Full authentication every time when connection disconnect manually

### Problem Statement Hello, Many thanks for your tool. Have a one quick question: Am I right that authentication via username/pass every manually disconnect is normal or not? I thought that I can auth at once and every disconnect redirects to browser and without full oauth(username/password/2fa) get auth while my session is live in keycloak. Thank you. # openvpn-server-config: ``` dev tun0 server 172.16.97.0 255.255.255.0 script-security 2 client-connect /etc/openvpn/scripts/client-connect.sh client-disconnect /etc/openvpn/scripts/client-disconnect.sh status /var/log/openvpn/status.log verb 3 ca /etc/openvpn/server/pki/ca.crt key /etc/openvpn/server/pki/private/server.key cert /etc/openvpn/server/pki/issued/server.crt push "dhcp-option DNS x.x.x.x" push "route x.x.x.x 255.255.255.0" keepalive 10 120 reneg-sec 600 persist-key persist-tun dh none auth SHA512 cipher AES-256-GCM tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 tls-cert-profile preferred tls-version-min 1.3 explicit-exit-notify 1 push "push-peer-info" verify-client-cert none username-as-common-name auth-user-pass-optional errors-to-stderr allow-compression no topology subnet proto udp port 1196 tun-mtu 1420 mssfix 1380 fast-io user nobody group nogroup management /run/openvpn/server.sock unix /etc/openvpn/server/password.txt #management-hold management-client-auth auth-gen-token 28800 external-auth ``` # openvpn-auth-oauth2 config: ``` #debug: # pprof: false # listen: :9001 http: # assets-path: "" # Example: "/etc/openvpn-auth-oauth2/assets/" baseurl: "https://domain.com" # cert: "/etc/openvpn-auth-oauth2/" # check: # ipaddr: false # enable-proxy-headers: true # key: "/etc/openvpn-auth-oauth2/" listen: ":9000" secret: "xxx" # template: "" # Path to a HTML file which is displayed at the end of the screen # tls: false log: format: console level: INFO vpn-client-ip: true oauth2: # authorize-params: "a=c" client: id: "openvpn-auth-oauth2" # private-key: "file:///etc/openvpn-auth-oauth2/oidc.key" # private-key-id: "openvpn-auth-oauth2" secret: "xxx" # endpoint: # discovery: "https://idp/.well-known/openid-configuration" # auth: "https://idp/oauth/auth" # token: "https://idp/oauth/token" # group-claim: "groups" issuer: "https://idp/realms/external" # provider: "generic" scopes: - "openid" - "profile" - "offline_access" # user-info: false # validate: # acr: [] # # - "phr" # # - "phrh" # common-name: "" # common-name-case-sensitive: false # groups: [] # # - "test" # # - "test2" # roles: [] # # - "test" # # - "test2" # ipaddr: false # issuer: true # nonce: true # refresh-nonce: "auto" # Options: auto (try with nonce, retry without on error), empty (always use empty nonce for refresh), equal (use same nonce as initial auth) # pkce: true refresh: enabled: true expires: 8h0m0s secret: "xxx" use-session-id: true validate-user: true openvpn: addr: "unix:///run/openvpn/server.sock" # This is overridden by /etc/sysconfig/openvpn-auth-oauth2 auth-token-user: true # auth-pending-timeout: 2m # bypass: # common-names: # - "test" # - "test2" # - "wildcard.