allow to dance only with some concrete gateway when SAML is disabled at the portal (but not at the gateway)

gp-okta.py

@@ -599,12 +599,29 @@ def main():
 	if conf.get('client_cert'):
 		s.cert = conf.get('client_cert')
 
+	another_dance = conf.get('another_dance', '').lower() in ['1', 'true']
+
+	if conf.get('gateway'):
+		gateway = conf.get('gateway').strip()
+
+	if gateway and not another_dance:
+		vpn_url = 'https://{0}'.format(gateway)
+		if vpn_url != conf.get('vpn_url'):
+			log('Discarding \'vpn_url\', as concrete gateway is given and another_dance = 0')
+			conf['vpn_url'] = vpn_url
+
+	userauthcookie = None
+
 	s.headers['User-Agent'] = 'PAN GlobalProtect'
+	if another_dance or not gateway:
 		saml_xml = paloalto_prelogin(conf, s)
+	else:
+		saml_xml = paloalto_prelogin(conf, s, gateway)
 	redirect_url = okta_saml(conf, s, saml_xml)
 	token = okta_auth(conf, s)
 	log('sessionToken: {0}'.format(token))
 	saml_username, prelogin_cookie = okta_redirect(conf, s, token, redirect_url)
+	if not gateway:
 		userauthcookie, gateway = paloalto_getconfig(conf, s, saml_username, prelogin_cookie)
 		gateway = conf.get('gateway', gateway).strip()
 
@@ -612,15 +629,15 @@ def main():
 	log('gateway: {0}'.format(gateway))
 	log('saml-username: {0}'.format(saml_username))
 
-	# We're done with the portal now. Another dance with the gateway now?
+	if another_dance:
-	if conf.get('another_dance', '').lower() in ['1', 'true']:
+		# 1st step: dance with the portal, 2nd step: dance with the gateway
 		saml_xml = paloalto_prelogin(conf, s, gateway)
 		saml_username, prelogin_cookie = okta_saml_2(conf, s, gateway, saml_xml)
 
 	log('saml-username: {0}'.format(saml_username))
 	log('prelogin-cookie: {0}'.format(prelogin_cookie))
 
-	if userauthcookie == 'empty' and prelogin_cookie != 'empty':
+	if (not userauthcookie or userauthcookie == 'empty') and prelogin_cookie != 'empty':
 	    cookie_type = "gateway:prelogin-cookie"
 	    cookie = prelogin_cookie
 	else: