From 9ee875bf569371317d18fb5a5148bb50884666f1 Mon Sep 17 00:00:00 2001
From: Tino Lange <coldcoff@yahoo.com>
Date: Fri, 14 Jun 2019 12:58:30 +0200
Subject: [PATCH] Some portals seem not to return root-ca entries, detect that
 and just continue

---
 gp-okta.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/gp-okta.py b/gp-okta.py
index a820462..44dc5fd 100755
--- a/gp-okta.py
+++ b/gp-okta.py
@@ -478,10 +478,12 @@ def paloalto_getconfig(conf, s, saml_username, prelogin_cookie):
 	if len(portal_userauthcookie) == 0:
 		err('empty portal_userauthcookie')
 	gateway = x.find('.//gateways//entry').get('name') # FIXME: this just grabs the very first, probably not what you want
-	for entry in x.find('.//root-ca'):
-		cert = entry.find('.//cert').text
-		conf['openconnect_certs'].write(to_b(cert))
-	conf['openconnect_certs'].flush()
+	xtmp = x.find('.//root-ca')
+	if xtmp is not None:
+		for entry in xtmp:
+			cert = entry.find('.//cert').text
+			conf['openconnect_certs'].write(to_b(cert))
+		conf['openconnect_certs'].flush()
 	return portal_userauthcookie, gateway
 
 # Combined first half of okta_saml with second half of okta_redirect