[Openvpn-devel] [PATCH] Introduce webauth auth pending method and deprecate openurl

[Openvpn-devel] [PATCH] Introduce webauth auth pending method and deprecate openurl

[Arne Schwabe]

The experience with openurl/OPEN_URL has shown that just sending
a URL to a client is not enough and we often need different
behaviour of the client depending on circumstances. Replace
OPEN_URL with a more flexible WEBAUTH pending auth method.

Signed-off-by: Arne Schwabe <arne@...1227...>
---
 doc/management-notes.txt    | 41 ++++++++++++++++++++++++++-----------
 include/openvpn-plugin.h.in |  2 +-
 2 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/doc/management-notes.txt b/doc/management-notes.txt
index c20344298..4572d967f 100644
--- a/doc/management-notes.txt
+++ b/doc/management-notes.txt
@@ -645,11 +645,11 @@ Before issuing a client-pending-auth to a client instead of a
 client-auth/client-deny, the server should check the IV_SSO
 environment variable for whether the method is supported. Currently
 defined methods are crtext for challenge/response using text
-(e.g., TOTP), openurl and proxy_url for opening a URL in the client to
-continue authentication. A client supporting the first two methods would
-set
+(e.g., TOTP), openurl (deprecated) and webauth for opening a URL in
+the client to continue authentication. A client supporting the last
+two methods would set
 
-    setenv IV_SSO openurl,crtext
+    setenv IV_SSO webauth,crtext
 
 The variable name IV_SSO is historic as AUTH_PENDING was first used
 to signal single sign on support. To keep compatibility with existing
@@ -668,33 +668,50 @@ notification as
 where {EXTRA} is formatted as received from the server.
 Currently defined formats for {EXTRA} are detailed below.
 
-openurl
-========
+webauth and openurl
+===================
 For a web based extra authentication (like for
 SSO/SAML) {EXTRA} should be
 
     OPEN_URL:url
 
-and client should ask the user to open the URL to continue.
+or
+
+    WEBAUTH:flags:url
+
+The OPEN_URL method is deprecated as it does not allow to send flags which
+proved to be needed to signal certain behaviour to the client.
+
+The client should ask the user to open the URL to continue.
 
 The space in a control message is limited, so this url should be kept
 short to avoid issues. If a longer url is required a URL that redirects
-to the longer URL should be sent instead.
+to the longer URL should be sent instead. The total length is limited to 1024
+bytes which includes the INFO_PRE:WEBAUTH:flags.
+
+flags is a list of flags which are separated by commas. Currently defined
+flags are:
+
+- proxy     (see next pargraph)
+- hidden    start the webview in hidden mode (see openvpn3 webauth documentation)
+- external  Do not use an internal webview but use an external browser. Some
+            authentication providers refuse to work in an internal webview.
+
 
 A complete documentation how URLs should be handled on the client is available
 in the openvpn3 repository:
 
 https://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md
 
-proxy_url
-========
-This is a variant of openurl that allows opening a url via an
+webauth with proxy
+==================
+This is a variant of webauth that allows opening a url via an
 HTTP proxy. It could be used to avoid issues with OpenVPN connection's
 persist-tun that may cause the web server to be unreachable.
 The client should announce proxy_url in its IV_SSO and parse the
 PROXY_URL message. The format of {EXTRA} in this case is
 
-    PROXY_URL:<proxy>:<proxy_port>:<proxyuser_base64>:<proxy_password_base64>:url
+    WEBAUTH:proxy=<proxy>;<proxy_port>;<proxyuser_base64>;<proxy_password_base64>,flags:url
 
 The proxy should be a literal IPv4 address or IPv6 address enclosed in [] to avoid
 ambiguity in parsing. A literal IP address is preferred as DNS might not be
diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in
index 79969bf89..944294b22 100644
--- a/include/openvpn-plugin.h.in
+++ b/include/openvpn-plugin.h.in
@@ -578,7 +578,7 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_op
  * auth_pending_file is
  * line 1: timeout in seconds
  * line 2: Pending auth method the client needs to support (e.g. openurl)
- * line 3: EXTRA (e.g. OPEN_URL:http://www.example.com)
+ * line 3: EXTRA (e.g. WEBAUTH::http://www.example.com)
  *
  * In addition the OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER and
  * OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 are called when OpenVPN tries to
-- 
2.32.0

Re: [Openvpn-devel] [PATCH] Introduce webauth auth pending method and deprecate openurl

[Arne Schwabe]

Am 16.07.21 um 14:18 schrieb Arne Schwabe:
> The experience with openurl/OPEN_URL has shown that just sending
> a URL to a client is not enough and we often need different
> behaviour of the client depending on circumstances. Replace
> OPEN_URL with a more flexible WEBAUTH pending auth method.

