Azure AD SSO asking me to "stay signed in" breaks flow #36

philippgerard · 2020-12-08T10:13:44Z

Hi there,

we're using some O365 AD with custom login pages, which seem to work flawlessly. However, after the 2FA confirmation using MS Authenticator App the page asking me if I want to "stay signed in" loads in the modal and then disappears every time before I can confirm. This effectively seems to break the flow.

This is the last message on the CLI:

[info ] Browser exited [openconnect_sso.browser.browser]
[info ] Response received [openconnect_sso.authenticator] id=main message=Please complete the authentication process in the AnyConnect Login window. title=
[error ] Could not finish authentication. Invalid response type in current state [openconnect_sso.authenticator] response=AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Single sign-on AnyConnect token verification failure.', login_url='https://vpn.....de/+CSCOE+/saml/sp/login?tgname=DefaultWEBVPNGroup&acsamlcap=v2', login_final_url='https://vpn.....de/+CSCOE+/saml_ac_login.html', token_cookie_name='...', opaque=<Element opaque at 0x7f594cae2c40>)
Traceback (most recent call last):
File "/usr/bin/openconnect-sso", line 33, in
sys.exit(load_entry_point('openconnect-sso==0.6.0', 'console_scripts', 'openconnect-sso')())
File "/usr/lib/python3.9/site-packages/openconnect_sso/cli.py", line 169, in main
return app.run(args)
File "/usr/lib/python3.9/site-packages/openconnect_sso/app.py", line 34, in run
auth_response, selected_profile = asyncio.get_event_loop().run_until_complete(
File "/usr/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
return future.result()
File "/usr/lib/python3.9/site-packages/openconnect_sso/app.py", line 137, in _run
auth_response = await authenticate_to(
File "/usr/lib/python3.9/site-packages/openconnect_sso/authenticator.py", line 50, in authenticate
raise AuthenticationError(response)
openconnect_sso.authenticator.AuthenticationError: AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Single sign-on AnyConnect token verification failure.', login_url='https://vpn.....de/+CSCOE+/saml/sp/login?tgname=DefaultWEBVPNGroup&acsamlcap=v2', login_final_url='https://vpn.....de/+CSCOE+/saml_ac_login.html', token_cookie_name='acSamlv2Token', opaque=<Element opaque at 0x7f594cae2c40>)

As no configuration file is created (I presume only after the first successful login), I don't know where to modify settings or explore configuration options. Any ideas what I could try next? Thanks in advance!

vlaci · 2020-12-08T20:10:35Z

The default rules are the following (in ~/.config/openconnect-sso/config.toml`):

[auto_fill_rules]
[[auto_fill_rules."https://*"]]
selector = "div[id=passwordError]"
action = "stop"

[[auto_fill_rules."https://*"]]
selector = "input[type=email]"
fill = "username"

[[auto_fill_rules."https://*"]]
selector = "input[type=password]"
fill = "password"

[[auto_fill_rules."https://*"]]
selector = "input[type=submit]"
action = "click"

There was a request to make this autofill stuff configurable and I'd like to make it so. If you find an addition that would fix your case I am happy to update the defaults.

philippgerard · 2020-12-21T17:45:56Z

Using

[[auto_fill_rules."https://*"]]
selector = "input[type=submit]"
action = "stop"

allows me to complete to click, but the process dies anyways :(

[error ] Could not finish authentication. Invalid response type in current state [openconnect_sso.authenticator] response=AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Single sign-on AnyConnect token verification failure.', login_url='https://vpn...de/+CSCOE+/saml/sp/login?tgname=DefaultWEBVPNGroup&acsamlcap=v2', login_final_url='https://vpn...de/+CSCOE+/saml_ac_login.html', token_cookie_name='acSamlv2Token', opaque=<Element opaque at 0x7fa52667e380>)
Traceback (most recent call last):
File "/usr/bin/openconnect-sso", line 33, in
sys.exit(load_entry_point('openconnect-sso==0.6.0', 'console_scripts', 'openconnect-sso')())
File "/usr/lib/python3.9/site-packages/openconnect_sso/cli.py", line 169, in main
return app.run(args)
File "/usr/lib/python3.9/site-packages/openconnect_sso/app.py", line 34, in run
auth_response, selected_profile = asyncio.get_event_loop().run_until_complete(
File "/usr/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
return future.result()
File "/usr/lib/python3.9/site-packages/openconnect_sso/app.py", line 137, in _run
auth_response = await authenticate_to(
File "/usr/lib/python3.9/site-packages/openconnect_sso/authenticator.py", line 50, in authenticate
raise AuthenticationError(response)
openconnect_sso.authenticator.AuthenticationError: AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Single sign-on AnyConnect token verification failure.', login_url='https://vpn....de/+CSCOE+/saml/sp/login?tgname=DefaultWEBVPNGroup&acsamlcap=v2', login_final_url='https://vpn....de/+CSCOE+/saml_ac_login.html', token_cookie_name='acSamlv2Token', opaque=<Element opaque at 0x7fa52667e380>)

