fix login if saml response is in body comment #59
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dlenski
previously requested changes
Sep 30, 2022
|
tested this within our company and it works now |
|
Any further updates or review comments on this, before it could get merged? @dlenski |
|
Just chiming in that one of the VPNs I've been using stopped working overnight, and it turns out this was the issue, and this PR fixed it! |
|
I hope this will be merged eventually. |
ghaith
reviewed
Jan 19, 2023
|
Thank you @ByteCommander for your patience and refinement here. I tweaked the PR slightly (squash commits, cleanup), and tested it against OpenConnect's
|
Fixes dlenski#51 [DL: Some GlobalProtect VPNs apparently return the crucial username and cookie result fields *only* in HTML comments and *not* in HTTP headers. In order to handle these cases correctly, we must parse the HTML comments in addition to the headers.] Signed-off-by: Daniel Lenski <dlenski@gmail.com>
This is a workaround for timing/race conditions.
jollaitbot
pushed a commit
to sailfishos-mirror/openconnect
that referenced
this pull request
Sep 22, 2023
…ly in comments
This modifies the fake GP server to have a 'saml_comments_only' option. If
set, the SAML completion fields ('saml-username', 'prelogin-cookie', etc.)
will be sent to the client *only* in a blob of XML wrapped in HTML comments,
and *not* in HTTP headers.
Some real GP servers are known to behave like this, and authentication
handlers like 'gp-saml-gui' need to be able to handle this case correctly
(see dlenski/gp-saml-gui#51 and
dlenski/gp-saml-gui#59).
Signed-off-by: Daniel Lenski <dlenski@gmail.com>
jollaitbot
pushed a commit
to sailfishos-mirror/openconnect
that referenced
this pull request
Sep 23, 2023
…ly in comments
This modifies the fake GP server to have a 'saml_comments_only' option. If
set, the SAML completion fields ('saml-username', 'prelogin-cookie', etc.)
will be sent to the client *only* in a blob of XML wrapped in HTML comments,
and *not* in HTTP headers.
Some real GP servers are known to behave like this, and authentication
handlers like 'gp-saml-gui' need to be able to handle this case correctly
(see dlenski/gp-saml-gui#51 and
dlenski/gp-saml-gui#59).
Signed-off-by: Daniel Lenski <dlenski@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fixes #51
If there are no SAML and/or prelogin-cookie related headers found in the server responses, this PR adds the functionality to check the response body for those values in embedded XML documents inside any HTML body comments.