search

yuezk / GlobalProtect-openconnect

A GlobalProtect VPN client for Linux, written in Rust, based on OpenConnect and Tauri, supports SSO with MFA, Yubikey, and client certificate authentication, etc.
GNU General Public License v3.0
1.2k stars 140 forks source link

Error accessing server with SAML. Signature signing problem #378

Open jose867 opened 1 week ago

jose867 commented 1 week ago

Hello! Great software, it has changed my life since I discovered it.

It has always been a Greek epic to connect to my company's Globalprotect server from Linux.

The thing is that everything has been working perfectly for the last few months, but now I find this:

org.opensaml.saml.common.SAMLException: No signature signing parameter is available

Has anyone found it? Thank you!

yuezk commented 1 week ago

org.opensaml.saml.common.SAMLException: No signature signing parameter is available

Is the log collected from the VPN server side?

yuezk commented 1 week ago

And is the client broken now?

jose867 commented 1 week ago

Yes... server side log...

It's funny that I can connect after several attempts. Using the "default browser" option has solved most of the problems I have always had. I understand that the server has qualms with something that is not its official client.

jose867 commented 1 week ago

I finally can connect... after a couple of tries. Taking into account that I have just launched a command, copied a cookie, pasted a command with a cookie... and waited for the correct connection, keeping the terminal always open. A proposal, I always have to modify the routing tables, eliminate the one that creates the connection so that all traffic goes through the VPN and route only the IP range that interests me... Networkmanager allows modifying the routes imposed by the server , For example. It worked very well until SAML was implemented... I could never use it to connect again

yuezk commented 1 week ago

The client delegates the SAML authentication to the external browser/webview. and intercept the cookies/tokens to connect to the VPN server. It does no special handling for the SAML authentication. I assume the error message on the server side may not be specific to this client.

Networkmanager allows modifying the routes imposed by the server

I'm interested in supporting this