Default Browser Failure

yuezk / GlobalProtect-openconnect

A GlobalProtect VPN client for Linux, written in Rust, based on OpenConnect and Tauri, supports SSO with MFA, Yubikey, and client certificate authentication, etc.

GNU General Public License v3.0

1.29k stars 147 forks source link

Default Browser Failure #397

Closed bagnaram closed 2 weeks ago

bagnaram commented 1 month ago

Describe the bug Unable to use default browser for SSO. I see the following login error when using the default browser. The embedded browser doesn't support yubikeys so I wish to use my internal one.

Expected behavior I expect to see the same page as in the internal browser.

Screenshots

Logs

For the GUI version, you can find the logs at ~/.local/share/gpclient/gpclient.log
For the CLI version, copy the output of the gpclient command.

Environment:

OS: Linux fedora 6.9.9-200.fc40.x86_64
Desktop Environment: Sway
bagnaram 3356 0.0 0.0 681592 9180 ? SLsl Jul22 0:00 /usr/bin/gnome-keyring-daemon --start --foreground --components=secrets

Additional context Add any other context about the problem here.

yuezk commented 1 month ago

Looks like the authentication has already finished, you could have already used your yubikey. Retry it from the start for this error.

bagnaram commented 1 month ago

It appears to be an issue launching in an already launched browser. It may be helpful to add a config option to override the browser with CLI args such as --profile in Firefox. I was able to get a successful login by temporarily installing a secondary browser and setting the XDG default browser to that browser instead of my main.

yuezk commented 1 month ago

Hi @bagnaram, glad you found the workaround, I will try to add an option to use a new profile.

yuezk commented 3 weeks ago

Hi @bagnaram I found this may related to the sudo, even though I can launch the browser as a normal user. In 2.3.7, I enhanced the gpauth command to support the browser authentication. You can try the following command to authenticate the external browser and see if it works.

gpauth <portal> --browser default 2>/dev/null | sudo gpclient connect <portal> --cookie-on-stdin

And you can specify the browser to launch, e.g., --browser firefox or --browser chrome, etc.

bagnaram commented 2 weeks ago

Thank you that option works for me using the separate browser instance!