From fce587af6145dcae1d83c611abf04978da10cba9 Mon Sep 17 00:00:00 2001 From: Daniel Lenski Date: Thu, 30 May 2019 16:12:20 -0700 Subject: [PATCH] Treat "Symantec VIP Access" as TOTP Although not advertised as such, Symantec VIP Access is based on TOTP and there is an open-source implementation for provisioning the tokens and obtaining the TOTP secret at http://github.com/dlenski/python-vipaccess --- gp-okta.conf | 1 + gp-okta.py | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/gp-okta.conf b/gp-okta.conf index 7eead47..73af663 100644 --- a/gp-okta.conf +++ b/gp-okta.conf @@ -14,6 +14,7 @@ password = mypass sms.okta = 0 #totp.okta = ABCDEFGHIJKLMNOP #totp.google = ABCDEFGHIJKLMNOP +#totp.symantec = ABCDEFGHIJKLMNOP gateway = Manual ny1-gw.example.com # optional hardcoded gateway diff --git a/gp-okta.py b/gp-okta.py index 5585ab6..0f11c19 100755 --- a/gp-okta.py +++ b/gp-okta.py @@ -172,7 +172,7 @@ def load_conf(cf): return conf def mfa_priority(conf, ftype, fprovider): - if ftype == 'token:software:totp': + if ftype == 'token:software:totp' or (ftype, fprovider) == ('token', 'symantec'): ftype = 'totp' if ftype not in ['totp', 'sms', 'webauthn']: return 0 @@ -382,7 +382,8 @@ def okta_mfa(conf, s, j): for f in sorted(factors, key=lambda x: x.get('priority', 0), reverse=True): #print(f) ftype = f.get('type') - if ftype == 'token:software:totp': + fprovider = f.get('provider') + if ftype == 'token:software:totp' or (ftype, fprovider) == ('token', 'symantec'): r = okta_mfa_totp(conf, s, f, state_token) elif ftype == 'sms': r = okta_mfa_sms(conf, s, f, state_token)