Open TheRealIndru opened 1 year ago
Good description of the problem but
Failed to obtain WebVPN cookie
… indicates that you're using a very old version of OpenConnect. This confusing message was changed in v8.20: https://gitlab.com/openconnect/openconnect/-/commit/ce8c6968f524aaa6d8387a3c63e9cdbce88f3c59
In v8.20 and newer releases, we've made a number of improvements to the GlobalProtect protocol implementation.
For your purposes, the most critical one is Pass "portal cookie" fields from GlobalProtect portal to gateway to avoid repetition of password- or SAML-based login (!199).
Please upgrade and retry.
Hi,
It seems after update the error is:
Valid client certificate is required. Failed to complete authentication.
openconnect -V output:
OpenConnect version v9.01-0-focal2 Using GnuTLS 3.6.13. Features present: TPMv2, PKCS#11, RSA software token, HOTP software token, TOTP software token, Yubikey OATH, System keys, DTLS, ESP Supported protocols: anyconnect (default), nc, gp, pulse, f5, fortinet, array Default vpnc-script (override with --script): /usr/share/vpnc-scripts/vpnc-script
How do I pass the certificate to gp-saml-gui? Or do I pass it directly to openconnect?
How do I pass the certificate to gp-saml-gui? Or do I pass it directly to openconnect?
You pass it directly to OpenConnect. And you can tell gp-saml-gui to pass them along as described in the README.
It seems I need some kind of private key, the certificate is not enough as it only has certificate + public key. Do you by any chance know how can I extract the proper private key? Where am I supposed to find it?
It seems I need some kind of private key, the certificate is not enough as it only has certificate + public key. Do you by any chance know how can I extract the proper private key? Where am I supposed to find it?
Without knowing where the certificate and private key are stored… I have no idea.
Educated guess: your certificate is stored in a Windows certificate store where the private key is marked as "non-exportable", and you'll need to use a tool like mimikatz
. https://gitlab.com/openconnect/openconnect/-/issues/188#note_438751439
Hi,
I am having basically the exact same issue like here: https://github.com/dlenski/gp-saml-gui/issues/6
Problem is, the solution from that thread doesn't work for me.
Where can I find the second cookie and how exactly am I supposed to use it? Where to input it?
Output of what-vpn is
PAN GlobalProtect (portal+portal wants SAML REDIRECT)
Commands I issue that got me the furthest are:
Command 1:
eval $( gp-saml-gui --portal --clientos=Windows gp-portal.companyserver.com)
Output:Command 2:
Output 2:
Thank you!