os-mnemo/pan-globalprotect-okta
1
0
Fork 0
mirror of https://github.com/os-mnemo/pan-globalprotect-okta synced 2026-07-31 07:44:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add more debugging.

Browse Source
This commit is contained in:
Andris Raugulis
2020-05-21 16:14:03 +00:00
parent 0857d9d5ee
commit 011dc55493
1 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gp-okta.py
+24 -5
View File
@@ -85,10 +85,25 @@ def dbg(d, h, *xs):
return return
if not d: if not d:
return return
print('[DEBUG] {0}:'.format(h))
for x in xs: for x in xs:
print('[DEBUG] {0}'.format(x)) if not isinstance(x, dict) and not isinstance(x, list):
print('[DEBUG] ---') for line in x.split('\n'):
print('[DEBUG] {0}: {1}'.format(h, line))
else:
print('[DEBUG] {0}: {1}'.format(h, x))
def dbg_form(conf, name, data):
if not conf.get('debug'):
return
for k in data:
dbg(True, name, '{0}: {1}'.format(k, data[k]))
if k in ['SAMLRequest', 'SAMLResponse']:
try:
saml_raw = base64.b64decode(data[k])
dbg(True, name, '{0}.decoded: {1}'.format(k, saml_raw))
except:
pass
def err(s): def err(s):
print('[ERROR] {0}'.format(s), file=sys.stderr) print('[ERROR] {0}'.format(s), file=sys.stderr)
@@ -235,6 +250,7 @@ def get_redirect_url(conf, c, current_url = None):
def send_req(conf, s, name, url, data, **kwargs): def send_req(conf, s, name, url, data, **kwargs):
dbg(conf.get('debug'), '{0}.request'.format(name), url) dbg(conf.get('debug'), '{0}.request'.format(name), url)
dbg_form(conf, 'send.req.data', data)
if kwargs.get('expected_url'): if kwargs.get('expected_url'):
purl = list(urlparse(url)) purl = list(urlparse(url))
purl = (purl[0], purl[1].split(':')[0]) purl = (purl[0], purl[1].split(':')[0])
@@ -302,6 +318,7 @@ def paloalto_prelogin(conf, s, gateway_url=None):
def okta_saml(conf, s, saml_xml): def okta_saml(conf, s, saml_xml):
log('okta saml request [okta_url]') log('okta saml request [okta_url]')
url, data = parse_form(saml_xml) url, data = parse_form(saml_xml)
dbg_form(conf, 'okta.saml request', data)
_, _h, c = send_req(conf, s, 'saml', url, data, _, _h, c = send_req(conf, s, 'saml', url, data,
expected_url=conf.get('okta_url'), verify=conf.get('okta_url_cert')) expected_url=conf.get('okta_url'), verify=conf.get('okta_url_cert'))
redirect_url = get_redirect_url(conf, c, url) redirect_url = get_redirect_url(conf, c, url)
@@ -391,7 +408,7 @@ def okta_mfa(conf, s, j):
'provider': provider, 'provider': provider,
'priority': mfa_priority(conf, factor_type, provider), 'priority': mfa_priority(conf, factor_type, provider),
'url': factor_url}) 'url': factor_url})
dbg(conf.get('debug'), 'factors', factors) dbg(conf.get('debug'), 'factors', *factors)
if len(factors) == 0: if len(factors) == 0:
err('no factors found') err('no factors found')
for f in sorted(factors, key=lambda x: x.get('priority', 0), reverse=True): for f in sorted(factors, key=lambda x: x.get('priority', 0), reverse=True):
@@ -545,6 +562,7 @@ def okta_redirect(conf, s, session_token, redirect_url):
else: else:
xhtml = parse_html(c) xhtml = parse_html(c)
form_url, form_data = parse_form(xhtml, url) form_url, form_data = parse_form(xhtml, url)
dbg_form(conf, 'okta.redirect request {0}'.format(rc), data)
if state_token is not None: if state_token is not None:
log('stateToken: {0}'.format(state_token)) log('stateToken: {0}'.format(state_token))
okta_auth(conf, s, state_token) okta_auth(conf, s, state_token)
@@ -612,11 +630,12 @@ def paloalto_getconfig(conf, s, username = None, prelogin_cookie = None, can_fai
def okta_saml_2(conf, s, gateway_url, saml_xml): def okta_saml_2(conf, s, gateway_url, saml_xml):
log('okta saml request (2) [okta_url]') log('okta saml request (2) [okta_url]')
url, data = parse_form(saml_xml) url, data = parse_form(saml_xml)
dbg_form(conf, 'okta.saml request(2)', data)
_, h, c = send_req(conf, s, 'okta saml request (2)', url, data, _, h, c = send_req(conf, s, 'okta saml request (2)', url, data,
expected_url=conf.get('okta_url'), verify=conf.get('okta_url_cert')) expected_url=conf.get('okta_url'), verify=conf.get('okta_url_cert'))
xhtml = parse_html(c) xhtml = parse_html(c)
url, data = parse_form(xhtml) url, data = parse_form(xhtml)
dbg_form(conf, 'okta.saml request(2)', data)
log('okta redirect form request (2) [gateway]') log('okta redirect form request (2) [gateway]')
verify = None verify = None
if conf.get('openconnect_certs') and os.path.getsize(conf.get('openconnect_certs').name) > 0: if conf.get('openconnect_certs') and os.path.getsize(conf.get('openconnect_certs').name) > 0: