Hello.

The Cisco VPN server I try to connect to expects the correct authgroup to be 
send as <group-select> in the initial POST request, like:

<config-auth client="vpn" type="auth-request" aggregate-auth-version="2">
  ...
  <group-select>correct-auth-group</group-select>
  ...
</config-auth>

Otherwise the server will send a wrong <sso-v2-login> path in the reponse.

However, openconnect v9.12-0+3.1 seems to ignore the --authgroup parameter for 
that purpose.

I also failed to manipulate the initial POST request form with the --form-entry 
parameter, like
--form-entry main:group-select=correct-auth-group
or
--form-entry init:group-select=correct-auth-group

I came to realize, that openconnect is designated to send the <group-select> 
node,  as can be seen in the code of auth.c in line 929:
https://gitlab.com/openconnect/openconnect/-/blob/master/auth.c#L929

However, it doesn't and I can't tell why. Any idea how to fix the problem?

Kind regards
Thomas Popp

Attachment: smime.p7s
Description: S/MIME cryptographic signature

_______________________________________________
openconnect-devel mailing list
openconnect-devel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/openconnect-devel

Reply via email to