Issues with Duo OIDC plugin and GlobalProtect embedded browser

[Tom Andrew]

Hi,

Has anyone else had any problems with getting the Palo Alto
GlobalProtect VPN client embedded browser to work with the Shibboleth
Duo OIDC plugin?

We are specifically seeing issues only on Windows, where after the
username and password is entered the users just see a blank screen (in
the embedded browser) and the duo prompt never appears. This is the
case with both the traditional prompt and the universal prompt when
using the OIDC plugin.

Version 6.2.3 of the GlobalProtect client (and some other versions,
which I'm told are using WebView2) has some fixes for WebView2 and it
does manage to display the duo prompt and the auth appears to all
complete successfully, but then the VPN connection never gets set up
by GlobalProtect. This is the case with both the old and new OIDC duo
plugins, and we think this is basically a bug in the GP client (that
will hopefully be fixed at some point) - but if anyone has found a
work around do please share.

It is probably also worth mentioning that we have tested using the
'default browser' instead of the 'embedded browser', but while that
does solve this issue it is apparently liable to make users lose their
"open" tabs if on boot they launch GlobalProtect before opening the
browser otherwise, so is not a very good user experience - if anyone
has any tips to share on that front that would also be useful.

This is currently preventing us upgrading to IdP v5, so we are eager
to find a solution soon before v4 goes end of life!

--
Tom Andrew
Infrastructure Engineer (Linux)
University of York