Just as FYI this is more of an RFC to give other people an early
opportunity to object/remark or request changes to the protocol as we
are going to implement this very soon this way if no objections are raised.

Arne

Re: [Openvpn-devel] [PATCH] Introduce webauth auth pending method and deprecate openurl

[Selva Nair]

[-- Attachment #1: Type: text/plain, Size: 5324 bytes --]

Hi,

On Fri, Jul 16, 2021 at 8:19 AM Arne Schwabe <arne@...1227...> wrote:

> The experience with openurl/OPEN_URL has shown that just sending
> a URL to a client is not enough and we often need different
> behaviour of the client depending on circumstances. Replace
> OPEN_URL with a more flexible WEBAUTH pending auth method.
>

As the two other methods are signalled as OPEN_URL and CR_TEXT, please
consider using WEB_AUTH.  The corresponding IV_SSO value can still be named
"webauth" as you have below, consistent with crtext and openurl.

I know it's just a keyword, but consistency makes it easier to write
consuming code without repeatedly referring to the docs.


> Signed-off-by: Arne Schwabe <arne@...1227...>
> ---
>  doc/management-notes.txt    | 41 ++++++++++++++++++++++++++-----------
>  include/openvpn-plugin.h.in |  2 +-
>  2 files changed, 30 insertions(+), 13 deletions(-)
>
> diff --git a/doc/management-notes.txt b/doc/management-notes.txt
> index c20344298..4572d967f 100644
> --- a/doc/management-notes.txt
> +++ b/doc/management-notes.txt
> @@ -645,11 +645,11 @@ Before issuing a client-pending-auth to a client
> instead of a
>  client-auth/client-deny, the server should check the IV_SSO
>  environment variable for whether the method is supported. Currently
>  defined methods are crtext for challenge/response using text
> -(e.g., TOTP), openurl and proxy_url for opening a URL in the client to
> -continue authentication. A client supporting the first two methods would
> -set
> +(e.g., TOTP), openurl (deprecated) and webauth for opening a URL in
>

As we have not released any versions with openurl, why not just replace it
webauth? Anyway, below you are replacing proxy_url to use WEB_AUTH instead
of PROXY_URL.


> +the client to continue authentication. A client supporting the last
> +two methods would set


> -    setenv IV_SSO openurl,crtext
> +    setenv IV_SSO webauth,crtext
>

The last two methods as per the text above are openutl and webauth. Reword
as
"A client supporting webauth and crtext would set
setenv IV_SSO webauth,crtext"


>
>  The variable name IV_SSO is historic as AUTH_PENDING was first used
>  to signal single sign on support. To keep compatibility with existing
> @@ -668,33 +668,50 @@ notification as
>  where {EXTRA} is formatted as received from the server.
>  Currently defined formats for {EXTRA} are detailed below.
>
> -openurl
> -========
> +webauth and openurl
> +===================
>  For a web based extra authentication (like for
>  SSO/SAML) {EXTRA} should be
>
>      OPEN_URL:url
>
> -and client should ask the user to open the URL to continue.
> +or
> +
> +    WEBAUTH:flags:url

+
> +The OPEN_URL method is deprecated as it does not allow to send flags which
> +proved to be needed to signal certain behaviour to the client.
> +
> +The client should ask the user to open the URL to continue.
>
>  The space in a control message is limited, so this url should be kept
>  short to avoid issues. If a longer url is required a URL that redirects
> -to the longer URL should be sent instead.
> +to the longer URL should be sent instead. The total length is limited to
> 1024
> +bytes which includes the INFO_PRE:WEBAUTH:flags.

