Environment
- Debian Trixie
- OpenVPN server version: 2.7.5-1~bpo13+1
- Clients: OpenVPN 2 community (
2.7.2) and OpenVPN Connect 3 (3.11.3)
- Plugin: OpenVPN auth oAuth2 plugin version
2.0.1
- Use authentication tokens and persistent HHAC keys (directives
auth-gen-token 86400 and auth-gen-token-secret [keyfile]
Description / Problem Statement:
When an OpenVPN server initiates a restart/reset (e.g., via SIGUSR1 or explicit management signals), it currently transmits a bare RESTART control message.
This causes inconsistent behavior across client implementations:
- OpenVPN 2.x (Community): Reuses the active
auth-token stored in memory and reconnects transparently.
- OpenVPN Connect 3 (OpenVPN 3 Core): Interprets bare
RESTART as a full session reset, purging ephemeral session tokens. Since the oauth2 plugin is in use, this forces users to re-enter credentials/OTP manually with the SSO server (unless the SSO session is already active) rather than completing a seamless background reconnection.
Proposed Solution / Feature Request:
- Update server restart signal emission to send
RESTART,[P]: by default to preserve pushed authentication tokens across restarts.
- Alternatively, provide a configurable server directive to toggle between
RESTART and RESTART,[P]: / RESTART,[PN]: behavior.
Impact:
Aligns session persistence across both OpenVPN 2.x and OpenVPN 3 core engines, preventing unnecessary authentication during graceful server restarts or maintenance.
Environment
2.7.2) and OpenVPN Connect 3 (3.11.3)2.0.1auth-gen-token 86400andauth-gen-token-secret [keyfile]Description / Problem Statement:
When an OpenVPN server initiates a restart/reset (e.g., via SIGUSR1 or explicit management signals), it currently transmits a bare
RESTARTcontrol message.This causes inconsistent behavior across client implementations:
auth-tokenstored in memory and reconnects transparently.RESTARTas a full session reset, purging ephemeral session tokens. Since the oauth2 plugin is in use, this forces users to re-enter credentials/OTP manually with the SSO server (unless the SSO session is already active) rather than completing a seamless background reconnection.Proposed Solution / Feature Request:
RESTART,[P]:by default to preserve pushed authentication tokens across restarts.RESTARTandRESTART,[P]:/RESTART,[PN]:behavior.Impact:
Aligns session persistence across both OpenVPN 2.x and OpenVPN 3 core engines, preventing unnecessary authentication during graceful server restarts or maintenance.