From dlenski at gmail.com  Fri Oct  6 20:49:00 2023
From: dlenski at gmail.com (Daniel Lenski)
Date: Fri, 6 Oct 2023 20:49:00 -0700
Subject: Fortinet / SAML support for Windows
In-Reply-To: <CAAn=bJOsHYicNgnvLPgvW-vbhTY3Y53ENqmvuz7n1MGpyxTA0Q@mail.gmail.com>
References: <CAAn=bJOsHYicNgnvLPgvW-vbhTY3Y53ENqmvuz7n1MGpyxTA0Q@mail.gmail.com>
Message-ID: <CAOw_LSGqHR-8ggwBc0f62iFq0o39_mR2765CYHYtvKfxkdM=7w@mail.gmail.com>

On Thu, Sep 28, 2023 at 3:06?AM julio toribio <juliothebatery at gmail.com> wrote:
>
> I'm using Windows and trying to connect to a VPN(Fortinet) but by
> default SAML is used to authenticate. When we hit connect in
> Forticlient, a web browser is launched, we authenticate in i.e
> Microsoft, then Forticlient is connected.

> I saw the option --external-browser=BROWSER but openconnects complains
> with "openconnect.exe: unknown option -- external-browser"
> I tried  replacing the "=" for an empty space (--external-browser
> "C:\P...") but still the same result.

> I'm I missing something?

The short answer here is that OpenConnect does not yet have any
support for SAML-based authentication using an external browser **with
the Fortinet protocol**.

See a related issue on GitLab:
https://gitlab.com/openconnect/openconnect/-/issues/?state=all&label_name%5B%5D=protocol%3A%3AFortinet&label_name%5B%5D=External%20Auth%2FSAML%2FSSO

As far as I know, none of the main OpenConnect developers have any
access to a Fortinet VPN that uses SAML, so without a lot more details
about *how* Fortinet does this SAML authentication (see
https://gitlab.com/openconnect/openconnect/-/issues/356#note_912401634),
it will not happen.

As ever, more details on how it works (especially in the form of a
merge request with working code :-)) would be welcome!


From sulfurfff at gmail.com  Wed Oct 25 12:57:13 2023
From: sulfurfff at gmail.com (=?UTF-8?Q?Ismael_Farf=C3=A1n?=)
Date: Wed, 25 Oct 2023 13:57:13 -0600
Subject: TOTP / Second password CLI option?
Message-ID: <CANXECd6D_2y=uZetT2DD9y24L8srgWxYX+SUk_KKcK8G5ETPmg@mail.gmail.com>

Hello

Our VPN server requires a Password + TOTP/"push" code.

I lost the TOTP key long ago xD but, If I use "push" as a code, I get
a phone notification to grant access.

Question:
How can I put the password and code in the CLI line?


Currently I HAVE to fail the first try because it only asks for one
password, so I couldn't script it and then during the second try it
actually asks for both passwords.

This is how I'm currently connecting, manually typing the username and
password(s):

openconnect   \
--authgroup foo \
--passwd-on-stdin \
--verbose \
-b some-server.com

I also tried with KDE network-manager UI but none of the available
openconnect templates had a group option, let alone passwords.

I'm using Debian stable with openconnect 9.01-3.

Regards
-Ismael

-- 
Do not let me induce you to satisfy my curiosity, from an expectation,
that I shall gratify yours. What I may judge proper to conceal, does
not concern myself alone.


From owmcclung at gmail.com  Wed Oct 25 15:44:49 2023
From: owmcclung at gmail.com (O. William McClung)
Date: Wed, 25 Oct 2023 17:44:49 -0500
Subject: Ubuntu 20.04 openconnect fails for GlobalProtect server
Message-ID: <CAN+YAYz6CRfwUPZ6HXuhSnGH=dhJPpq+JLw5gA-OLsv_UG5Y+A@mail.gmail.com>

I have openconnect v8.05-1, the latest for Ubuntu 20.04, and am trying
to connect to a GlobalProtect server which I know requires
gp-saml-gui.

$ gp-saml-gui -p -S --clientos=Windows <server> -- --authgr='US Central'

allows me to authenticate. After the long URL following this prompt

SAML login is required via REDIRECT to this URL:

comes

Enter login credentials
POST https://<server>/global-protect/getconfig.esp
8 gateway servers available:
 US Northwest (us-northwest-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
 US Southwest (us-southwest-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
 US West (us-west-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
 US East (us-east-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
 US Southeast (us-southeast-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
 US Central (us-central-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
 US Northeast (us-northeast-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
 US South (us-south-universi.gpo2ojjg5cnn.gw.gpcloudservice.com)
Please select GlobalProtect gateway.
POST https://us-central-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com/ssl-vpn/login.esp
Connected to 208.127.240.223:443
SSL negotiation with us-central-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com
Connected to HTTPS on us-central-g-universi.gpo2ojjg5cnn.gw.gpcloudservice.com
Failed to parse server response
Failed to obtain WebVPN cookie

Thanks for any help you can provide.

-Bill McClung