+
> +flags is a list of flags which are separated by commas. Currently defined
> +flags are:
> +
> +- proxy     (see next pargraph)
> +- hidden    start the webview in hidden mode (see openvpn3 webauth
> documentation)
> +- external  Do not use an internal webview but use an external browser.
> Some
> +            authentication providers refuse to work in an internal
> webview.
> +
>
>  A complete documentation how URLs should be handled on the client is
> available
>  in the openvpn3 repository:
>
>  https://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md
>
> -proxy_url
> -========
> -This is a variant of openurl that allows opening a url via an
> +webauth with proxy
> +==================
> +This is a variant of webauth that allows opening a url via an
>  HTTP proxy. It could be used to avoid issues with OpenVPN connection's
>  persist-tun that may cause the web server to be unreachable.
>  The client should announce proxy_url in its IV_SSO and parse the
>  PROXY_URL message. The format of {EXTRA} in this case is
>
> -
> PROXY_URL:<proxy>:<proxy_port>:<proxyuser_base64>:<proxy_password_base64>:url
> +
> WEBAUTH:proxy=<proxy>;<proxy_port>;<proxyuser_base64>;<proxy_password_base64>,flags:url

 The proxy should be a literal IPv4 address or IPv6 address enclosed in []
> to avoid
>  ambiguity in parsing. A literal IP address is preferred as DNS might not
> be
> diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in
> index 79969bf89..944294b22 100644
> --- a/include/openvpn-plugin.h.in
> +++ b/include/openvpn-plugin.h.in
> @@ -578,7 +578,7 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t
> OPENVPN_PLUGIN_FUNC(openvpn_plugin_op
>   * auth_pending_file is
>   * line 1: timeout in seconds
>   * line 2: Pending auth method the client needs to support (e.g. openurl)
> - * line 3: EXTRA (e.g. OPEN_URL:http://www.example.com)
> + * line 3: EXTRA (e.g. WEBAUTH::http://www.example.com)
>   *
>   * In addition the OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER and
>   * OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 are called when OpenVPN tries to
> --
> 2.32.0
>

Looks good otherwise.

Selva

[-- Attachment #2: Type: text/html, Size: 7857 bytes --]

[Openvpn-devel] [PATCH v2] Introduce webauth auth pending method and deprecate openurl

[Arne Schwabe]

The experience with openurl/OPEN_URL has shown that just sending
a URL to a client is not enough and we often need different
behaviour of the client depending on circumstances. Replace
OPEN_URL with a more flexible WEB_AUTH pending auth method.

Patch v2: use WEB_AUTH instead WEBAUTH

Signed-off-by: Arne Schwabe <arne@...1227...>
---
 doc/management-notes.txt    | 41 ++++++++++++++++++++++++++-----------
 include/openvpn-plugin.h.in |  2 +-
 2 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/doc/management-notes.txt b/doc/management-notes.txt
index c20344298..d794a4a98 100644
--- a/doc/management-notes.txt
+++ b/doc/management-notes.txt
@@ -645,11 +645,11 @@ Before issuing a client-pending-auth to a client instead of a
 client-auth/client-deny, the server should check the IV_SSO
 environment variable for whether the method is supported. Currently
 defined methods are crtext for challenge/response using text
-(e.g., TOTP), openurl and proxy_url for opening a URL in the client to
-continue authentication. A client supporting the first two methods would
-set
+(e.g., TOTP), openurl (deprecated) and webauth for opening a URL in
+the client to continue authentication. A client supporting webauth and
+crtext would set
 
-    setenv IV_SSO openurl,crtext
+    setenv IV_SSO webauth,crtext
 
 The variable name IV_SSO is historic as AUTH_PENDING was first used
 to signal single sign on support. To keep compatibility with existing
@@ -668,33 +668,50 @@ notification as
 where {EXTRA} is formatted as received from the server.
 Currently defined formats for {EXTRA} are detailed below.
 
-openurl
-========
+webauth and openurl
+===================
 For a web based extra authentication (like for
 SSO/SAML) {EXTRA} should be
 
     OPEN_URL:url
 
-and client should ask the user to open the URL to continue.
+or
+
+    WEB_AUTH:flags:url
+
+The OPEN_URL method is deprecated as it does not allow to send flags which
+proved to be needed to signal certain behaviour to the client.
+
+The client should ask the user to open the URL to continue.
 