Can you make sense of the error message?

vlaci · 2020-12-21T19:50:00Z

The error message is that somehow your VPN server still returns an auth request response, instead of complting the authentication. At debug loglevel the response message is logged on screen. I am not sure if it contains any meaningful additional info.

TheSentry · 2021-01-05T17:05:04Z

Our company recently switched to Cisco AnyConnect with Microsoft 2FA and this here seems to be my best shot. However, I encounter almost the same problem, although the "Stay signed in" window appears for me and I can click it and confirm. But then the dialog closes and I get a very similar stacktrace:

[info ] Response received [openconnect_sso.authenticator] id=main message=Please complete the authentication process in the AnyConnect Login window. title=
[error ] Could not finish authentication. Invalid response type in current state [openconnect_sso.authenticator] response=AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Single sign-on AnyConnect token verification failure.', login_url='https://vpn.....de/+CSCOE+/saml/sp/login?tgname=DefaultWEBVPNGroup&acsamlcap=v2', login_final_url='https://vpn.....de/+CSCOE+/saml_ac_login.html', token_cookie_name='acSamlv2Token', opaque=<Element opaque at 0x7f67108415c0>)
Traceback (most recent call last):
File "/home/florian/.local/bin/openconnect-sso", line 8, in
sys.exit(main())
File "/home/florian/.local/pipx/venvs/openconnect-sso/lib/python3.8/site-packages/openconnect_sso/cli.py", line 169, in main
return app.run(args)
File "/home/florian/.local/pipx/venvs/openconnect-sso/lib/python3.8/site-packages/openconnect_sso/app.py", line 34, in run
auth_response, selected_profile = asyncio.get_event_loop().run_until_complete(
File "/usr/lib/python3.8/asyncio/base_events.py", line 616, in run_until_complete
return future.result()
File "/home/florian/.local/pipx/venvs/openconnect-sso/lib/python3.8/site-packages/openconnect_sso/app.py", line 137, in _run
auth_response = await authenticate_to(
File "/home/florian/.local/pipx/venvs/openconnect-sso/lib/python3.8/site-packages/openconnect_sso/authenticator.py", line 50, in authenticate
raise AuthenticationError(response)
openconnect_sso.authenticator.AuthenticationError: AuthRequestResponse(auth_id='main', auth_title='', auth_message='Please complete the authentication process in the AnyConnect Login window.', auth_error='Single sign-on AnyConnect token verification failure.', login_url='https://vpn.....de/+CSCOE+/saml/sp/login?tgname=DefaultWEBVPNGroup&acsamlcap=v2', login_final_url='https://vpn.....de/+CSCOE+/saml_ac_login.html', token_cookie_name='acSamlv2Token', opaque=<Element opaque at 0x7f67108415c0>)

Is there anything I can provide to help solve this?

Edit: I forgot: At this point I'm usually prompted to authenticate myself using the Microsoft Authenticator App on my phone, so this might be the last AuthRequestResponse

vlaci · 2021-01-05T17:29:38Z

It would be great to know what anyconnect does differently in your case. A mitmproxy log of a successful login with anyconnect would be most helpful.

Make sure to remove all sensitive information (keys, mac addresses, urls) from the mitmproxy trace before sharing with anyone.

TheSentry · 2021-01-07T10:53:37Z

I'm having a hard time getting openconnect-sso to work with mitmproxy. Either it complains about

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1123)

or

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)

but I've never used mitmproxy before, so I probably didn't set up the certificates correctly and this here is probably not the right place to discuss this.

