Palo Alto Global Protect embedded browser + Shibboleth

[Nickles, Brent]

This issue is gaining traction on our campus....has anyone come up with a workable solution and/or any word if Palo is going to supply a patch?

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via users
Sent: Friday, April 29, 2022 4:36 PM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: Palo Alto Global Protect embedded browser + Shibboleth

CAUTION: This message originated from a non-UMB email system. Hover over any links before clicking and use caution opening attachments.

>    Not being a programmer, I'm hoping this makes sense to someone with specific knowledge of the logon page

I don't know what Windows is doing underneath, what matters is the HTTP requests it issues. You would need to trace the traffic and identify what it's actually communicating, but my guess is they have a bug and it's not passing the cookie(s) back in. The exception in the log will be explicit about why it broke. "Conversation not found" basically means the cookies didn't get sent, and it will also issue a new JSESSIONID in response also. There's no "API explanation" for that, that's a broken user agent.

I would, I suppose, suggest that your workaround would be some kind of Javascript in the login template to try and interfere with it and prevent whatever it might be doing with the enter key, but that's beyond my experience level.

-- Scott


--
For Consortium Member technical support, see https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cbnick001%40umaryland.edu%7Cb42a24cee9ac49ada1e208da2a1fda1f%7C3dcdbc4a7e4c407b80f77fb6757182f2%7C0%7C0%7C637868613543562169%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=eOADBkbigAIy%2BnRllitkuw%2Fj%2FTwSr32xR0BI6JeRgzo%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net