Issues with Duo OIDC plugin and GlobalProtect embedded browser

[Tom Andrew]

On Fri, 5 Jul 2024 at 09:35, Tom Andrew <tom.andrew at york.ac.uk> wrote:
>
> Has anyone else had any problems with getting the Palo Alto
> GlobalProtect VPN client embedded browser to work with the Shibboleth
> Duo OIDC plugin?
>
> We are specifically seeing issues only on Windows, where after the
> username and password is entered the users just see a blank screen (in
> the embedded browser) and the duo prompt never appears. This is the
> case with both the traditional prompt and the universal prompt when
> using the OIDC plugin.

For the archives, we discovered (entirely accidentally) that an
ancient WPAD config that we still had around seems to have been the
cause of this. It's still not clear why, given all the config said was
in all cases go direct, but getting rid of it seems to have solved
this issue and authn/DuoOIDC now works as expected with the global
protect embedded browser.

--
Tom Andrew
Infrastructure Engineer (Linux)
University of York