 The space in a control message is limited, so this url should be kept
 short to avoid issues. If a longer url is required a URL that redirects
-to the longer URL should be sent instead.
+to the longer URL should be sent instead. The total length is limited to 1024
+bytes which includes the INFO_PRE:WEB_AUTH:flags.
+
+flags is a list of flags which are separated by commas. Currently defined
+flags are:
+
+- proxy     (see next pargraph)
+- hidden    start the webview in hidden mode (see openvpn3 webauth documentation)
+- external  Do not use an internal webview but use an external browser. Some
+            authentication providers refuse to work in an internal webview.
+
 
 A complete documentation how URLs should be handled on the client is available
 in the openvpn3 repository:
 
 https://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md
 
-proxy_url
-========
-This is a variant of openurl that allows opening a url via an
+webauth with proxy
+==================
+This is a variant of webauth that allows opening a url via an
 HTTP proxy. It could be used to avoid issues with OpenVPN connection's
 persist-tun that may cause the web server to be unreachable.
 The client should announce proxy_url in its IV_SSO and parse the
 PROXY_URL message. The format of {EXTRA} in this case is
 
-    PROXY_URL:<proxy>:<proxy_port>:<proxyuser_base64>:<proxy_password_base64>:url
+    WEB_AUTH:proxy=<proxy>;<proxy_port>;<proxyuser_base64>;<proxy_password_base64>,flags:url
 
 The proxy should be a literal IPv4 address or IPv6 address enclosed in [] to avoid
 ambiguity in parsing. A literal IP address is preferred as DNS might not be
diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in
index abbfd9c2a..28b845af1 100644
--- a/include/openvpn-plugin.h.in
+++ b/include/openvpn-plugin.h.in
@@ -573,7 +573,7 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_op
  * auth_pending_file is
  * line 1: timeout in seconds
  * line 2: Pending auth method the client needs to support (e.g. openurl)
- * line 3: EXTRA (e.g. OPEN_URL:http://www.example.com)
+ * line 3: EXTRA (e.g. WEBAUTH::http://www.example.com)
  *
  * In addition the OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER and
  * OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 are called when OpenVPN tries to
-- 
2.32.0

Re: [Openvpn-devel] [PATCH v2] Introduce webauth auth pending method and deprecate openurl

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 1504 bytes --]

Hi,

On Wed, Jul 28, 2021 at 02:41:03PM +0200, Arne Schwabe wrote:
> The experience with openurl/OPEN_URL has shown that just sending
> a URL to a client is not enough and we often need different
> behaviour of the client depending on circumstances. Replace
> OPEN_URL with a more flexible WEB_AUTH pending auth method.
> 
> Patch v2: use WEB_AUTH instead WEBAUTH
[..]

I think this is mostly ready, except for a small oversight:

> -proxy_url
> -========
> -This is a variant of openurl that allows opening a url via an
> +webauth with proxy
> +==================
> +This is a variant of webauth that allows opening a url via an
>  HTTP proxy. It could be used to avoid issues with OpenVPN connection's
>  persist-tun that may cause the web server to be unreachable.
>  The client should announce proxy_url in its IV_SSO and parse the
>  PROXY_URL message. The format of {EXTRA} in this case is

   ^^^^^^^^^ there is no PROXY_URL anymore, so this might read

   ... and parse the "proxy=..." part of the "flags" section.  The format
   of {EXTRA} in this case is:

Or something like this.

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             gert@...1296...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 630 bytes --]

Re: [Openvpn-devel] [PATCH v2] Introduce webauth auth pending method and deprecate openurl

[Selva Nair]

[-- Attachment #1: Type: text/plain, Size: 2296 bytes --]

Hi,

-proxy_url
> -========
> -This is a variant of openurl that allows opening a url via an
> +webauth with proxy
> +==================
> +This is a variant of webauth that allows opening a url via an
>  HTTP proxy. It could be used to avoid issues with OpenVPN connection's
>  persist-tun that may cause the web server to be unreachable.
>  The client should announce proxy_url in its IV_SSO and parse the
>  PROXY_URL message. The format of {EXTRA} in this case is
>

"PROXY_URL message"  above should be replaced by "proxy flag and related
flags in the message" (Gert has already pointed this out.)
But we keep the requirement that compliant clients should announce "proxy"
in IV_SSO, right? As the flag is called "proxy", I suggest we change that
IV_SSO value to "proxy" as well.

