Python module does not properly handle MFA/OTP authentication

[webbrandon]

Python module does not properly handle MFA/OTP authentication

[dsommers]

To be honest, I'm puzzled by your approach ... I would rather recommend you modify or write your own openvpn3-autoload variant solving your issue more directly than wrapping a Python script from a bash script.

I would suggest adding your MFA injection somewhere close to this line:

openvpn3-linux/src/python/openvpn3-autoload

Line 275 in 1888b97

varn = ui.GetVariableName()

You can also have a look at the src/tests/python/start-tunnel2.py test code which covers how to start a pre-imported (via openvpn3 config-import) configuration profile. Configuration file import can also be done in Python, see the src/tests/python/configimport.py for details. Adding a configuration/option parser (which is used by the openvpn3-autoload and openvpn2 scripts) is demoed here in src/tests/python/genconfig.py.

[dsommers]

Oh, and I forgot ... there's a very slimmed down openvpn2 example in src/tests/python/ovpncli.py

[webbrandon]

This can be done many ways it seems. I am looking to share this and be configured with minimal effort so python script may be more helpful in achieving that.

I created python script to do this using the src/tests/python/genconfig.py example, I still am seeing errors when I call its equivalent --static-challenge. I did notice it embedded my auth-user-pass as XML like syntax in the config which resulted in a more descriptive error which makes me think it needs more time before opening connection. I guess with a little bit of unwanted effort I can make some modifications with a python script to process just the MFA question, just need to figure that out in code I guess.

session-start: ** ERROR ** Failed to start new session: Failed calling D-Bus method Ready: GDBus.Error:net.openvpn.v3.sessions.error: Backend VPN process have died. Session is no longer valid.

[dsommers]

I've been doing some more investigation, and it looks like there is a regression in the Python module which does not properly handle MFA authentication

[dsommers]

This should work now with the openvpn2 implementation in the v16_beta release (with commit 2aa087c).

The openvpn3-autoload approach is questionable in regards to 2FA, and this utility is going to be deprecated in future releases as we have added a better way for handling this with systemctl {start,stop,status} [email protected].

Static and dynamic challenges in openvpn3-autoload will not have a high priority going forward.

Closing this issue as fixed.