcookie> <scep-cert-auth-cookie>XyzzYAShorterstring==</scep-cert-auth-cookie> But now I'm stuck. What magic incarnation of the openconnect command line do I use now? I tried (with different cookies): cookie="ABCAverylargestringindeed=" echo "$cookie" | \ sudo openconnect --protocol=gp --usergroup portal:portal-userauthcookie \ --user=joe@xxxxxxxxxxx vpn.example.com echo "$cookie" | \ sudo openconnect --protocol=gp --user='joe@xxxxxxxxxxx' --os=win --usergroup=prelogin-cookie:gateway --passwd-on-stdin vpn.example.com But it seems to fail with 'Unexpected 512 result from server' and still want to go to 'POST https://vpn.example.com/global-protect/getconfig.esp' Sorry for the rather basic question, but I haven't found what to do next anywhere I looked. Thanks! Michel _______________________________________________ openconnect-devel mailing list openconnect-devel@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/openconnect-devel