With "flags", WEBAUTH  is extensible and we have to decide which features
require an explicit announce from the client. As not every client may be
ready to support proxy, looks reasonable to require it in IV_SSO.

We may soon require a section titled IV_SSO and list all legal values in
there.

-
> PROXY_URL:<proxy>:<proxy_port>:<proxyuser_base64>:<proxy_password_base64>:url
> +
> WEB_AUTH:proxy=<proxy>;<proxy_port>;<proxyuser_base64>;<proxy_password_base64>,flags:url
>

This may be an opportunity to change proxyuser_base64 to proxy_user_base64
as well. That would match proxy_password_base64 and proxy_port.


>
>  The proxy should be a literal IPv4 address or IPv6 address enclosed in []
> to avoid
>  ambiguity in parsing. A literal IP address is preferred as DNS might not
> be
> diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in
> index abbfd9c2a..28b845af1 100644
> --- a/include/openvpn-plugin.h.in
> +++ b/include/openvpn-plugin.h.in
> @@ -573,7 +573,7 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t
> OPENVPN_PLUGIN_FUNC(openvpn_plugin_op
>   * auth_pending_file is
>   * line 1: timeout in seconds
>   * line 2: Pending auth method the client needs to support (e.g. openurl)
> - * line 3: EXTRA (e.g. OPEN_URL:http://www.example.com)
> + * line 3: EXTRA (e.g. WEBAUTH::http://www.example.com)
>   *
>   * In addition the OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER and
>   * OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 are called when OpenVPN tries to
> --


Looks good otherwise.

Selva

[-- Attachment #2: Type: text/html, Size: 3622 bytes --]

[Openvpn-devel] [PATCH v3] Introduce webauth auth pending method and deprecate openurl

[Arne Schwabe]

The experience with openurl/OPEN_URL has shown that just sending
a URL to a client is not enough and we often need different
behaviour of the client depending on circumstances. Replace
OPEN_URL with a more flexible WEB_AUTH pending auth method.

Patch v2: use WEB_AUTH instead WEBAUTH
Patch v3: incooperate other comments from Selva

Signed-off-by: Arne Schwabe <arne@...1227...>
---
 doc/management-notes.txt    | 45 +++++++++++++++++++++++++------------
 include/openvpn-plugin.h.in |  2 +-
 2 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/doc/management-notes.txt b/doc/management-notes.txt
index c20344298..1cafb8a8e 100644
--- a/doc/management-notes.txt
+++ b/doc/management-notes.txt
@@ -645,11 +645,11 @@ Before issuing a client-pending-auth to a client instead of a
 client-auth/client-deny, the server should check the IV_SSO
 environment variable for whether the method is supported. Currently
 defined methods are crtext for challenge/response using text
-(e.g., TOTP), openurl and proxy_url for opening a URL in the client to
-continue authentication. A client supporting the first two methods would
-set
+(e.g., TOTP), openurl (deprecated) and webauth for opening a URL in
+the client to continue authentication. A client supporting webauth and
+crtext would set
 
-    setenv IV_SSO openurl,crtext
+    setenv IV_SSO webauth,crtext
 
 The variable name IV_SSO is historic as AUTH_PENDING was first used
 to signal single sign on support. To keep compatibility with existing
@@ -668,33 +668,50 @@ notification as
 where {EXTRA} is formatted as received from the server.
 Currently defined formats for {EXTRA} are detailed below.
 
-openurl
-========
+webauth and openurl
+===================
 For a web based extra authentication (like for
 SSO/SAML) {EXTRA} should be
 
     OPEN_URL:url
 
-and client should ask the user to open the URL to continue.
+or
+
+    WEB_AUTH:flags:url
+
+The OPEN_URL method is deprecated as it does not allow to send flags which
+proved to be needed to signal certain behaviour to the client.
+
+The client should ask the user to open the URL to continue.
 
