search

vlaci / openconnect-sso

Wrapper script for OpenConnect supporting Azure AD (SAMLv2) authentication to Cisco SSL-VPNs
GNU General Public License v3.0
292 stars 125 forks source link

TFA input/automation #28

Open TheCase opened 3 years ago

TheCase commented 3 years ago

I have the ability to programmatically determine my TFA code and would to include its entry in the scripted login actions.

Is there a way to inject the value into the config.toml so that it will autofill the appropriate form field?

vlaci commented 3 years ago

Currently it is not possible. It doesn't seem hard to implement: the config.Credentials class should be extended to have an additional attribute having the MFA code, then a rule can be created to fill in the form. If I have time at the weekend, I'll look into it deeper.

vlaci commented 3 years ago

My company just implemented the requirement of MFA codes for authentication to VPN so that I can work on this issue now :)

TheCase commented 3 years ago

I see that you made a comment about 0.7.0 reusing past sessions and hoping that it didn't re-request the SSO information. So far that hasn't been working for me. I see no difference in behavior compared to 0.6.3. Every morning I am prompted for my TFA - perhaps the servers at my company are configured differently in that the sessions is expired every 24 hours (perhaps less, maybe 12).

TheCase commented 3 years ago

FYI - I am no longer using this style of VPN login, so I will no be available for testing should this enhancement get added at some point.

cannonpalms commented 3 years ago

I'm also available for testing here.

vlaci commented 2 years ago

Unfortunately I no longer have access to this type of VPN :/

cannonpalms commented 2 years ago

@vlaci I'm still happy to assist here. I still have access to a MFA VPN.

I'd recommend integrating with pass-otp to achieve this goal.

olaf-b commented 2 years ago

I managed to make this work for our CISCO-system. Have a look at my fork and the description of how to tune the config.toml I put the TOTP secret in the keyring.