Skip to content
Snippets Groups Projects
New look: Off

CAS is not supported by the client. Minimum client version is 6.0

    • Open Issue created by Thomas Menard @menardorama

    Hi,

    I am trying to configure openconnect to work with GlobalProtect (SAML Auth).

    I am facing this error CAS is not supported by the client. Minimum client version is 6.0

    I am running debian 12 and openconnect is in 9.01-3.

    It seems that minimum client version block ...

    I don't know how to fix this.

    Is somebody have any idea ?

    Thanks

    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items ...

    • Activity

    • Dimitri Papadopoulos Orfanos added protocolGlobalProtect label

      added protocolGlobalProtect label

    • Dimitri Papadopoulos Orfanos
      Dimitri Papadopoulos Orfanos @DimitriPapadopoulos ·
      Developer

      I have no reason to believe it will help, but it would be great if you could try latest version 9.12.

      Also not sure what "CAS" is. Any clue? Client Access Server?

      Edited by Dimitri Papadopoulos Orfanos
    • Dimitri Papadopoulos Orfanos added External Auth/SAML/SSO label

      added External Auth/SAML/SSO label

    • Dimitri Papadopoulos Orfanos added Needs info label

      added Needs info label

    • Thomas Menard
      Thomas Menard @menardorama ·
      Author

      Hi,

      Here is the debug ouput of openconnect

      
POST https://gp.example.com/global-protect/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Linux
Attempting to connect to server 192.168.1.1:443
Connected to 192.168.1.1:443
Négociation SSL avec gp.example.com
Connected to HTTPS on gp.example.com with ciphersuite (TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA256)-(AES-256-GCM)
> POST /global-protect/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Linux HTTP/1.1
> Host: gp.example.com
> User-Agent: PAN GlobalProtect
> 
Got HTTP response: HTTP/1.1 200 OK
Date: Fri, 08 Sep 2023 05:53:53 GMT
Content-Type: application/xml; charset=UTF-8
Content-Length: 538
Connection: keep-alive
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: SESSID=3cda0a56-498b-4b26-8034-7c4a8827e6d6; Path=/; HttpOnly; Secure
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000;
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; img-src * data:; style-src 'self' 'unsafe-inline';
HTTP body length:  (538)
< <?xml version="1.0" encoding="UTF-8" ?>
< <prelogin-response>
< <status>Error</status>
< <ccusername></ccusername>
< <autosubmit>false</autosubmit>
< <msg>CAS is not supported by the client. Minimum client version is 6.0</msg>
< <newmsg></newmsg>
< <authentication-message>Enter login credentials</authentication-message>
< <username-label>Username</username-label>
< <password-label>Password</password-label>
< <panos-version>1</panos-version>
< <saml-default-browser>yes</saml-default-browser>
< 
< <auth-api>no</auth-api><region>FR</region>
< </prelogin-response>
CAS is not supported by the client. Minimum client version is 6.0
Failed to complete authentication

      Now looking using gp-saml-gui

      • Thomas Menard
        Thomas Menard @menardorama ·
        Author

        I see in the code that clientVer is hardcoded to version 4100, it does not seem to be configurable ?

      • Daniel Lenski
        Daniel Lenski @dlenski ·
        Maintainer

        Do not change that value. It appears to be "fossilized"; it is the same for all client software versions.

        The value that you probably want to change is this one…

        index 37235c1f..ddaef6c4 100644
--- a/gpst.c
+++ b/gpst.c
@@ -644,7 +644,7 @@ static int gpst_get_config(struct openconnect_info *vpninfo)
 
        /* submit getconfig request */
        buf_append(request_body, "client-type=1&protocol-version=p1&internal=no");
-       append_opt(request_body, "app-version", vpninfo->csd_ticket ? : "5.1.5-8");
+       append_opt(request_body, "app-version", vpninfo->csd_ticket ? : "6.1.2-82");
        append_opt(request_body, "ipv6-support", vpninfo->disable_ipv6 ? "no" : "yes");
        append_opt(request_body, "clientos", gpst_os_name(vpninfo));
        append_opt(request_body, "os-version", vpninfo->platname);

        However, the surprising thing about your server is that it seems to want to know the client software version earlier in the authentication flow. It wants to know the client software version as part of the /global-protect/prelogin.esp request. Proprietary clients which I've MITM'ed don't send this: https://github.com/dlenski/openconnect/blob/master/PAN_GlobalProtect_protocol_doc.md#pre-login-request

        Edited by Daniel Lenski
      • Please register or sign in to reply
      • Thomas Menard
        Thomas Menard @menardorama ·
        Author

        Tried to bump the version number to 6000 and recompile without success.

        I've configure the GlobalProtect client in dump mode and see this request:

        Command = 
<request>
    <type>portal</type>
    <portal>vpn.example.com</portal>
    <pid>2343</pid>
    <user>myuser@example.com</user>
    <passwd>*</passwd>
    <path>/home/myuser/.GlobalProtect</path>
    <checkupdate>no</checkupdate>
    <allow-cached-portal>yes</allow-cached-portal>
    <remember-me>yes</remember-me>
    <retrieve-cache-only>no</retrieve-cache-only>
    <manual-select-gateway-ip></manual-select-gateway-ip>
    <portal-certificate-verification>yes</portal-certificate-verification>
    <win-user>myuser</win-user>
    <user-profile-type>0</user-profile-type>
    <preferred-gateway></preferred-gateway>
    <preferred-gateway-address></preferred-gateway-address>
    <saved-user>myuser@example.com</saved-user>
    <saved-passwd></saved-passwd>
    <portal-2fa>no</portal-2fa>
    <token>--redacted token--</token>
    <cas-username>myuser@example.com</cas-username>
    <cas-auth-status>1</cas-auth-status>
    <saml-auth-error></saml-auth-error>
    <use-ssl-tunnel>no</use-ssl-tunnel>
    <gid>1000</gid>
    <uid>1000</uid>
    <domain></domain>
    <default-browser>4</default-browser>
</request>

        Reply

        <?xml version="1.0" encoding="UTF-8"?>
<response>
	<type>status</type>
	<status>Disconnected</status>
	<protocol/>
	<portal-config-version>0</portal-config-version>
	<error-must-show/>
	<error-must-show-level>error</error-must-show-level>
	<error/>
	<product-version>6.1.2-82</product-version>
	<product-code/>
	<portal-status>User authentication failed</portal-status>
	<user-name>myuser@example.com</user-name>
	<username-type>cas</username-type>
	<state>Retrieving configuration...</state>
	<check-version>no</check-version>
	<portal>myuser@example.com</portal>
	<discover-ready>no</discover-ready>
	<mdm-is-enabled>no</mdm-is-enabled>
	<gateway-list>gateway-list</gateway-list>
	<mobile-network-type>0</mobile-network-type>
	<cdl-log>no</cdl-log>
</response>

        I hope it helps....

        Edited by Thomas Menard
      • Dimitri Papadopoulos Orfanos
        Dimitri Papadopoulos Orfanos @DimitriPapadopoulos ·
        Developer

        It might be time to bump the emulated version number from 5.1.5-8 to something more recent, such as 6.1.2-82. Does it get you further, that is, is the error message different?

        I've configure the GlobalProtect client in dump mode and see this request:

        Do you mean the proprietary GlobalProtect client?

      • Daniel Lenski
        Daniel Lenski @dlenski ·
        Maintainer

        It might be time to bump the emulated version number from 5.1.5-8 to something more recent, such as 6.1.2-82. Does it get you further, that is, is the error message different?

        As of !333 (merged), we will simply parrot back whatever software version number the portal thinks is the latest and greatest. :grimacing:

        … but yes, we probably should also bump the fallback version number that we use in case of a direct connection to the gateway, in which case OpenConnect won't learn the version number to parrot. 🦜

        Edited by Daniel Lenski
      • Federico
        Federico @nemobis ·

        Can I test this theory by running tests/fake-gp-server.py with a different default (e.g. from master), or is it more complicated than that?

        Edited by Federico
      • Daniel Lenski
        Daniel Lenski @dlenski ·
        Maintainer

        Can I test this theory by running tests/fake-gp-server.py with a different default (e.g. from master)

        I don't understand what you're proposing here.

        The fake GP server does not care what emulated version number you send to it. You can send it Help.I.Am.Trapped.In.A.VPN.Factory as your app-version, and it won't care.

        You need to modify the client and test it with your real server. Quite likely the change you need is b22782f5 in, also described above in #651 (comment 1573448681).

      • Please register or sign in to reply
    • Dimitri Papadopoulos Orfanos mentioned in merge request !493 (merged)

      mentioned in merge request !493 (merged)

    • Daniel Lenski mentioned in commit 0727a48c

      mentioned in commit 0727a48c

    • Daniel Lenski mentioned in commit e5592b05

      mentioned in commit e5592b05

    • Daniel Lenski mentioned in commit 8f6186f1

      mentioned in commit 8f6186f1

    • Daniel Lenski mentioned in commit 50428ca0

      mentioned in commit 50428ca0

    • Daniel Lenski removed Needs info label

      removed Needs info label

    • Daniel Lenski mentioned in merge request !497 (merged)

      mentioned in merge request !497 (merged)

    • Jan-Michael Brummer mentioned in commit jbrummer_vw/openconnect@585ee9d0

      mentioned in commit jbrummer_vw/openconnect@585ee9d0

    • Jan-Michael Brummer mentioned in merge request !503 (closed)

      mentioned in merge request !503 (closed)

    • Loading
    • Loading
    • Loading
    • Loading
    • Loading
    • Loading
    • Loading
    • Loading
    • Loading
    • Loading
    Please register or sign in to reply