PAGP (Palo Alto Global Protect) with SAML authentication is broken on Ubuntu desktop

Bug #2026771 reported by Bun K Tan
38
This bug affects 1 person
Affects Status Importance Assigned to Milestone
intel
In Progress
High
Unassigned
gp-saml-gui (Ubuntu)
Status tracked in Mantic
Focal
Fix Released
Undecided
Shane McKee
Jammy
Fix Released
Undecided
Shane McKee
Lunar
Fix Released
Undecided
Shane McKee
Mantic
Fix Released
Undecided
Shane McKee

Bug Description

SRU Justification:

[ Impact ]

While trying to connect to the Palo Alto Global Protect (PAGP) VPN, gp-saml-gui hangs after authentication. Additionally, gp-saml-gui is not even available for 20.04 LTS users.

This fixes the first issue by backporting the following patch to each version of this package:
https://github.com/dlenski/gp-saml-gui/commit/085d3276e17e1094e22e5d49545e273147598eb4
gp-saml-gui expects lowercase HTTP headers, so this patch allows gp-saml-gui to handle mixed-case headers as well.

It fixes the second issue by creating a gp-saml-gui focal package.

[ Test Plan ]

Assumptions:

1. User has gp-saml-gui installed
2. User has valid PEM-encoded client certificate at '~/.cert/certificate.pem' and PEM-encoded client certificate private key at '~/.cert/vpn-priv-key-plain.pem'
3. Server is configured to use client certificate for authentication
4. Server is configured to also use Microsoft SAML for authentication
5. Server does not require "unsafe legacy negotiation" or user has applied appropriate workaround (see: https://github.com/dlenski/gp-saml-gui/issues/37)
6. Server is located at ${VPN_URL}

Instructions:

1. Run the following command from the shell: gp-saml-gui -g -c ~/.cert/certificate.pem --key ~/.cert/vpn-priv-key-plain.pem -S ${VPN_URL}
2. Authenticate in the pop-up window (see 'login.png'); this might consist of:
        - Login e-mail
        - Login password
        - OTP code
3. Pop-up window changes to "Login Successful!" and stays there indefinitely (see 'login_success.png')

[ Where problems could occur ]

* The patch is pretty innocuous looking and already exists upstream, but if it breaks
   functionality, it could break authentication for all current users of this package
   and prevent anyone from accessing their VPNs.
* Any backport which does not take all of the preceding patches risks missing
   some required patches in between.

[ Other Info ]

* focal does not yet have a gp_saml_gui package, this is the initial upload on partner request (same version different version number than jammy)
* kinetic/22.10 is ignored, because it went EOL on July 20th, 2023
* fix is the same and applies as is to all further affected Ubuntu releases
* The debhelper-compat dependency version had to be downgraded to 12 in
  debian/control for Focal since that is the version we have there.

--- Original Description ---

When using 'gp-saml-gui' in order to connect to the Palo Alto Global Protect (PAGP) VPN, 'gp-saml-gui' hangs after a successful authentication.
This appears to be due to bug in 'gp-saml-gui' which was triggered as a result of server-side changes in PAGP;
'gp-saml-gui' expects the HTTP headers returned by the PAGP server to be in lowercase format, but the headers are being returned in mixed-case format.
The HTTP specification requires headers to be interpreted in a case-insensitive manner.
This upstream patch in 'gp-saml-gui' fixes the issue: https://github.com/dlenski/gp-saml-gui/commit/085d3276e17e1094e22e5d49545e273147598eb4
Manually applying the change in the patch to my system fixes the issue.
Without applying the patch, 'gp-saml-gui' cannot connect to the VPN server and is thus broken.

This bug appears to fall under the Stable Release Update (SRU) criteria of a "High-impact bug", because an update needs to be applied to the package due to a change in the PAGP VPN server which causes the current version to cease working.
I therefore request that the aforementioned patch be applied to the stable 'gp-saml-gui' package.

Revision history for this message
Bun K Tan (bktan1) wrote :
Bun K Tan (bktan1)
Changed in intel:
importance: Undecided → High
affects: ubuntu → linux (Ubuntu)
Revision history for this message
Marcelo Cerri (mhcerri) wrote :

Hello, Bun K Tan.

Do you have more details on how to test and reproduce the problem so we can validate if the fix is really working?

Thank you!

Revision history for this message
Bun K Tan (bktan1) wrote :

Hi Marcelo,

Unfortunately, we can't grant access to our VPN instance in order for you to test the fix. We've applied the fix manually (by directly editing '/usr/share/gp-saml-gui/gp_saml_gui.py') and it does work.