 The space in a control message is limited, so this url should be kept
 short to avoid issues. If a longer url is required a URL that redirects
-to the longer URL should be sent instead.
+to the longer URL should be sent instead. The total length is limited to 1024
+bytes which includes the INFO_PRE:WEB_AUTH:flags.
+
+flags is a list of flags which are separated by commas. Currently defined
+flags are:
+
+- proxy     (see next pargraph)
+- hidden    start the webview in hidden mode (see openvpn3 webauth documentation)
+- external  Do not use an internal webview but use an external browser. Some
+            authentication providers refuse to work in an internal webview.
+
 
 A complete documentation how URLs should be handled on the client is available
 in the openvpn3 repository:
 
 https://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md
 
-proxy_url
-========
-This is a variant of openurl that allows opening a url via an
+webauth with proxy
+==================
+This is a variant of webauth that allows opening a url via an
 HTTP proxy. It could be used to avoid issues with OpenVPN connection's
 persist-tun that may cause the web server to be unreachable.
-The client should announce proxy_url in its IV_SSO and parse the
-PROXY_URL message. The format of {EXTRA} in this case is
+The client should announce proxy in its IV_SSO and parse the
+proxy flag in the WEB_AUTH message. The format of {EXTRA} in this case is
 
-    PROXY_URL:<proxy>:<proxy_port>:<proxyuser_base64>:<proxy_password_base64>:url
+    WEB_AUTH:proxy=<proxy>;<proxy_port>;<proxy_user_base64>;<proxy_password_base64>,flags:url
 
 The proxy should be a literal IPv4 address or IPv6 address enclosed in [] to avoid
 ambiguity in parsing. A literal IP address is preferred as DNS might not be
diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in
index abbfd9c2a..28b845af1 100644
--- a/include/openvpn-plugin.h.in
+++ b/include/openvpn-plugin.h.in
@@ -573,7 +573,7 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_op
  * auth_pending_file is
  * line 1: timeout in seconds
  * line 2: Pending auth method the client needs to support (e.g. openurl)
- * line 3: EXTRA (e.g. OPEN_URL:http://www.example.com)
+ * line 3: EXTRA (e.g. WEBAUTH::http://www.example.com)
  *
  * In addition the OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER and
  * OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 are called when OpenVPN tries to
-- 
2.32.0

Re: [Openvpn-devel] [PATCH v3] Introduce webauth auth pending method and deprecate openurl

[Selva Nair]

[-- Attachment #1: Type: text/plain, Size: 4882 bytes --]

Hi,

On Fri, Aug 13, 2021 at 7:56 AM Arne Schwabe <arne@...1227...> wrote:

