Open dlenski opened 4 years ago
I've pulled the SMS bit -- that works fine for me. I did modify the change slightly: AFAICT you're not supposed to include factorId in the POST body -- that's part of the URL and is already included in the ['verify']['href'].
Aha, thanks. I based that off the usage in pan-globalprotect-okta (https://github.com/arthepsy/pan-globalprotect-okta/blob/master/gp-okta.py#L331,L342). The implementation over there is, hrmm, a lot messier than yours… so it's hard for me to determine whether including this field is/was found to be necessary in any case.
I also added an assert to check the status is MFA_CHALLENGE after the first POST.
:+1:
I'm unsure about the POST/REDIRECT change. The code looks broken in the case where saml-auth-method is REDIRECT (saml_req_data is not set at all)?
I don't have access to a “live” VPN that uses the REDIRECT method, but here's my understanding of how it works (based on this comment https://github.com/dlenski/openconnect/pull/97#issuecomment-377899908):
<saml-auth-method>REDIRECT</saml-auth-method>
<saml-request>aHR0cDovL3NhbWwuYXV0aC5lbmRwb2ludC5jb21wYW55LmNvbS9ibGFoL2JsYWg/YWNjZXNzPUtK
RldFUklVRVJCU0RMU1BJV0VSS0pTREZKSFNLREdOQ0tTSkRGU0ZECg==</saml-request>
<saml-request>
contents as the source of a form to be POST
ed by the client in order to start the SAML authentication process, the contents simply contain a URL which the client should GET
in order to start the process.saml_req_data
is needed because it's presumably already encoded into the URL.Also only the first request to saml_req_url is actually changed to POST in the POST case. The second request (the one that actually returns the SAML response) is still a redirect from sessionCookieRedirect.
Right.
I'm not really sure what the right thing to do here is. For me, saml-auth-method is POST but doing GETs works fine and IIRC is what the official client was doing. Slightly off-topic: it's not really clear why the first GET is necessary at all. I know that it sets a DT cookie (which I guess is some kind of tracking cookie), and that without this the sessionCookieRedirect just doesn't seem to work. But none of this is mentioned in the Okta docs (edit: I guess this is GP-specific so it wouldn't be).
I share your understanding, and also your uncertainty about what some of these things mean.
Basically, the difference between POST
and REDIRECT
is a relatively superficial one: the former says "POST
this form to start the SAML auth", while the latter says "GET
this URL to start the SAML auth.
<saml-auth-method>