Command-line client for PaloAlto Networks' GlobalProtect VPN, integrated with OKTA. This utility will do the authentication dance with OKTA to retrieve portal-userauthcookie, which will be passed to OpenConnect with PAN GlobalProtect support for creating actual VPN connection.

It also supports Google and OKTA two factor authentication and can work without user interaction, if initial TOTP secret is provided. Otherwise, it will ask for generated code. If this feature will be used, pyotp dependency is required.

To gather TOTP secret, there are two possibilities - either scan the provided QR code with normal QR code scanner and write down the secret. Or create backup from current OTP application in phone. Some applications have this feature, but some don't. For example, andOTP on Android do support this feature.

usage

   ./gp-okta.py gp-okta.conf

configuration

Configuration file should be self-explanatory. Options can be overridden with GP_ prefixed respective environment variables, e.g., GP_PASSWORD will override username option in configuration file.

known issues

If openconnect returns with ioctl error, then this version has a bug, which requires to prefix stdin input with a newline. Set bg.nl=1 in configuration file.