os-mnemo/pan-globalprotect-okta
1
0
Fork 0
mirror of https://github.com/os-mnemo/pan-globalprotect-okta synced 2026-07-31 07:44:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Do OKTA redirect dance until it is sucessful.

Browse Source
This commit is contained in:
Andris Raugulis
2019-01-24 15:02:20 +02:00
parent 7528cb8875
commit 281aa34247
1 changed files with 33 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gp-okta.py
+33 -24
View File
@@ -81,7 +81,7 @@ def parse_rjson(r):
def parse_form(html, current_url = None): def parse_form(html, current_url = None):
xform = html.find('.//form') xform = html.find('.//form')
url = xform.attrib.get('action', '').strip() url = xform.attrib.get('action', '').strip()
if not url.startswith('http'): if not url.startswith('http') and current_url:
url = urljoin(current_url, url) url = urljoin(current_url, url)
data = {} data = {}
for xinput in html.findall('.//input'): for xinput in html.findall('.//input'):
@@ -319,29 +319,38 @@ def okta_mfa_sms(conf, s, factor, state_token):
return j.get('sessionToken', '').strip() return j.get('sessionToken', '').strip()
def okta_redirect(conf, s, session_token, redirect_url): def okta_redirect(conf, s, session_token, redirect_url):
data = { rc = 0
'checkAccountSetupComplete': 'true', form_url, form_data = None, {}
'report': 'true', while True:
'token': session_token, if rc > 10:
'redirectUrl': redirect_url err('redirect rabbit hole is too deep...')
} rc += 1
url = '{0}/login/sessionCookieRedirect'.format(conf.get('okta_url')) if redirect_url:
log('okta redirect request') data = {
h, c = send_req(conf, s, 'redirect', url, data) 'checkAccountSetupComplete': 'true',
xhtml = parse_html(c) 'report': 'true',
'token': session_token,
url, data = parse_form(xhtml) 'redirectUrl': redirect_url
log('okta redirect form request') }
h, c = send_req(conf, s, 'redirect form', url, data) url = '{0}/login/sessionCookieRedirect'.format(conf.get('okta_url'))
saml_username = h.get('saml-username', '').strip() log('okta redirect request')
if len(saml_username) == 0: h, c = send_req(conf, s, 'redirect', url, data)
err('saml-username empty') redirect_url = get_redirect_url(conf, c, url)
saml_auth_status = h.get('saml-auth-status', '').strip() if redirect_url:
saml_slo = h.get('saml-slo', '').strip() form_url, form_data = None, {}
prelogin_cookie = h.get('prelogin-cookie', '').strip() else:
if len(prelogin_cookie) == 0: xhtml = parse_html(c)
err('prelogin-cookie empty') form_url, form_data = parse_form(xhtml, url)
return saml_username, prelogin_cookie elif form_url:
log('okta redirect form request')
h, c = send_req(conf, s, 'redirect form', form_url, form_data)
saml_username = h.get('saml-username', '').strip()
prelogin_cookie = h.get('prelogin-cookie', '').strip()
if saml_username and prelogin_cookie:
saml_auth_status = h.get('saml-auth-status', '').strip()
saml_slo = h.get('saml-slo', '').strip()
dbg(conf.get('debug'), 'saml prop', [saml_auth_status, saml_slo])
return saml_username, prelogin_cookie
def paloalto_getconfig(conf, s, saml_username, prelogin_cookie): def paloalto_getconfig(conf, s, saml_username, prelogin_cookie):
log('getconfig request') log('getconfig request')