OpenVPN: allow storing authentication user name in configuration about openvpn HOT 8 CLOSED

@selvanair: thanks for your detailed explanation. I got it working now with "client-pending-auth" and a cr_text challenge and can confirm that it is working as expected without username and password.

from openvpn.

from openvpn.

That is fantastic news. Thank you! What about (2)?

from openvpn.

from openvpn.

No worries and thanks for your effort.

That would also work for our case, however we don't want to have the need to enter the username but have it derived from the certificate as is the default behavior.

from openvpn.

Static challenge is intimately coupled with auth-user-pass and cannot be used without it. Also embedding username/password with static-challenge enabled will work only for users who run from command line (and possibly via systemd). When using a UI that talks to the management interface (like Windows OpenVPN-GUI), the challenge will not get queried if user/pass are embedded or read from a file.

For your use case, it may be better to send a CR_TEXT challenge form the server using client-pending-auth via management interface. For details see: https://github.com/OpenVPN/openvpn/blob/master/doc/management-notes.txt It will require some re-thinking of how server-side verification is implemented.

from openvpn.

Yes. As @selvanair explains it is very unlikely that we improve the old 2FA methods since we now have the much more flexible pending auth/crtext method.

from openvpn.

Closing the issue since the features are already implemented.

from openvpn.