vlaci / openconnect-sso

Wrapper script for OpenConnect supporting Azure AD (SAMLv2) authentication to Cisco SSL-VPNs
GNU General Public License v3.0
299 stars 131 forks source link

Error on connection attempt #182

Closed mgite closed 1 month ago

mgite commented 1 month ago

I try to connect to vpn. It automatically enters email and password in browser window (very cool feature) and then numbers show up i enter them in the authenticator app on my phone and then when it tries to connect it throws this error. I tried older versions using python .whl packages but every version has the same error. Could anyone help with this?

` ~ openconnect-sso --server mydomain --authgroup mygroup --user myuser

[info ] Authenticating to VPN endpoint [openconnect_sso.app] address=mydomain name=mygroup

[info ] Response received [openconnect_sso.authenticator] id=main message=Please complete the authentication process in the AnyConnect Login window. title=

[info ] Browser started [webengine] startup_info=StartupInfo(url='https://mydomain/+DEDECSE+/some/cp/login?ctx=3543436&acsamlcap=v2', credentials=Credentials(username='myuser'))

[info ] Loading page [webengine] url=https://mydomain/+DEDECSE+/some/cp/login?ctx=3543436&acsamlcap=v2

[info ] Initiating autologin [webengine] cred=Credentials(username='myuser')

[info ] Terminate requested. [webengine]

[info ] Exiting browser [webengine]

[info ] Browser exited [openconnect_sso.browser.browser]

[info ] Response received [openconnect_sso.authenticator] id=main message=Please complete the authentication process in the AnyConnect Login window. title=

[error ] Could not finish authentication. Invalid response type in current state [openconnect_sso.authenticator] response=AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Unknown error.', login_url='https://mydomain/+DEDECSE+/some/cp/login?ctx=3543436&acsamlcap=v2', login_final_url='https://mydomain/+DEDECSE+/c_login.html', token_cookie_name='token', opaque=<Element opaque at 0x76269813c140>) Traceback (most recent call last): File "/usr/bin/openconnect-sso", line 33, in sys.exit(load_entry_point('openconnect-sso==0.8.0', 'console_scripts', 'openconnect-sso')()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/openconnect_sso/cli.py", line 169, in main return app.run(args) ^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/openconnect_sso/app.py", line 34, in run auth_response, selected_profile = asyncio.get_event_loop().run_until_complete( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/asyncio/base_events.py", line 687, in run_until_complete return future.result() ^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/openconnect_sso/app.py", line 139, in _run auth_response = await authenticate_to( ^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/openconnect_sso/authenticator.py", line 50, in authenticate raise AuthenticationError(response) openconnect_sso.authenticator.AuthenticationError: AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Unknown error.', login_url='https://mydomain/+DEDECSE+/some/cp/login?ctx=3543436&acsamlcap=v2', login_final_url='https://mydomain/+DEDECSE+/c_login.html', token_cookie_name='acSamlv2Token', opaque=<Element opaque at 0x76269813c140>) `

mgite commented 1 month ago

New findings.

When i run it like this

openconnect-sso --server mydomain --authgroup mygroup --user myuser

It automatically fils in username and password in browser window. Then shows me numbers which i type inside authenticator app and suddenly it disconnects and give me an error in the first post.

But if i create config.toml file and put configuration in it. It does not automatically fill in username and password i do it manually, put those numbers shown to me in authenticator app and it connects and works.

Why does it disconnect and give me an error using --server option but works using --profile option?

mgite commented 1 month ago

Again New finding

if i run it like this

openconnect-sso --server mydomain --authgroup mygroup

It does not autofill user and password, but i do it manually and it works with --server option too. Something is wrong with handling autofilling with --server option.

I could not get it to autofill using config.toml file.

mgite commented 1 month ago

The problem with autofill was that button selector was matching with some other button and that is why on connect it was immedeatly disconnecting and throwing some error. Manually it worked.

So i configured config.toml with VERY long js selectors for each input and button that only match them and nothing else and it works.

I am closing this issue as it was not a bug, just configuration problem.