OpenVPN / openvpn3-indicator

Simple GTK indicator GUI for OpenVPN 3 Linux
https://github.com/OpenVPN/openvpn3-indicator
GNU Affero General Public License v3.0
24 stars 2 forks source link

openvpn-3-indicator not working with AutoLogin Profiles (Certificate Authentication) #3

Closed bgironx15 closed 3 months ago

bgironx15 commented 4 months ago

First of all, good job with this project, very helpful to manage VPN Connections via Dekstop GUI

I was testing this tool in my Ubuntu Desktop Environment installed on HyperV and there are the results:

I tested using OpenVPN Access Server I tested with 2 different Client Profiles: User-Locked Profiles and AutoLogin Profiles

User-Locked Profiles = Requires to input Password only and in some scenarios to input both Username + Password AutoLogin Profiles = These profiles don't require inputting any credentials but use the User Certificate attached to the Profile to authenticate with the VPN Server and connect to the VPN

However, I tested with AutoLogin Profiles (Certificate-based Authentication), and didn't work

I checked the OpenVPN3 Logs while attempting the VPN Connection via "openvpn-3-indicator" and nothing happened in the logs (So, it's like the "openvpn-3-indicator" doesn't trigger the VPN Connection attempt to the OpenVPN3)

I tested the same without the "openvpn-3-indicator" and directly via OpenVPN3 CLI (Command Line) and worked just fine

Not sure if the "openvpn-3-indicator" is only working with Username + Password Authentication for now, or if this is a bug or something that will be added in the feature

Having Certificate-based Authentication is really good, especially for those cases where users/customers like to have Unattentended Machines so Certificate-based Authentication is required

Thanks again

dsommers commented 4 months ago

It seems like the session isn't started when credentials are not needed. Running openvpn3 sessions-list lists the session in a "config ok" state, which is the pre-connect state. That means the Ready() call passes but the UserInputQueue*() calls returns nothing.

Whenever Ready() returns successfully, the session is ready for the Connect() call.