Client does not go to IDP. Client opens the redirect uri instead

### Current Behavior As soon as the client* connects, a system browser pops up and opens the website "https://<BASEURL_of_oAuth>/oauth/start?state=d-<token>". Client = OpenVPN Connect on Windows, version 3.7.2 and 3.8.0 were tested. OpenVPN3 on Debian behaves the same way. ### Expected Behavior As soon as the client* connects, a system browser pops up and opens the website "https://login.microsoftonline.com%2f<BASEURL_of_oAuth>/oauth/start?state=d-<token>" or equivalent. ### Steps To Reproduce ```Markdown 1. Tested on Debian Trixie 2. Configuration of OpenVPN server: ` server xx.xx.xx.xx 255.255.255.192 server-ipv6 xx:xx:xx:xx::xx/64 port 1194 proto udp6 dev tun1 topology subnet fast-io explicit-exit-notify max-clients 61 client-to-client session-timeout 259200 keepalive 10 60 username-as-common-name duplicate-cn verify-client-cert none dh /etc/tls/dhparams/dhparam_4096.pem ca /etc/ssl/ca.pem cert /etc/ssl/cert.pem key /etc/ssl/key.pem management localhost 2081 management-hold management-client-auth script-security 2 client-connect "/usr/local/bin/custom_connect.sh" ` Configuration of oAuth: ` http: baseurl: "http://<my_public_ip>:9001/" secret: "HyprCookieSecret" listen: ":9001" tls: false cert: "/etc/openvpn-auth-oauth2/cert.pem" key: "/etc/openvpn-auth-oauth2/key.pem" oauth2: issuer: "https://login.microsoftonline.com/<TenantID>/v2.0" client: id: "<Application ID>" secret: "<Client secret value>" openvpn: addr: "tcp://localhost:2081" auth-pending-timeout: 2m ` oauth is run as root and tls is disabled for debugging. This will reenabled as soon as the issue is resolved. 3. Try to connect with OpenVPN3 client for Windows (3.7.2 or 3.8.0) 4. Error from system browser going to https://<BASEURL_of_oAuth>/oauth/start?state=d-<token> and getting "404 page not found" ``` ### Environment - openvpn-auth-oauth2 Version: 1.26.2 - OpenVPN Server Version: 2.6.15 - Server OS: Debian Trixie - OpenVPN Client (flavor, OS): Windows 11, OpenVPN3 3.7.2 and 3.8.0 & Debian Trixie, OpenVPN3-client 25 - OIDC Provider: Azure AD ### openvpn-auth-oauth2 logs ```shell Nov 27 10:36:02 deb-ovpn systemd[1]: Started openvpn-auth-oauth2.service - OpenVPN authenticator. Nov 27 10:36:02 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:02.549Z level=DEBUG msg=config config="{\"config\":\"\",\"http\":{\"baseurl\":\"<BASEURL_of_oAuth>\",\"assets-path\":\"\",\"template\":\"\",\"listen\":\":9001\",\"cert\":\"/etc/openvpn-auth-oauth2/cert.pem\",\"key\":\"/etc/openvpn-auth-oauth2/key.pem\",\"secret\":\"***\",\"tls\":false,\"check\":{\"ipaddr\":false},\"enable-proxy-headers\":false,\"short-url\":false},\"debug\":{\"listen\":\":9001\",\"pprof\":false},\"log\":{\"format\":\"console\",\"level\":\"DEBUG\",\"vpn-client-ip\":true},\"openvpn\":{\"addr\":\"tcp://localhost:2081\",\"password\":\"\",\"client-config\":{\"path\":\"\",\"token-claim\":\"\",\"enabled\":false},\"bypass\":{\"common-names\":\"\"},\"common-name\":{\"environment-variable-name\":\"common_name\",\"mode\":\"plain\"},\"pass-through\":{\"address\":\"unix:/run/openvpn-auth-oauth2/server.sock\",\"password\":\"\",\"socket-group\":\"\",\"socket-mode\":660,\"enabled\":false},\"auth-pending-timeout\":120000000000,\"command-timeout\":10000000000,\"auth-token-user\":true,\"override-username\":false,\"reauthentication\":true},\"oauth2\":{\"endpoint\":{\"discovery\":\"\",\"auth\":\"\",\"token\":\"\"},\"issuer\":\"https://login.microsoftonline.com/<TenantID>/v2.0\",\"client\":{\"id\":\"<Application ID>\",\"secret\":\"***\",\"private-key\":\"\",\"private-key-id\":\"\"},\"groups-claim\":\"groups\",\"authorize-params\":\"\",\"provider\":\"generic\",\"scopes\":\"\",\"validate\":{\"common-name\":\"\",\"acr\":\"\",\"groups\":\"\",\"roles\":\"\",\"ipaddr\":false,\"issuer\":true,\"common-name-case-sensitive\":false},\"refresh\":{\"secret\":\"\",\"expires\":28800000000000,\"enabled\":false,\"use-session-id\":false,\"validate-user\":true},\"auth-style\":\"AuthStyleInParams\",\"refresh-nonce\":\"auto\",\"nonce\":true,\"pkce\":true,\"user-info\":false}}" Nov 27 10:36:02 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:02.549Z level=INFO msg="discover oidc auto configuration with provider generic for issuer https://login.microsoftonline.com/<TenantID>/v2.0" Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.096Z level=DEBUG msg=discover rp.function=NewRelyingPartyOIDC config="&{Issuer:https://login.microsoftonline.com/<TenantID>/v2.0 AuthorizationEndpoint:https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/authorize TokenEndpoint:https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/token IntrospectionEndpoint: UserinfoEndpoint:https://graph.microsoft.com/oidc/userinfo RevocationEndpoint: EndSessionEndpoint:https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/logout DeviceAuthorizationEndpoint:https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/devicecode CheckSessionIframe: JwksURI:https://login.microsoftonline.com/<TenantID>/discovery/v2.0/keys RegistrationEndpoint: ScopesSupported:[openid profile email offline_access] ResponseTypesSupported:[code id_token code id_token id_token token] ResponseModesSupported:[query fragment form_post] GrantTypesSupported:[] ACRValuesSupported:[] SubjectTypesSupported:[pairwise] IDTokenSigningAlgValuesSupported:[RS256] IDTokenEncryptionAlgValuesSupported:[] IDTokenEncryptionEncValuesSupported:[] UserinfoSigningAlgValuesSupported:[] UserinfoEncryptionAlgValuesSupported:[] UserinfoEncryptionEncValuesSupported:[] RequestObjectSigningAlgValuesSupported:[] RequestObjectEncryptionAlgValuesSupported:[] RequestObjectEncryptionEncValuesSupported:[] TokenEndpointAuthMethodsSupported:[client_secret_post private_key_jwt client_secret_basic self_signed_tls_client_auth] TokenEndpointAuthSigningAlgValuesSupported:[] RevocationEndpointAuthMethodsSupported:[] RevocationEndpointAuthSigningAlgValuesSupported:[] IntrospectionEndpointAuthMethodsSupported:[] IntrospectionEndpointAuthSigningAlgValuesSupported:[] DisplayValuesSupported:[] ClaimTypesSupported:[] ClaimsSupported:[sub iss cloud_instance_name cloud_instance_host_name cloud_graph_host_name msgraph_host aud exp iat auth_time acr nonce preferred_username name tid ver at_hash c_hash email] ClaimsParameterSupported:false CodeChallengeMethodsSupported:[] ServiceDocumentation: ClaimsLocalesSupported:[] UILocalesSupported:[] RequestParameterSupported:false RequestURIParameterSupported:false RequireRequestURIRegistration:false OPPolicyURI: OPTermsOfServiceURI: BackChannelLogoutSupported:false BackChannelLogoutSessionSupported:false}" Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.096Z level=INFO msg="openvpn-auth-oauth2 started with base url <BASEURL_of_oAuth>" Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.096Z level=INFO msg="connect to openvpn management interface tcp://localhost:2081" Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.097Z level=INFO msg="start HTTP server listener on [::]:9001" Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.097Z level=DEBUG msg="password probe: >INFO:OpenVPN M" Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.099Z level=INFO msg="connection to OpenVPN management interface established" Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.099Z level=DEBUG msg="send command" command=version Nov 27 10:36:03 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:36:03.099Z level=INFO msg="OpenVPN Version: OpenVPN 2.6.14 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]" Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_VER=3.11.3 Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_PLAT=win Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_NCP=2 Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_TCPNL=1 Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_PROTO=8094 Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_MTU=1600 Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305 Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_GUI_VER=OCWindows_3.8.0-4528 Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_SSO=webauth,crtext Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> peer info: IV_BS64DL=1 Nov 27 10:37:36 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:37:36.901Z level=DEBUG msg=">CLIENT:CONNECT,12,1\r\n>CLIENT:ENV,n_clients=0\r\n>CLIENT:ENV,password=***\r\n>CLIENT:ENV,untrusted_port=52629\r\n>CLIENT:ENV,untrusted_ip6=<ClientIP>\r\n>CLIENT:ENV,username=krj2\r\n>CLIENT:ENV,IV_BS64DL=1\r\n>CLIENT:ENV,IV_SSO=webauth,crtext\r\n>CLIENT:ENV,IV_GUI_VER=OCWindows_3.8.0-4528\r\n>CLIENT:ENV,IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305\r\n>CLIENT:ENV,IV_MTU=1600\r\n>CLIENT:ENV,IV_PROTO=8094\r\n>CLIENT:ENV,IV_TCPNL=1\r\n>CLIENT:ENV,IV_NCP=2\r\n>CLIENT:ENV,IV_PLAT=win\r\n>CLIENT:ENV,IV_VER=3.11.3\r\n>CLIENT:ENV,remote_port_1=1194\r\n>CLIENT:ENV,local_port_1=1194\r\n>CLIENT:ENV,proto_1=udp6\r\n>CLIENT:ENV,daemon_pid=1680\r\n>CLIENT:ENV,daemon_start_time=1764144751\r\n>CLIENT:ENV,daemon_log_redirect=0\r\n>CLIENT:ENV,daemon=1\r\n>CLIENT:ENV,verb=1\r\n>CLIENT:ENV,config=/etc/openvpn/udp1.conf\r\n>CLIENT:ENV,ifconfig_local=<IPv4_Assigned_addr>\r\n>CLIENT:ENV,ifconfig_netmask=255.255.255.192\r\n>CLIENT:ENV,ifconfig_ipv6_local=<IPv6_Assigned_addr>\r\n>CLIENT:ENV,ifconfig_ipv6_netbits=64\r\n>CLIENT:ENV,ifconfig_ipv6_remote=<IPv6_VPN_Gateway>\r\n>CLIENT:ENV,script_context=init\r\n>CLIENT:ENV,tun_mtu=1500\r\n>CLIENT:ENV,dev=tun1\r\n>CLIENT:ENV,dev_type=tun\r\n>CLIENT:ENV,redirect_gateway=0\r\n>CLIENT:ENV,END\r\n" Nov 27 10:37:36 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:37:36.901Z level=INFO msg="new client authentication" ip=<ClientIP>:52629 cid=12 kid=1 common_name="" reason=CONNECT session_id="" session_state="" Nov 27 10:37:36 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:37:36.901Z level=DEBUG msg="silent re-authentication disabled by configuration" ip=<ClientIP>:52629 cid=12 kid=1 common_name="" reason=CONNECT session_id="" session_state="" Nov 27 10:37:36 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:37:36.901Z level=INFO msg="sent client-pending-auth command" ip=<ClientIP>:52629 cid=12 kid=1 common_name="" reason=CONNECT session_id="" session_state="" Nov 27 10:37:36 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:37:36.901Z level=DEBUG msg="send command" command="client-pending-auth 12 1 \"WEB_AUTH::<BASEURL_of_oAuth>/oauth2/start?state=5tJqVNTXSbmVoyxDUpflxJvUKAcZh3vuQMLc0efuEeJhdXZ-KngREQPpbt5RIJDwXAVdgQoenmmuefeNCIvyfXzYF3ZkDrbsnSot\" 120" Nov 27 10:37:36 deb-ovpn ovpn-udp1[1680]: <ClientIP> [krj2] Peer Connection Initiated with [AF_INET6]<ClientIP>:52629 Nov 27 10:39:44 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:39:44.032Z level=DEBUG msg=">CLIENT:DISCONNECT,12\r\n>CLIENT:ENV,END\r\n" Nov 27 10:39:44 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:39:44.033Z level=INFO msg="client disconnected" ip=: cid=12 kid=0 common_name="" reason=DISCONNECT session_id="" session_state="" Nov 27 10:39:44 deb-ovpn openvpn-auth-oauth2[4829]: time=2025-11-27T10:39:44.033Z level=DEBUG msg="error from token store: value does not exist" ip=: cid=12 kid=0 common_name="" reason=DISCONNECT session_id="" session_state="" ``` ### openvpn server logs ```shell ``` ### Anything else? _No response_ ### Preflight Checklist - [x] I could not find a solution in the [documentation](https://github.com/jkroepke/openvpn-auth-oauth2/wiki), the [FAQ](https://github.com/jkroepke/openvpn-auth-oauth2/wiki/FAQ), the existing issues or discussions.