Automate Cisco AnyConnect VPN client with 2-factor auth on OSX

cisco.osascript

-- Usage: <script> gatewayHostName username password
-- based on https://gist.github.com/andrewh/7135352 and https://github.com/seanfisk/juniper-network-connect-vpn-applescript/blob/master/juniper.applescript

on run argv
	if (count of argv) is not equal to 3 then
		return "Usage: <script> gatewayHostName username password"
	else

		set {gatewayHostName, username, pw} to argv
		
		tell application "Cisco AnyConnect Secure Mobility Client"
			activate
		end tell
		repeat until application "Cisco AnyConnect Secure Mobility Client" is running
			delay 1
		end repeat
		tell application "System Events"
			repeat until (window 1 of process "Cisco AnyConnect Secure Mobility Client" exists)
				delay 1
			end repeat
			tell process "Cisco AnyConnect Secure Mobility Client"
				keystroke (gatewayHostName as string)
				keystroke return
			end tell
			repeat until (window 2 of process "Cisco AnyConnect Secure Mobility Client" exists)
				delay 1
			end repeat
			tell process "Cisco AnyConnect Secure Mobility Client"
				keystroke tab using {shift down}
				keystroke (username as string)
				keystroke tab
				keystroke (pw as string)
				-- the following pertains only to 2-factor auth
				keystroke tab
				keystroke ("push" as string)
				-- end 2-factor
				keystroke return
			end tell
		end tell

	end if
end run

vpn.sh

#!/bin/bash
# collect credentials from lastpass, run the VPN client, issue a Duo push request
# requires Cisco AnyConnect Secure Mobility Client and LastPass CLI

host=vpn.example.com

username=$( lpass show --name "$host" --username )
pw=$( lpass show --name "$host" --password )

osascript cisco.osascript "$host" "$username" "$pw"