os-mnemo/pan-globalprotect-okta
1
0
Fork 0
mirror of https://github.com/os-mnemo/pan-globalprotect-okta synced 2026-07-31 07:44:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
50 Commits 1 Branch 0 Tags
412560eff7184cc8ab30a46c68f7bbae4d152f97
Commit Graph

11 Commits

Author SHA1 Message Date
Tino Lange 412560eff7 - Add ssl cert verification for vpn and okta side, if configured 
- new option `vpn_url_cert`
  - new option `okta_url_cert`
- rename client certificate option to `client_cert` from `cert`
- totp: comment out ABCDEFGHIJKLMNOP secrets, default to not set (so you get asked)
- grab and display prelogin errors (for example: client certificate needed or such)
- new option `openconnect_certs` that points to a file to collect all given and collected server certificates, will be given to the final openconnect call (inspired by nicklans fork, thank you). If it is not set it will be a temp file.
- check all redirect and parsed urls if they point to an expected domain (either `okta_url` or `vpn_url`)
- learn `gateway` from getconfig call, if not set/overridden by config file
 2019-06-11 14:31:23 +02:00
Tino Lange fab69fe18c Set certificate automatically also in openconnect call, if one is set in gp-okta.conf for the requests-dance 2019-06-07 09:37:21 +02:00
Tino Lange 29527325fd Implement config option cert to use a client certificate. 
This fixes Issue https://github.com/arthepsy/pan-globalprotect-okta/issues/17 raised by @lvml.

(Note that if you need to specify a client certificate for the `vpn_url`, then most probably
you will also need to give the same certificate to the final `openconnect` call with `--certificate` via the `openconnect_args`)
 2019-06-06 09:53:35 +02:00
Aaron Lindsay 58c1d37f93 Add option for second round of Okta authentication 
This appears to be required for my VPN
 2019-06-04 14:04:32 -04:00
Andris Raugulis 45ef74bca3 Implement MFA selection priority (by mfa_order, by line number, by value). 2019-01-22 13:19:28 +00:00
Andris Raugulis 1f8db7d309 Escape backslash in username and other fields, i.e., use single quote. 
Add work-around for additional username input.
 2018-10-08 00:12:59 +00:00
Andris Raugulis 51b8725260 Do not force sudo in default configuration. 2018-09-03 15:05:35 +03:00
Andris Raugulis 76597ea412 Request username/password if empty. Override configuration file 
settings with environment variables (GP_*). Implement openconnect
command (for sudo/doas cases) and args (for custom vpnc scripts).
Implement execution.
 2018-09-03 15:03:16 +03:00
Andris Raugulis 1df901118d Add gateway support. Add workaround for newline bug in openconnect. 2018-09-03 13:40:29 +03:00
Andris Raugulis b3201c402a Add support for OKTA TOTP, fixing #2. 2018-08-31 12:03:33 +00:00
Andris Raugulis 71fdf176dc Implement GlobalProtect + OKTA authentication dance. Support TOTP. 2018-04-09 16:48:45 +03:00