Would it possible for you to send us the updated package and we can verify for you?

Thanks!

Revision history for this message
Bun K Tan (bktan1) wrote :
Revision history for this message
Bun K Tan (bktan1) wrote :

Instructions to reproduce
-------------------------
Assumptions:

1. User has gp-saml-gui installed
2. User has valid PEM-encoded client certificate at '~/.cert/certificate.pem' and PEM-encoded client certificate private key at '~/.cert/vpn-priv-key-plain.pem'
3. Server is configured to use client certificate for authentication
4. Server is configured to also use Microsoft SAML for authentication
5. Server does not require "unsafe legacy negotiation" or user has applied appropriate workaround (see: https://github.com/dlenski/gp-saml-gui/issues/37)
6. Server is located at ${VPN_URL}

Instructions:

1. Run the following command from the shell: gp-saml-gui -g -c ~/.cert/certificate.pem --key ~/.cert/vpn-priv-key-plain.pem -S ${VPN_URL}
2. Authenticate in the pop-up window (see 'login.png'); this might consist of:
        - Login e-mail
        - Login password
        - OTP code
3. Pop-up window changes to "Login Successful!" and stays there indefinitely (see 'login_success.png')

Shane McKee (mckeesh)
affects: linux (Ubuntu) → gp-saml-gui (Ubuntu)
Changed in gp-saml-gui (Ubuntu):
assignee: nobody → Shane McKee (mckeesh)
status: New → Confirmed
Shane McKee (mckeesh)
summary: - gp-saml-gui hangs after successful authentication
+ PAGP (Palo Alto Global Protect) with SAML authentication is broken on
+ Ubuntu desktop
Frank Heimes (fheimes)
Changed in intel:
status: New → Confirmed
Shane McKee (mckeesh)
Changed in gp-saml-gui (Ubuntu Lunar):
assignee: nobody → Shane McKee (mckeesh)
Changed in gp-saml-gui (Ubuntu Focal):
assignee: nobody → Shane McKee (mckeesh)
Changed in gp-saml-gui (Ubuntu Jammy):
assignee: nobody → Shane McKee (mckeesh)
Bun K Tan (bktan1)
information type: Private → Public
Shane McKee (mckeesh)
description: updated
Revision history for this message
Shane McKee (mckeesh) wrote :
Frank Heimes (fheimes)
description: updated
Revision history for this message
Shane McKee (mckeesh) wrote :
Revision history for this message
Frank Heimes (fheimes) wrote :

I had a look at the latest debdiffs in comment #8 and did a review.
Looks good, nice work - also great SRU justification!
Thx for your contribution!

I'll start to upload now ...

Changed in gp-saml-gui (Ubuntu Mantic):
status: Confirmed → In Progress
Changed in gp-saml-gui (Ubuntu Lunar):
status: New → In Progress
Changed in gp-saml-gui (Ubuntu Jammy):
status: New → In Progress
Changed in gp-saml-gui (Ubuntu Focal):
status: New → In Progress
Changed in intel:
status: Confirmed → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gp-saml-gui - 0.0~git20220831-1ubuntu1

---------------
gp-saml-gui (0.0~git20220831-1ubuntu1) mantic; urgency=medium

  * Add d/p/lp-2026771-Handle-headers-case-insensitively.patch to fix broken
    PAPG with SAML authentication working (LP: #2026771)
  * d/control: Changes due to update-maintainer run.

 -- Shane McKee <email address hidden> Wed, 26 Jul 2023 13:17:11 -0600

Changed in gp-saml-gui (Ubuntu Mantic):
status: In Progress → Fix Released
Revision history for this message
Timo Aaltonen (tjaalton) wrote : Please test proposed package

Hello Bun, or anyone else affected,

Accepted gp-saml-gui into lunar-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gp-saml-gui/0.0~git20220831-1ubuntu0.23.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-lunar to verification-done-lunar. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-lunar. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in gp-saml-gui (Ubuntu Lunar):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-lunar
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Hello Bun, or anyone else affected,

Accepted gp-saml-gui into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gp-saml-gui/0.0~git20210909-1ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in gp-saml-gui (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

the focal upload needs an archive admin to process it from the NEW queue

Revision history for this message
Bun K Tan (bktan1) wrote :

Hello Timo,

Confirmed that the fix works as expected in Mantic and Jammy. We haven't tested Lunar since we don't need it. We're still waiting the package for Focal.

