Palo Alto Global Protect embedded browser + Shibboleth

[Jones, Steve]

Since a couple more people have replied on this issue, I figured I’d send an update. I’ve had no progress on my case with Palo Alto, but I believe I’ve narrowed it down to DUO and, specifically, jQuery.

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631833/SystemRequirements

"The HTML-based user interfaces make relatively minimal use of Javascript with the exception of the Duo and logout features, which include a dependency on JQuery (a version of which is included with the software)."

I discovered you can hit control+L in the Global Protect Embedded browser while it’s at the logon page and get prompted to enter a URL to go to.

There’s an API example website for JQuery and its keydown event handler (https://api.jquery.com/keydown/), and it looks like keydown is what’s submitting the login form. I was able to use control+L to load that site in the GP Embedded browser and test to confirm that it’s related.

Global Protect 5.2.8 – hitting enter in their demo “Type Something” example form returns the same results as I get in a full desktop browser like Chrome.

http://webpages.csus.edu/steve.jones/gp5.2.8.mp4

Global Protect 5.2.11 – hitting enter in the same form starts to return the text from the event handler, but then reloads the entire page nested in the main page. It seems like it registers the enter key and the event handler does its thing, but then something else happens to reload the page (the Windows API change Palo Alto made?). So it's not surprising it breaks the login process.

http://webpages.csus.edu/steve.jones/gp5.2.11.mp4

I've sent these same details to Palo Alto.

---
Steve Jones
California State University, Sacramento