README.md

   1 gp-saml-gui
   2 ===========
   3
   4 This is a helper script to allow you to interactively login to a GlobalProtect VPN
   5 that uses SAML authentication.
   6
   7 Interactive login is, unfortunately, sometimes a necessary alternative to automated
   8 login via scripts such as
   9 [zdave/openconnect-gp-okta](https://github.com/zdave/openconnect-gp-okta).
  10
  11 How to use
  12 ==========
  13
  14 Specify the GlobalProtect server URL (portal or gateway) and optional arguments.
  15
  16 This script will pop up a [GTK WebKit2 WebView](https://webkitgtk.org/) window.
  17 After you succesfully complete the SAML login via web forms, the script will output
  18 `HOST`, `USER`, and `COOKIE` variables in a form that can be used by
  19 [OpenConnect](http://www.infradead.org/openconnect/juniper.html)
  20 (similar to the output of `openconnect --authenticate`):
  21
  22 ```sh
  23 $ eval $( gp-saml-gui.py -v vpn.company.com )
  24 Got SAML POST content, opening browser...
  25 Finished loading about:blank...
  26 Finished loading https://company.okta.com/app/panw_globalprotect/deadbeefFOOBARba1234/sso/saml...
  27 Finished loading https://company.okta.com/login/sessionCookieRedirect...
  28 Finished loading https://vpn.qorvo.com/SAML20/SP/ACS...
  29 Got SAML relevant headers, done: {'prelogin-cookie': 'blahblahblah', 'saml-username': 'foo12345@corp.company.com', 'saml-slo': 'no', 'saml-auth-status': '1'}
  30
  31 SAML response converted to OpenConnect command line invocation:
  32
  33     echo 'blahblahblah' |
  34         openconnect --protocol=gp --user='foo12345@corp.company.com' --usergroup=prelogin-cookie:gateway --passwd-on-stdin vpn.company.com
  35
  36 $ echo $HOST; echo $USER; echo $COOKIE
  37 https://vpn.company.com/gateway:prelogin-cookie
  38 foo12345@corp.company.com
  39 blahblahblah'
  40
  41 $ echo "$COOKIE" | openconnect --protocol=gp -u "$USER" --passwd-on-stdin "$HOST"
  42 ```
  43
  44 TODO
  45 ====
  46
  47 * Packaging
  48 * Explain dependencies
  49
  50 License
  51 =======
  52
  53 GPLv3 or newer