Feature Request: Pass Client ID and Key ID

[jkroepke]

Hi,

I'm currently looking for possibilities in my OpenVPN auth plugin (https://github.com/jkroepke/openvpn-auth-oauth2) to replace the management interface with the plugin API.

I'm wondering why Client ID and Key ID is not passed and I would like to asked, if they can added as ENV as well.

[cron2]

I would guess "because nobody needed it yet" - for the use cases I had so far I didn't need them, and in general not that many people seem to use the plugin API.

Not sure how complicated this is to add on the OpenVPN side - it's been a while since I looked at those code paths (mostly when reviewing and testing the deferred client-connect implementation in 2.5). @schwabe might have ideas and opinions.

[schwabe]

client id and key id are also basically only used in the management interface to identify the connection. For the plugin/script interface there is no need to identify the client this way since the plugin/script is called exactly for a single authentication and expects the return for that. The client ID does not even exist in the code without management support enabled.

So you need to explain a bit more detailed why you think you need the client id in the plugin interface

[jkroepke]

since the plugin/script is called exactly for a single authentication and expects the return for that.

If users are initially authenticated, I want to store a cookie on the server. The value of this cookie is larger than the allowed auth-token size.

During re-authentication (soft reset), I plan to use the stored cookie to perform re-authentication against an external system.

I believe binding the cookie to the ClientID is the best approach OpenVPN offers in this context. It ensures the cookie cannot be leaked to other connections.

The overall use case here is that the auth_oauth2 plugin is currently implemented as an OpenVPN Management Interface solution, even though it does not provide actual management functionality. Since OpenVPN supports only one Management Interface client at a time, I would like to re-implement jkroepke/openvpn-auth-oauth2 as a proper OpenVPN plugin, if possible.

[jkroepke]

close by mis-click.