mirror of
https://github.com/os-mnemo/pan-globalprotect-okta
synced 2026-07-31 15:54:36 +02:00
Andris Raugulis
52 lines
1.8 KiB
Plaintext
52 lines
1.8 KiB
Plaintext
# --- general
|
|
debug = 0
|
|
okta_url = https://company.okta.lan
|
|
vpn_url = https://vpn.company.lan
|
|
|
|
# "gateway_url" forces authentication with specific gateway.
|
|
#gateway_url = https://ny1-gw.my.lan
|
|
# "another_dance" (0/1) defines whether to do second authentication, i.e.,
|
|
# after authentication with portal, do another authentication with gateway.
|
|
#another_dance = 0
|
|
|
|
username = myuser
|
|
password = mypass
|
|
# "gateway" is a preferred gateway selection, which portal asks for.
|
|
gateway = NEWYORK1-GW
|
|
|
|
# --- multi-factor authentication
|
|
#mfa_order = totp sms
|
|
#sms.okta = 0
|
|
#totp.okta = ABCDEFGHIJKLMNOP
|
|
#totp.google = ABCDEFGHIJKLMNOP
|
|
#totp.symantec = ABCDEFGHIJKLMNOP
|
|
|
|
# --- certificates
|
|
# any defined "*_cert" is path to readable and unencrypted certificate file.
|
|
# "vpn_url_cert" and "okta_url_cert" are used to verify relevant URLs.
|
|
# "vpn_cli_cert" and "okta_cli_cert" are used as client certificate.
|
|
# any other "*_cert" and "vpn_url_cert" will be added to certs (see below).
|
|
#
|
|
#okta_url_cert = okta.pem
|
|
#okta_cli_cert = okta_cli.pem
|
|
#vpn_url_cert = vpn.pem
|
|
#vpn_cli_cert = vpn_cli.pem
|
|
#
|
|
# "certs" is (optional) path to certificate file, which will be overwritten
|
|
# and stored with all certificates encountered (in config and portal config).
|
|
# by default, "certs" is not specified, so a temporary file will be created.
|
|
# it will be used to verify gateways and passed to openconnect executable.
|
|
#
|
|
#certs = certs.pem
|
|
|
|
# --- execution
|
|
# "execute" (0/1) defines if openconnect (as specified with "openconnect_cmd"
|
|
# and "openconnect_args") is executed after OKTA authentication dance.
|
|
execute = 0
|
|
openconnect_cmd = sudo openconnect
|
|
openconnect_args =
|
|
# "openconnect_fmt" is manually specified format what to pipe to openconect.
|
|
# supports <cookie>, <username>, etc. other characters are provided as-is
|
|
#openconnect_fmt = <cookie><cookie>
|
|
|