Use stored 1Password credentials to authenticate a Cisco AnyConnect VPN client

1password-vpn-login.sh

#!/usr/bin/env bash

# Prerequisites
#
# Download the 1Password CLI tool
#
#   brew cask install 1password-cli
# 
# Before using this script, you'll need to authenticate the 1Password
# CLI for the first time. Use the following command, replacing
# the domain and email address with your details in the below command.
#
#   op signin example.1password.com [email protected]
#
# See: https://support.1password.com/command-line-getting-started/
#
# Commands
#
#   vpn.sh connect <optional endpoint>
#
#   vpn.sh state
#
#   vpn.sh disconnect

# endpoint for the Cisco AnyConnect VPN if not specified
DEFAULT_ENDPOINT="example.endpoint.com"

# your 1Password domain
OP_DOMAIN="example"
# name or UUID of the entry holding your VPN credentials
OP_ENTRY_IDENTIFIER="example name"

if [[ "$1" = "connect" ]]
then
    # authenticate with 1Password (must be done every 30 minutes)
    eval $(op signin $OP_DOMAIN)

    # grab credentials
    USERNAME=$(op get item $OP_ENTRY_IDENTIFIER | jq --raw-output '.details.fields[] | select(.designation=="username").value')
    PASSWORD=$(op get item $OP_ENTRY_IDENTIFIER | jq --raw-output '.details.fields[] | select(.designation=="password").value')

    # escaping the special chars in the password to allow sed-ing it
    ESC_PWD=$(echo $PASSWORD | sed -e 's/[]\/$*.^[]/\\&/g')

    VPN_ENDPOINT=${2:-$DEFAULT_ENDPOINT}

    echo "Connecting to $VPN_ENDPOINT as $USERNAME..."

    printf "${USERNAME}\n${PASSWORD}\ny" | /opt/cisco/anyconnect/bin/vpn -s connect $VPN_ENDPOINT | sed "s/$ESC_PWD/*****/"    
else
    # pass the command through to the Cisco VPN client
    /opt/cisco/anyconnect/bin/vpn $1
fi