Thanks!

Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Hello Bun, or anyone else affected,

Accepted gp-saml-gui into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gp-saml-gui/0.0~git20210909-1ubuntu0.20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in gp-saml-gui (Ubuntu Focal):
status: In Progress → Fix Committed
tags: added: verification-needed-focal
Revision history for this message
Bun K Tan (bktan1) wrote :

Hello Lukasz,

Looks like we're having trouble getting "focal-proposed" to install properly. Dependency issues.

        $ sudo apt-get install gp-saml-gui/focal-proposed
        Reading package lists... Done
        Building dependency tree
        Reading state information... Done
        Selected version '0.0~git20210909-1ubuntu0.20.04.1' (Ubuntu:20.04/focal-proposed [all]) for 'gp-saml-gui'
        Some packages could not be installed. This may mean that you have
        requested an impossible situation or if you are using the unstable
        distribution that some required packages have not yet been created
        or been moved out of Incoming.
        The following information may help to resolve the situation:

        The following packages have unmet dependencies:
         gp-saml-gui : Depends: openconnect (>= 8.06~) but 8.05-1 is to be installed
                       Depends: vpnc-scripts (>= 0.1~git20200226~) but 0.1~git20190117-1 is to be installed
        E: Unable to correct problems, you have held broken packages.

       $ apt-cache policy gp-saml-gui
        gp-saml-gui:
          Installed: (none)
          Candidate: 0.0~git20210909-1ubuntu0.20.04.1
          Version table:
             0.0~git20210909-1ubuntu0.20.04.1 400
                400 http://archive.ubuntu.com/ubuntu focal-proposed/universe amd64 Packages
                400 http://archive.ubuntu.com/ubuntu focal-proposed/universe i386 Packages

        apt-cache policy openconnect
        openconnect:
          Installed: 8.05-1
          Candidate: 8.05-1
          Version table:
         *** 8.05-1 500
                500 http://us.archive.ubuntu.com/ubuntu focal/universe amd64 Packages
                100 /var/lib/dpkg/status

        wtcline@wtcline-desk7:~/wtcline.ansible$ apt-cache policy vpnc-scripts
        vpnc-scripts:
          Installed: 0.1~git20190117-1
          Candidate: 0.1~git20190117-1
          Version table:
         *** 0.1~git20190117-1 500
                500 http://us.archive.ubuntu.com/ubuntu focal/universe amd64 Packages
                500 http://us.archive.ubuntu.com/ubuntu focal/universe i386 Packages
                100 /var/lib/dpkg/status

Revision history for this message
Shane McKee (mckeesh) wrote :

It looks like I missed some dependency version issues in the control file. I built this and installed it successfully in a focal VM, so we should be good on this one.

Revision history for this message
Shane McKee (mckeesh) wrote :

Hi Bun & others affected,

Since this is a new backport, can you please try my PPA for Focal before we submit a proposed version again?

sudo add-apt-repository ppa:mckeesh/lp2026771
sudo apt update
sudo apt install gp-saml-gui

Revision history for this message
Bun K Tan (bktan1) wrote :

Tested '0.0~git20220831-1ubuntu0.23.04.1' on Lunar (Ubuntu 23.04) and confirmed that it works!

Revision history for this message
Bun K Tan (bktan1) wrote :

Hi Shane,

We just tried your PPA and had success with the package!

Thanks!

Frank Heimes (fheimes)
tags: added: verification-done-jammy verification-done-lunar
removed: verification-needed-jammy verification-needed-lunar
tags: added: verification-failed-focal
Revision history for this message
Frank Heimes (fheimes) wrote :

Quick summary and status:

I first of all tagged version 0.0~git20210909-1ubuntu0.20.04.1 with verification-failed-focal due to the reported dependency issues.

This was fixed in 0.0~git20210909-1ubuntu0.20.04.*2*.
The fixed version 0.0~git20210909-1ubuntu0.20.04.2 was build in PPA, lintian is happy, the installation tested (even on multiple platforms), the initial bug reporter did a successful functional test based on the PPA package and the debdiff checked (should be a diff between 0.0~git20210909-1ubuntu0.20.04.1 and 0.0~git20210909-1ubuntu0.20.04.2, since 0.0~git20210909-1ubuntu0.20.04.1 already hit the archive, even if it was only -proposed - it's attached to this comment).

With that I'm uploading now 0.0~git20210909-1ubuntu0.20.04.2.

Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Hello @bktan1,

> Confirmed that the fix works as expected in Mantic and Jammy. We haven't tested Lunar since we don't need
> it. We're still waiting the package for Focal.

Can you please confirm that you used the package from the jammy-proposed repository, and not from some ppa or even a local build?

Revision history for this message
Andreas Hasenack (ahasenack) wrote : Update Released

The verification of the Stable Release Update for gp-saml-gui has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gp-saml-gui - 0.0~git20220831-1ubuntu0.23.04.1

---------------
gp-saml-gui (0.0~git20220831-1ubuntu0.23.04.1) lunar; urgency=medium

  * Add d/p/lp-2026771-Handle-headers-case-insensitively.patch to fix broken
    PAPG with SAML authentication working (LP: #2026771)
  * d/control: Changes due to update-maintainer run.

 -- Shane McKee <email address hidden> Wed, 26 Jul 2023 14:12:25 -0600

Changed in gp-saml-gui (Ubuntu Lunar):
status: Fix Committed → Fix Released
Revision history for this message
Bun K Tan (bktan1) wrote :

@ahasenack

>Can you please confirm that you used the package from the jammy-proposed repository, and not from some ppa >or even a local build?

Yes, we tested the package from jammy-proposed.

Revision history for this message
Robie Basak (racb) wrote :

Accepting gp-saml-gui 0.0~git20210909-1ubuntu0.20.04.2 into focal-proposed. I don't think _versioned_ depends are necessary at all unless they affect an upgrade path *up to* Focal or gp-saml-gui needs versions newer than in the Focal release pocket. So it seems a bit strange just do move them back to the Focal versions. But they aren't doing any harm there either so no need to change it now.

tags: removed: verification-failed-focal
Revision history for this message
Robie Basak (racb) wrote : Please test proposed package

Hello Bun, or anyone else affected,

Accepted gp-saml-gui into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gp-saml-gui/0.0~git20210909-1ubuntu0.20.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gp-saml-gui - 0.0~git20210909-1ubuntu0.22.04.1

---------------
gp-saml-gui (0.0~git20210909-1ubuntu0.22.04.1) jammy; urgency=medium

  * Add d/p/lp-2026771-Handle-headers-case-insensitively.patch to fix broken
    PAPG with SAML authentication working (LP: #2026771)
  * d/control: Changes due to update-maintainer run.

 -- Shane McKee <email address hidden> Wed, 26 Jul 2023 14:19:20 -0600

Changed in gp-saml-gui (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Bun K Tan (bktan1) wrote :

@racb:

> I can confirm that the gp-saml-gui package in Focal works as expected!
>
> Output of 'apt-cache policy gp-saml-gui':
>
> gp-saml-gui:
> Installed: 0.0~git20210909-1ubuntu0.20.04.2
> Candidate: 0.0~git20210909-1ubuntu0.20.04.2
> Version table:
> *** 0.0~git20210909-1ubuntu0.20.04.2 400
> 400 http://archive.ubuntu.com/ubuntu focal-proposed/universe amd64 Packages
> 400 http://archive.ubuntu.com/ubuntu focal-proposed/universe i386 Packages
> 100 /var/lib/dpkg/status

Revision history for this message
Luís Infante da Câmara (luis220413) wrote :

Marking as verified per comment #29.

tags: added: verification-done verification-done-focal
removed: verification-needed verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gp-saml-gui - 0.0~git20210909-1ubuntu0.20.04.2

---------------
gp-saml-gui (0.0~git20210909-1ubuntu0.20.04.2) focal; urgency=medium

  * Fix focal verification failure (LP: #2026771).
    - d/control: Change openconnect minimum version to 8.05 to match the
      version available in focal.
    - d/control: Change vpnc-scripts minimum version to 0.1~git20190117 to
      match the version available in focal.

gp-saml-gui (0.0~git20210909-1ubuntu0.20.04.1) focal; urgency=medium

  * Initial upload, requested at (LP: #2026771).
    - Pick latest (SRU-) version from 22.04, but use focal-specific version.
    - d/control: Decrease debhelper-compat to 12 to enable 20.04 builds.
    - d/p/lp-2026771-Handle-headers-case-insensitively.patch is incl. to fix
      broken PAPG with SAML authentication.
    - d/control: Changes due to update-maintainer run

 -- Shane McKee <email address hidden> Mon, 14 Aug 2023 11:25:38 -0600

Changed in gp-saml-gui (Ubuntu Focal):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.