Palo Alto Global Protect embedded browser + Shibboleth

[Les LaCroix]

We are mostly seeing this with the Global Protect client (>99.9%), but we
are also seeing this with logins to our Microsoft Online, having nothing to
do with the Global Protect client.

Our Azure tenant is federated back to our Shibboleth IdP.  Logging in to
Microsoft 365 desktop apps pops up an embedded browser with the first MS
online login screen, asking you for your "email address".  That window
redirects to our IdP, and from there it's just like what we've been
experiencing with Global Protect client logins.  (I believe our Global
Protect workaround is that we have reverted the GP client to the previous
version and turned off automatic checking for updates.)

We don't typically deploy MS 365 versions of those apps, so this affects
maybe a half dozen of our users, and they've all learned to click the
sign-in button instead of pressing enter.

Anyway, there is definitely something in our login pages that triggers the
issue with the MS embedded browser technology, and definitely something in
the Global Protect client update that exacerbates it.

Here's a question: is anyone seeing this problem after having switched to
the Duo Universal Prompt?  Some folks here are hoping that going to the
Universal Prompt might alter things enough that the GP client problem will
go away.  We had to tweak our javascript when we first deployed SSO in the
GP client several months ago because our javascript used a method that
wasn't implemented in the embedded browser.  (That was a lot of fun
debugging, by the way.)

-Les


<http://www.carleton.edu/>

*Les LaCroix '79*

Strategic Technologist

Information Technology Services

t: (507) 222-5455


On Fri, May 13, 2022 at 7:37 AM Nickles, Brent via users <
users at shibboleth.net> wrote:

> This issue is gaining traction on our campus....has anyone come up with a
> workable solution and/or any word if Palo is going to supply a patch?
>
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via
> users
> Sent: Friday, April 29, 2022 4:36 PM
> To: Shib Users <users at shibboleth.net>
> Cc: Cantor, Scott <cantor.2 at osu.edu>
> Subject: Re: Palo Alto Global Protect embedded browser + Shibboleth
>
> CAUTION: This message originated from a non-UMB email system. Hover over
> any links before clicking and use caution opening attachments.
>
> >    Not being a programmer, I'm hoping this makes sense to someone with
> specific knowledge of the logon page
>
> I don't know what Windows is doing underneath, what matters is the HTTP
> requests it issues. You would need to trace the traffic and identify what
> it's actually communicating, but my guess is they have a bug and it's not
> passing the cookie(s) back in. The exception in the log will be explicit
> about why it broke. "Conversation not found" basically means the cookies
> didn't get sent, and it will also issue a new JSESSIONID in response also.
> There's no "API explanation" for that, that's a broken user agent.
>
> I would, I suppose, suggest that your workaround would be some kind of
> Javascript in the login template to try and interfere with it and prevent
> whatever it might be doing with the enter key, but that's beyond my
> experience level.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cbnick001%40umaryland.edu%7Cb42a24cee9ac49ada1e208da2a1fda1f%7C3dcdbc4a7e4c407b80f77fb6757182f2%7C0%7C0%7C637868613543562169%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=eOADBkbigAIy%2BnRllitkuw%2Fj%2FTwSr32xR0BI6JeRgzo%3D&reserved=0
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220513/ed3a321d/attachment.htm>