> The experience with openurl/OPEN_URL has shown that just sending
> a URL to a client is not enough and we often need different
> behaviour of the client depending on circumstances. Replace
> OPEN_URL with a more flexible WEB_AUTH pending auth method.
>
> Patch v2: use WEB_AUTH instead WEBAUTH
> Patch v3: incooperate other comments from Selva
>
> Signed-off-by: Arne Schwabe <arne@...1227...>
> ---
>  doc/management-notes.txt    | 45 +++++++++++++++++++++++++------------
>  include/openvpn-plugin.h.in |  2 +-
>  2 files changed, 32 insertions(+), 15 deletions(-)
>
> diff --git a/doc/management-notes.txt b/doc/management-notes.txt
> index c20344298..1cafb8a8e 100644
> --- a/doc/management-notes.txt
> +++ b/doc/management-notes.txt
> @@ -645,11 +645,11 @@ Before issuing a client-pending-auth to a client
> instead of a
>  client-auth/client-deny, the server should check the IV_SSO
>  environment variable for whether the method is supported. Currently
>  defined methods are crtext for challenge/response using text
> -(e.g., TOTP), openurl and proxy_url for opening a URL in the client to
> -continue authentication. A client supporting the first two methods would
> -set
> +(e.g., TOTP), openurl (deprecated) and webauth for opening a URL in
> +the client to continue authentication. A client supporting webauth and
> +crtext would set
>
> -    setenv IV_SSO openurl,crtext
> +    setenv IV_SSO webauth,crtext
>
>  The variable name IV_SSO is historic as AUTH_PENDING was first used
>  to signal single sign on support. To keep compatibility with existing
> @@ -668,33 +668,50 @@ notification as
>  where {EXTRA} is formatted as received from the server.
>  Currently defined formats for {EXTRA} are detailed below.
>
> -openurl
> -========
> +webauth and openurl
> +===================
>  For a web based extra authentication (like for
>  SSO/SAML) {EXTRA} should be
>
>      OPEN_URL:url
>
> -and client should ask the user to open the URL to continue.
> +or
> +
> +    WEB_AUTH:flags:url
> +
> +The OPEN_URL method is deprecated as it does not allow to send flags which
> +proved to be needed to signal certain behaviour to the client.
> +
> +The client should ask the user to open the URL to continue.
>
>  The space in a control message is limited, so this url should be kept
>  short to avoid issues. If a longer url is required a URL that redirects
> -to the longer URL should be sent instead.
> +to the longer URL should be sent instead. The total length is limited to
> 1024
> +bytes which includes the INFO_PRE:WEB_AUTH:flags.
> +
> +flags is a list of flags which are separated by commas. Currently defined
> +flags are:
> +
> +- proxy     (see next pargraph)
> +- hidden    start the webview in hidden mode (see openvpn3 webauth
> documentation)
> +- external  Do not use an internal webview but use an external browser.
> Some
> +            authentication providers refuse to work in an internal
> webview.
> +
>
>  A complete documentation how URLs should be handled on the client is
> available
>  in the openvpn3 repository:
>
>  https://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md
>
> -proxy_url
> -========
> -This is a variant of openurl that allows opening a url via an
> +webauth with proxy
> +==================
> +This is a variant of webauth that allows opening a url via an
>  HTTP proxy. It could be used to avoid issues with OpenVPN connection's
>  persist-tun that may cause the web server to be unreachable.
> -The client should announce proxy_url in its IV_SSO and parse the
> -PROXY_URL message. The format of {EXTRA} in this case is
> +The client should announce proxy in its IV_SSO and parse the
> +proxy flag in the WEB_AUTH message. The format of {EXTRA} in this case is
>
> -
> PROXY_URL:<proxy>:<proxy_port>:<proxyuser_base64>:<proxy_password_base64>:url
> +
> WEB_AUTH:proxy=<proxy>;<proxy_port>;<proxy_user_base64>;<proxy_password_base64>,flags:url
>
>  The proxy should be a literal IPv4 address or IPv6 address enclosed in []
> to avoid
>  ambiguity in parsing. A literal IP address is preferred as DNS might not
> be
> diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in
> index abbfd9c2a..28b845af1 100644
> --- a/include/openvpn-plugin.h.in
> +++ b/include/openvpn-plugin.h.in
> @@ -573,7 +573,7 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t
> OPENVPN_PLUGIN_FUNC(openvpn_plugin_op
>   * auth_pending_file is
>   * line 1: timeout in seconds
>   * line 2: Pending auth method the client needs to support (e.g. openurl)
> - * line 3: EXTRA (e.g. OPEN_URL:http://www.example.com)
> + * line 3: EXTRA (e.g. WEBAUTH::http://www.example.com)
>   *
>   * In addition the OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER and
>   * OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 are called when OpenVPN tries to
>

Acked-by: <selva.nair@...277...>

[-- Attachment #2: Type: text/html, Size: 6346 bytes --]

[Openvpn-devel] [PATCH applied] Re: Introduce webauth auth pending method and deprecate openurl

[Gert Doering]

That was an easy one :-) - no code changes, no testing required.

Your patch has been applied to the master branch.

commit 42f6063f611b75a07c266061dc6a07f6dcfe372c
Author: Arne Schwabe
Date:   Fri Aug 13 13:55:42 2021 +0200

     Introduce webauth auth pending method and deprecate openurl

     Signed-off-by: Arne Schwabe <arne@...1227...>
     Acked-by: Selva Nair <selva.nair@...277...>
     Message-Id: <20210813115542.2794-1-arne@...1227...>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22737.html
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering