feat: support default browser for CLI (#345)

apps/gpauth/Cargo.toml

@@ -22,3 +22,4 @@ html-escape = "0.2.13"
 webkit2gtk = "0.18.2"
 tauri = { workspace = true, features = ["http-all"] }
 compile-time.workspace = true
+open.workspace = true

apps/gpauth/src/browser_authenticator.rs

@@ -0,0 +1,34 @@
+use std::{env::temp_dir, io::Write};
+
+pub struct BrowserAuthenticator<'a> {
+  auth_request: &'a str,
+}
+
+impl BrowserAuthenticator<'_> {
+  pub fn new(auth_request: &str) -> BrowserAuthenticator {
+    BrowserAuthenticator { auth_request }
+  }
+
+  pub fn authenticate(&self) -> anyhow::Result<()> {
+    if self.auth_request.starts_with("http") {
+      open::that_detached(self.auth_request)?;
+    } else {
+      let html_file = temp_dir().join("gpauth.html");
+      let mut file = std::fs::File::create(&html_file)?;
+
+      file.write_all(self.auth_request.as_bytes())?;
+
+      open::that_detached(html_file)?;
+    }
+
+    Ok(())
+  }
+}
+
+impl Drop for BrowserAuthenticator<'_> {
+  fn drop(&mut self) {
+    // Cleanup the temporary file
+    let html_file = temp_dir().join("gpauth.html");
+    let _ = std::fs::remove_file(html_file);
+  }
+}

apps/gpauth/src/cli.rs

@@ -11,7 +11,10 @@ use serde_json::json;
 use tauri::{App, AppHandle, RunEvent};
 use tempfile::NamedTempFile;
 
-use crate::auth_window::{portal_prelogin, AuthWindow};
+use crate::{
+  auth_window::{portal_prelogin, AuthWindow},
+  browser_authenticator::BrowserAuthenticator,
+};
 
 const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), " (", compile_time::date_str!(), ")");
 
@@ -37,6 +40,8 @@ struct Cli {
   ignore_tls_errors: bool,
   #[arg(long)]
   clean: bool,
+  #[arg(long)]
+  default_browser: bool,
 }
 
 impl Cli {
@@ -56,6 +61,15 @@ impl Cli {
       None => portal_prelogin(&self.server, &gp_params).await?,
     };
 
+    if self.default_browser {
+      let browser_auth = BrowserAuthenticator::new(&saml_request);
+      browser_auth.authenticate()?;
+
+      info!("Please continue the authentication process in the default browser");
+
+      return Ok(());
+    }
+
     self.saml_request.replace(saml_request);
 
     let app = create_app(self.clone())?;

apps/gpauth/src/main.rs

@@ -1,6 +1,7 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
 mod auth_window;
+mod browser_authenticator;
 mod cli;
 
 #[tokio::main]

apps/gpclient/src/connect.rs

@@ -19,8 +19,9 @@ use gpapi::{
 use inquire::{Password, PasswordDisplayMode, Select, Text};
 use log::info;
 use openconnect::Vpn;
+use tokio::{io::AsyncReadExt, net::TcpListener};
 
-use crate::{cli::SharedArgs, GP_CLIENT_LOCK_FILE};
+use crate::{cli::SharedArgs, GP_CLIENT_LOCK_FILE, GP_CLIENT_PORT_FILE};
 
 #[derive(Args)]
 pub(crate) struct ConnectArgs {
@@ -60,6 +61,8 @@ pub(crate) struct ConnectArgs {
   hidpi: bool,
   #[arg(long, help = "Do not reuse the remembered authentication cookie")]
   clean: bool,
+  #[arg(long, help = "Use the default browser to authenticate")]
+  default_browser: bool,
 }
 
 impl ConnectArgs {
@@ -240,7 +243,9 @@ impl<'a> ConnectHandler<'a> {
 
     match prelogin {
       Prelogin::Saml(prelogin) => {
-        SamlAuthLauncher::new(&self.args.server)
+        let use_default_browser = prelogin.support_default_browser() && self.args.default_browser;
+
+        let cred = SamlAuthLauncher::new(&self.args.server)
           .gateway(is_gateway)
           .saml_request(prelogin.saml_request())
           .user_agent(&self.args.user_agent)
@@ -250,8 +255,21 @@ impl<'a> ConnectHandler<'a> {
           .fix_openssl(self.shared_args.fix_openssl)
           .ignore_tls_errors(self.shared_args.ignore_tls_errors)
           .clean(self.args.clean)
+          .default_browser(use_default_browser)
           .launch()
-          .await
+          .await?;
+
+        if let Some(cred) = cred {
+          return Ok(cred);
+        }
+
+        if !use_default_browser {
+          // This should never happen
+          unreachable!("SAML authentication failed without using the default browser");
+        }
+
+        info!("Waiting for the browser authentication to complete...");
+        wait_credentials().await
       }
       Prelogin::Standard(prelogin) => {
         let prefix = if is_gateway { "Gateway" } else { "Portal" };
@@ -274,6 +292,27 @@ impl<'a> ConnectHandler<'a> {
   }
 }
 
+async fn wait_credentials() -> anyhow::Result<Credential> {
+  // Start a local server to receive the browser authentication data
+  let listener = TcpListener::bind("127.0.0.1:0").await?;
+  let port = listener.local_addr()?.port();
+
+  // Write the port to a file
+  fs::write(GP_CLIENT_PORT_FILE, port.to_string())?;
+
+  info!("Listening authentication data on port {}", port);
+  let (mut socket, _) = listener.accept().await?;
+
+  info!("Received the browser authentication data from the socket");
+  let mut data = String::new();
+  socket.read_to_string(&mut data).await?;
+
+  // Remove the port file
+  fs::remove_file(GP_CLIENT_PORT_FILE)?;
+
+  Credential::from_gpcallback(&data)
+}
+
 fn write_pid_file() {
   let pid = std::process::id();
 

apps/gpclient/src/launch_gui.rs

@@ -7,6 +7,9 @@ use gpapi::{
   utils::{endpoint::http_endpoint, env_file, shutdown_signal},
 };
 use log::info;
+use tokio::io::AsyncWriteExt;
+
+use crate::GP_CLIENT_PORT_FILE;
 
 #[derive(Args)]
 pub(crate) struct LaunchGuiArgs {
@@ -78,6 +81,11 @@ impl<'a> LaunchGuiHandler<'a> {
 }
 
 async fn feed_auth_data(auth_data: &str) -> anyhow::Result<()> {
+  let _ = tokio::join!(feed_auth_data_gui(auth_data), feed_auth_data_cli(auth_data));
+  Ok(())
+}
+
+async fn feed_auth_data_gui(auth_data: &str) -> anyhow::Result<()> {
   let service_endpoint = http_endpoint().await?;
 
   reqwest::Client::default()
@@ -90,6 +98,15 @@ async fn feed_auth_data(auth_data: &str) -> anyhow::Result<()> {
   Ok(())
 }
 
+async fn feed_auth_data_cli(auth_data: &str) -> anyhow::Result<()> {
+  let port = tokio::fs::read_to_string(GP_CLIENT_PORT_FILE).await?;
+  let mut stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", port.trim())).await?;
+
+  stream.write_all(auth_data.as_bytes()).await?;
+
+  Ok(())
+}
+
 async fn try_active_gui() -> anyhow::Result<()> {
   let service_endpoint = http_endpoint().await?;
 

apps/gpclient/src/main.rs

@@ -4,6 +4,7 @@ mod disconnect;
 mod launch_gui;
 
 pub(crate) const GP_CLIENT_LOCK_FILE: &str = "/var/run/gpclient.lock";
+pub(crate) const GP_CLIENT_PORT_FILE: &str = "/var/run/gpclient.port";
 
 #[tokio::main]
 async fn main() {