os-mnemo/pan-globalprotect-okta
1
0
Fork 0
mirror of https://github.com/os-mnemo/pan-globalprotect-okta synced 2026-07-31 15:54:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Do OKTA redirect dance until it is sucessful.

Browse Source
This commit is contained in:
Andris Raugulis
2019-01-24 15:02:20 +02:00
parent 7528cb8875
commit 281aa34247
1 changed files with 33 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gp-okta.py
+18 -9
View File
@@ -81,7 +81,7 @@ def parse_rjson(r):
def parse_form(html, current_url = None): def parse_form(html, current_url = None):
xform = html.find('.//form') xform = html.find('.//form')
url = xform.attrib.get('action', '').strip() url = xform.attrib.get('action', '').strip()
if not url.startswith('http'): if not url.startswith('http') and current_url:
url = urljoin(current_url, url) url = urljoin(current_url, url)
data = {} data = {}
for xinput in html.findall('.//input'): for xinput in html.findall('.//input'):
@@ -319,6 +319,13 @@ def okta_mfa_sms(conf, s, factor, state_token):
return j.get('sessionToken', '').strip() return j.get('sessionToken', '').strip()
def okta_redirect(conf, s, session_token, redirect_url): def okta_redirect(conf, s, session_token, redirect_url):
rc = 0
form_url, form_data = None, {}
while True:
if rc > 10:
err('redirect rabbit hole is too deep...')
rc += 1
if redirect_url:
data = { data = {
'checkAccountSetupComplete': 'true', 'checkAccountSetupComplete': 'true',
'report': 'true', 'report': 'true',
@@ -328,19 +335,21 @@ def okta_redirect(conf, s, session_token, redirect_url):
url = '{0}/login/sessionCookieRedirect'.format(conf.get('okta_url')) url = '{0}/login/sessionCookieRedirect'.format(conf.get('okta_url'))
log('okta redirect request') log('okta redirect request')
h, c = send_req(conf, s, 'redirect', url, data) h, c = send_req(conf, s, 'redirect', url, data)
redirect_url = get_redirect_url(conf, c, url)
if redirect_url:
form_url, form_data = None, {}
else:
xhtml = parse_html(c) xhtml = parse_html(c)
form_url, form_data = parse_form(xhtml, url)
url, data = parse_form(xhtml) elif form_url:
log('okta redirect form request') log('okta redirect form request')
h, c = send_req(conf, s, 'redirect form', url, data) h, c = send_req(conf, s, 'redirect form', form_url, form_data)
saml_username = h.get('saml-username', '').strip() saml_username = h.get('saml-username', '').strip()
if len(saml_username) == 0: prelogin_cookie = h.get('prelogin-cookie', '').strip()
err('saml-username empty') if saml_username and prelogin_cookie:
saml_auth_status = h.get('saml-auth-status', '').strip() saml_auth_status = h.get('saml-auth-status', '').strip()
saml_slo = h.get('saml-slo', '').strip() saml_slo = h.get('saml-slo', '').strip()
prelogin_cookie = h.get('prelogin-cookie', '').strip() dbg(conf.get('debug'), 'saml prop', [saml_auth_status, saml_slo])
if len(prelogin_cookie) == 0:
err('prelogin-cookie empty')
return saml_username, prelogin_cookie return saml_username, prelogin_cookie
def paloalto_getconfig(conf, s, saml_username, prelogin_cookie): def paloalto_getconfig(conf, s, saml_username, prelogin_cookie):