search

yuezk / GlobalProtect-openconnect

A GlobalProtect VPN client for Linux, written in Rust, based on OpenConnect and Tauri, supports SSO with MFA, Yubikey, and client certificate authentication, etc.
GNU General Public License v3.0
1.4k stars 157 forks source link

CLI application errors when connecting: Gtk-WARNING: cannot open display #297

Open InterLinked1 opened 10 months ago

InterLinked1 commented 10 months ago

When trying to run the latest build from today, the CLI version, I get the following error:

sfcu@testdebian:~$ gpclient connect REDACTED
[2024-01-23T01:43:51Z INFO  gpclient::cli] gpclient started: 2.0.0-beta5 (2024-01-22)
[2024-01-23T01:43:51Z INFO  gpapi::portal::prelogin] Portal prelogin, user_agent: PAN GlobalProtect
[2024-01-23T01:43:56Z INFO  gpauth::cli] gpauth started: 2.0.0-beta5 (2024-01-22)

(gpauth:1442717): Gtk-WARNING **: 01:43:56.787: cannot open display:

This seems to be a display-related error, which doesn't make sense to over SSH, as this is a headless machine with no display. The repo advertises "CLI support", but for some reason, it seems to be trying to start the GUI anyways, which doesn't seem right. Is this a bug or does the GUI have to be manually disabled?

TS-CUBED commented 10 months ago

It will want to start the SAML authorisation in a browser. But I could not get this to work on the CLI either with the new version.

I had better success with gp-saml-gui - which also requires SAML auth, but only to create an auth cookie once. After that it will work for as long as that is valid.

InterLinked1 commented 10 months ago

It will want to start the SAML authorisation in a browser. But I could not get this to work on the CLI either with the new version.

If it can't be fully run in the CLI on a machine, then I think the feature list is a bit misleading - I've seen it where they give you a URL you can copy and paste into another browser and return a token, that might be a better way of doing that. Unless it would work with a text-based browser like Lynx, which I doubt...

I had better success with gp-saml-gui - which also requires SAML auth, but only to create an auth cookie once. After that it will work for as long as that is valid.

Can the GUI stuff be done on a separate machine besides the server, as described above?

yuezk commented 10 months ago

Can the GUI stuff be done on a separate machine besides the server, as described above?

Possible, but it could be complex.

TS-CUBED commented 10 months ago

Can the GUI stuff be done on a separate machine besides the server, as described above?

I did use ssh -X in a similar scenario with just a firefox or chrome installed on the server.