Maybe I'll try to modify openconnect-sso directly to make it work, but my availably time for this is limited, unfortunately

TheSentry · 2021-01-07T11:08:08Z

Funny, trying it again now gave me a different result:

[info     ] Response received              [openconnect_sso.authenticator] id=success message=
[sudo] password for user:           
Connected to x.y.z.a:443
SSL negotiation with vpn.....de
Server certificate verify failed: signer not found
Server SSL certificate didn't match: pin-sha256:<redacted>=
SSL connection failure: Error in the certificate.
Creating SSL connection failed

The next attempt had the same result as in my first comment.
(I guess the MS Authenticator is not always required and this changes the outcome)

vlaci · 2021-01-07T16:19:45Z

It is indeed funny as the last connection attempt shows a succesfull authentication.

At debug log level openconnect-sso logs all request-responses. Mitmproxy would help to capture Anyconnect's traffic to figure out how it behaves differently.

Mitmproxy has guidance on how to set-up your machine to trust its certificates https://docs.mitmproxy.org/stable/concepts-certificates/#installing-the-mitmproxy-ca-certificate-manually

TheSentry · 2021-01-08T09:01:59Z

Mitmproxy has guidance on how to set-up your machine to trust its certificates https://docs.mitmproxy.org/stable/concepts-certificates/#installing-the-mitmproxy-ca-certificate-manually

I actually followed that instructions and I still get the SSL errors I described above.

Unfortunately, I don't have any more (work) time available to delve into this problem, so I'm afraid I'm going to have to leave it at that. But if it helps you, this is what I see as a user during a successful VPN login:

Browser window: Prompt to enter my username
Browser window: Login page of my employer with username and password prompt
Sometimes: Browser window: Prompt to verify my login using the MS Authenticator App, together with a "Stay signed in" checkbox
Browser window: Another prompt "Stay signed in" with a checkbox "Don't ask me again"
Dialog window of AnyConnect: "Welcome to blabla Company, by connecting you accept the terms and services" with the options "Cancel" and "Connect"

Step 1, 2 and 4 work with openconnect-sso and I'm very certain that 3 and 5 are the problematic ones.

Maybe I'll find some spare time to look at it again, but no promises.

vlaci · 2021-02-04T10:49:05Z

Could you check if the issue persist with the newest 0.6.1. I hope, that #37 may have fixed this issue.

myelsukov · 2021-02-20T20:08:10Z

I am experiencing the same problem. #37 didn't help.

vlaci · 2021-03-01T21:34:40Z

FYI as of 0.7.0, the browser properly caches cookies between connection attempts so that it is possible to reuse a previous successful authentication.

DeepestToaster · 2021-10-11T21:43:18Z

While caching cookies may, in theory, work in some instances. I can confirm this doesn't work for me. I have authenticated previously with all browsers on my system yet when I try to connect I still get prompted for credentials cannot click the "remember" button fast enough and then everything falls apart on the "stay signed in" screen.

vlaci · 2021-10-19T16:14:52Z

Yeah, I still see that cookie saving is racy somehow. It may work for someone and won't for others. :(

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Azure AD SSO asking me to "stay signed in" breaks flow #36

Azure AD SSO asking me to "stay signed in" breaks flow #36

philippgerard commented Dec 8, 2020

vlaci commented Dec 8, 2020

philippgerard commented Dec 21, 2020

vlaci commented Dec 21, 2020 •

edited

Loading

TheSentry commented Jan 5, 2021 •

edited

Loading

vlaci commented Jan 5, 2021

TheSentry commented Jan 7, 2021

TheSentry commented Jan 7, 2021

vlaci commented Jan 7, 2021

TheSentry commented Jan 8, 2021

vlaci commented Feb 4, 2021

myelsukov commented Feb 20, 2021

vlaci commented Mar 1, 2021

DeepestToaster commented Oct 11, 2021

vlaci commented Oct 19, 2021

Azure AD SSO asking me to "stay signed in" breaks flow #36

Azure AD SSO asking me to "stay signed in" breaks flow #36

Comments

philippgerard commented Dec 8, 2020

vlaci commented Dec 8, 2020

philippgerard commented Dec 21, 2020

vlaci commented Dec 21, 2020 • edited Loading

TheSentry commented Jan 5, 2021 • edited Loading

vlaci commented Jan 5, 2021

TheSentry commented Jan 7, 2021

TheSentry commented Jan 7, 2021

vlaci commented Jan 7, 2021

TheSentry commented Jan 8, 2021

vlaci commented Feb 4, 2021

myelsukov commented Feb 20, 2021

vlaci commented Mar 1, 2021

DeepestToaster commented Oct 11, 2021

vlaci commented Oct 19, 2021

vlaci commented Dec 21, 2020 •

edited

Loading

TheSentry commented Jan 5, 2021 •

edited

Loading