GlobalProtect VPN with SAML Authentication

justin_brody · Apprentice Joined: 26 Jan 2005 Posts: 283

Has anyone been able to successfully set this up? I've been poking at it for a bit but not having much luck.

Here's some things I have tried:

Using the PanGpsUI. No luck, it wants QT5 webkit which is unsupported.
Using PanGPS and the globalconnect command line. I get "Failed to connect to <remote_server>. Error: Default browser is not enabled"
Using gp-saml-gui. This will let me login and perform 2 factor authentication. I get a message that says "Login Successful" but I don't get the expected message " Got SAML relevant headers, done". No variables seem to be set when run inside an eval

Any guidance would be appreciated!

alamahant · Advocate Joined: 23 Mar 2019 Posts: 3879

I found this

justin_brody · Apprentice Joined: 26 Jan 2005 Posts: 283

Thanks alamahant!
I should mention that this is a server I used to connect to fine using a configuration similar to what you posted. Unfortunately they switched the authentication mechanisms to that now SAML is required.

My understanding is that VPNC does not support this but OpenVPN does. From what I can tell, there's an extra step to get the information the needs to be passed to OpenVPN (the "SAML-relevant headers" that gp-saml-gui is looking for) and this is where I seem to be stuck...

alamahant · Advocate Joined: 23 Mar 2019 Posts: 3879

I dont know if it helpful but I found this
https://gpo.zugaina.org/net-vpn/globalprotect-openconnect
And ot supports saml.
But it requires
dev-qt/qtwebengine
Oh-my-God!
But there are cli versions

salahx · Guru Joined: 12 Mar 2005 Posts: 530

My workplace uses it too. Support exists in theory, but won't totally be realized until st least the next version of net-vpn/networkmanager-openconnect is released.: https://gitlab.gnome.org/GNOME/NetworkManager-openconnect/-/merge_requests/26

The main problem is the etworkmanager-openconnect needs to embed a browser within it to display the portal to get the cookie needed for the gateway

See https://www.infradead.org/openconnect/globalprotect.html for support.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

I wrote an ebuild for a git prerelease snapshot.of netowrkmanager-openconnect. It was quite buggy for me (could connect to the portal but not the gateway, also needed the VPN settings opened to get the dialog box, in addition, you need to press Logiin on the auth dialog box to get the web page to appear)) , although it open up the web browser and ask for credential, I was able to login to the portal successfully.

Call it "networkmanager-openconnect-1.2.9_pre20220526.ebuild"

pgu · l33t Joined: 30 Jul 2009 Posts: 721 Location: Oslo, Norway

I'm sorry I don't follow all this, but why is a GUI required to connect to the VPN?

salahx · Guru Joined: 12 Mar 2005 Posts: 530

The authentication process with SAML can works something like this: When the user connected to the VPN, the server spits out a SAML REDIRECT to a web site to do the authentication. Once the authentication is completed, the web server returns a cookie need for the 2nd phase of authentication. The VPN client needs this cookie, and so an embedded web browser is opened to handle the redirect, the user performs the authentication, and then captures the cookie.

pgu · l33t Joined: 30 Jul 2009 Posts: 721 Location: Oslo, Norway

Thank you for the explanation. I guess a chromedriver/selenium could do the job for a CLI interface then.

mimosinnet · Posted: Sat Dec 02, 2023 6:01 am Post subject:

cfgauss · l33t Joined: 18 May 2005 Posts: 688 Location: USA

I was able to install release 2.1.0 of globalprotect-openconnect from source. It has a fix-openssl flag which I believe is necessary for my VPN server/VPN gateway/Gentoo box combination. Works like a charm.