Directly print the Auth URL for external authentication upon session-start #81

LukeLR commented 2025年11月04日 17:29:24 +01:00

At my university, authentication via a second factor is required to connect to the OpenVPN. Therefore, users need to complete external authentication in a web browser. Usually, the authentication URL will be automatically opened in a web browser when starting a new session. However, users cannot easily restart the external authentication when opening the web browser fails or the authentication process fails on first try. The authentication URL needs to be fetched via openvpn3 session-auth in order to open it manually in a web browser (a second time), and (inexperienced) users often don't know that they can fetch the URL and restart the authentication.

If the authentication URL would be directly displayed when executing the session-start URL, users would directly see it and could simply click it to retry the external authentication if it fails for whatever reason. I think, the URL would fit well in the output after awaiting external authentication, like this:

lukas@framework-rose:~$ openvpn3 session-start --config HHU-VPN-Intern
Using pre-loaded configuration profile 'HHU-VPN-Intern'
Session path: /net/openvpn/v3/sessions/fd341e1cseceas4bces8a77s2d9df2ca4fb8
Auth User name: luros101.intern
Auth Password: 
Web based authentication required.
Session running, awaiting external authentication at https://mfa.university.edu/webauth.php?code=<...>
Further manage this session using 'openvpn3 session-manage' and 'openvpn3 session-auth'

What do you think? Could this be a possible improvement to openvpn3?

At my university, authentication via a second factor is required to connect to the OpenVPN. Therefore, users need to complete external authentication in a web browser. Usually, the authentication URL will be automatically opened in a web browser when starting a new session. However, users cannot easily restart the external authentication when opening the web browser fails or the authentication process fails on first try. The authentication URL needs to be fetched via `openvpn3 session-auth` in order to open it manually in a web browser (a second time), and (inexperienced) users often don't know that they can fetch the URL and restart the authentication. If the authentication URL would be directly displayed when executing the `session-start` URL, users would directly see it and could simply click it to retry the external authentication if it fails for whatever reason. I think, the URL would fit well in the output after `awaiting external authentication`, like this: ``` lukas@framework-rose:~$ openvpn3 session-start --config HHU-VPN-Intern Using pre-loaded configuration profile 'HHU-VPN-Intern' Session path: /net/openvpn/v3/sessions/fd341e1cseceas4bces8a77s2d9df2ca4fb8 Auth User name: luros101.intern Auth Password: Web based authentication required. Session running, awaiting external authentication at https://mfa.university.edu/webauth.php?code=<...> Further manage this session using 'openvpn3 session-manage' and 'openvpn3 session-auth' ``` What do you think? Could this be a possible improvement to `openvpn3`?

dazo commented 2025年11月05日 14:14:28 +01:00

For inexperienced users, I would actually recommend the OpenVPN 3 Indicator project. That gives a GUI interface where you start/stop sessions - and it should also do the web-auth part as well.

I've also attached a simple mini-project which could be used as well. This runs a little background service watching VPN sessions and will also trigger the web-auth step as a desktop notification. I've intended to include this into an OpenVPN 3 Linux release, but it got less priority as the OpenVPN 3 Indicator project appeared around the same timeframe.

But I'll consider to show the URL regardless. The challenge here is that some authentication URLs are extremely long (close to 200 characters), and that again makes it less user-friendly.

For inexperienced users, I would actually recommend the [OpenVPN 3 Indicator](https://github.com/OpenVPN/openvpn3-indicator/) project. That gives a GUI interface where you start/stop sessions - and it should also do the web-auth part as well. I've also attached a simple mini-project which could be used as well. This runs a little background service watching VPN sessions and will also trigger the web-auth step as a desktop notification. I've intended to include this into an OpenVPN 3 Linux release, but it got less priority as the OpenVPN 3 Indicator project appeared around the same timeframe. But I'll consider to show the URL regardless. The challenge here is that some authentication URLs are extremely long (close to 200 characters), and that again makes it less user-friendly.

dazo commented 2026年01月27日 10:31:44 +01:00

The openvpn3-session-watcher will be included in the next release of OpenVPN 3 Linux, included via commit b876a5469a

The `openvpn3-session-watcher` will be included in the next release of OpenVPN 3 Linux, included via commit b876a5469a27f2365d3bc301e4bcbf2bbf11ef7d