From fab69fe18ccc75c9e63dc1c94c96a47547aca4f4 Mon Sep 17 00:00:00 2001 From: Tino Lange Date: Fri, 7 Jun 2019 09:37:21 +0200 Subject: [PATCH] Set certificate automatically also in openconnect call, if one is set in `gp-okta.conf` for the requests-dance --- gp-okta.conf | 2 +- gp-okta.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/gp-okta.conf b/gp-okta.conf index ac1b828..d1e3b69 100644 --- a/gp-okta.conf +++ b/gp-okta.conf @@ -10,7 +10,7 @@ totp.google = ABCDEFGHIJKLMNOP gateway = Manual ny1-gw.example.com #cert = path-to-client-cert-as-unencrypted-pem-file.pem #openconnect_cmd = sudo openconnect -openconnect_args = # optional arguments to openconnect, probably you might want to repeat the cert here (if used above) with --certificate=xxx +openconnect_args = # optional arguments to openconnect execute = 0 # execute openconnect command another_dance = 0 # second round of authentication required bug.nl = 0 # newline work-around for openconnect diff --git a/gp-okta.py b/gp-okta.py index 76c929d..7ddde29 100755 --- a/gp-okta.py +++ b/gp-okta.py @@ -490,6 +490,8 @@ def main(): cmd = conf.get('openconnect_cmd') or 'openconnect' cmd += ' --protocol=gp -u \'{0}\'' cmd += ' --usergroup {1}' + if conf.get('cert'): + cmd += ' --certificate=\'{0}\''.format(conf.get('cert')) cmd += ' --passwd-on-stdin ' + conf.get('openconnect_args', '') + ' \'{2}\'' cmd = cmd.format(username, cookie_type, conf.get('vpn_url')) gw = (conf.get('gateway') or '').strip()