Palo Alto Global Protect embedded browser + Shibboleth

[John C. Pfeifer]

We’ve done some more digging. What we are seeing is that the embedded browser is doing a double POST from the username/password page--both POSTs with "execution=e1s1”. Obviously, this is doomed to failure (well, the second POST is doomed) and not the fault of the IdP.

//
John Pfeifer
Division of Information Technology
University of Maryland, College Park

> On May 13, 2022, at 11:49 PM, Jones, Steve <steve.jones at csus.edu> wrote:
> 
> Since a couple more people have replied on this issue, I figured I’d send an update. I’ve had no progress on my case with Palo Alto, but I believe I’ve narrowed it down to DUO and, specifically, jQuery.
> 
> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631833/SystemRequirements
> 
> "The HTML-based user interfaces make relatively minimal use of Javascript with the exception of the Duo and logout features, which include a dependency on JQuery (a version of which is included with the software)."
> 
> I discovered you can hit control+L in the Global Protect Embedded browser while it’s at the logon page and get prompted to enter a URL to go to.
> 
> There’s an API example website for JQuery and its keydown event handler (https://api.jquery.com/keydown/), and it looks like keydown is what’s submitting the login form. I was able to use control+L to load that site in the GP Embedded browser and test to confirm that it’s related.
> 
> Global Protect 5.2.8 – hitting enter in their demo “Type Something” example form returns the same results as I get in a full desktop browser like Chrome.
> 
> http://webpages.csus.edu/steve.jones/gp5.2.8.mp4
> 
> Global Protect 5.2.11 – hitting enter in the same form starts to return the text from the event handler, but then reloads the entire page nested in the main page. It seems like it registers the enter key and the event handler does its thing, but then something else happens to reload the page (the Windows API change Palo Alto made?). So it's not surprising it breaks the login process.
> 
> http://webpages.csus.edu/steve.jones/gp5.2.11.mp4
> 
> I've sent these same details to Palo Alto.
> 
> ---
> Steve Jones
> California State University, Sacramento
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net