*" # client-config: # enabled: false # path: "/etc/openvpn-auth-oauth2/client-config/" # token-claim: "" # common-name: # environment-variable-name: common_name # mode: plain password: "xxx" # override-username: false # (requires OpenVPN 2.7 server) # reauthentication: true #pass-through: # enabled: false # address: "unix:///run/openvpn/pass-through.sock" # password: "" # socket-group: "" # socket-mode: 660 ``` ### openvpn-auth-oauth2 logs ```shell 1st attempt: time=2025-12-29T22:54:50.021+03:00 level=INFO msg="new client authentication" ip=109.245.170.254:59737 cid=19 kid=1 common_name="" reason=CONNECT session_id=1N5lK5rFZEM8zUSV session_state=Initial time=2025-12-29T22:54:50.021+03:00 level=INFO msg="sent client-pending-auth command" ip=109.245.170.254:59737 cid=19 kid=1 common_name="" reason=CONNECT session_id=1N5lK5rFZEM8zUSV session_state=Initial time=2025-12-29T22:54:50.693+03:00 level=INFO msg="initialize authorization via oauth2" ip=109.245.170.254:59737 cid=19 kid=1 common_name="" time=2025-12-29T22:55:06.793+03:00 level=INFO msg="successful authorization via oauth2" ip=109.245.170.254:59737 cid=19 kid=1 common_name="" session_id=1N5lK5rFZEM8zUSV session_state=Initial idtoken_subject=4d9431ed-6959-476e-b481-740135a7f99f idtoken_email=denis_kuzakov@domain.com idtoken_preferred_username=denis_kuzakov@domain.com user_subject=4d9431ed-6959-476e-b481-740135a7f99f user_preferred_username=denis_kuzakov@domain.com time=2025-12-29T22:55:06.793+03:00 level=INFO msg="client authentication" ip=109.245.170.254:59737 cid=19 kid=1 common_name="" session_id=1N5lK5rFZEM8zUSV session_state=Initial idtoken_subject=4d9431ed-6959-476e-b481-740135a7f99f idtoken_email=denis_kuzakov@domain.com idtoken_preferred_username=denis_kuzakov@domain.com user_subject=4d9431ed-6959-476e-b481-740135a7f99f user_preferred_username=denis_kuzakov@domain.com time=2025-12-29T22:55:07.111+03:00 level=INFO msg="client established" ip=109.245.170.254:59737 cid=19 kid=0 common_name="" reason=ESTABLISHED session_id=1N5lK5rFZEM8zUSV session_state=Initial vpn_ip=172.16.97.18 time=2025-12-29T22:55:28.183+03:00 level=INFO msg="client disconnected" ip=109.245.170.254:59737 cid=19 kid=0 common_name="" reason=DISCONNECT session_id=1N5lK5rFZEM8zUSV session_state=Initial 2nd attempt(after manually disconnect): time=2025-12-29T22:56:16.018+03:00 level=INFO msg="new client authentication" ip=109.245.170.254:61454 cid=20 kid=1 common_name="" reason=CONNECT session_id=X7o6H2qROoHIhO3g session_state=Initial time=2025-12-29T22:56:16.018+03:00 level=INFO msg="sent client-pending-auth command" ip=109.245.170.254:61454 cid=20 kid=1 common_name="" reason=CONNECT session_id=X7o6H2qROoHIhO3g session_state=Initial time=2025-12-29T22:56:16.582+03:00 level=INFO msg="initialize authorization via oauth2" ip=109.245.170.254:61454 cid=20 kid=1 common_name="" time=2025-12-29T22:56:37.983+03:00 level=INFO msg="successful authorization via oauth2" ip=109.245.170.254:61454 cid=20 kid=1 common_name="" session_id=X7o6H2qROoHIhO3g session_state=Initial idtoken_subject=4d9431ed-6959-476e-b481-740135a7f99f idtoken_email=denis_kuzakov@domain.com idtoken_preferred_username=denis_kuzakov@domain.com user_subject=4d9431ed-6959-476e-b481-740135a7f99f user_preferred_username=denis_kuzakov@domain.com time=2025-12-29T22:56:37.983+03:00 level=INFO msg="client authentication" ip=109.245.170.254:61454 cid=20 kid=1 common_name="" session_id=X7o6H2qROoHIhO3g session_state=Initial idtoken_subject=4d9431ed-6959-476e-b481-740135a7f99f idtoken_email=denis_kuzakov@domain.com idtoken_preferred_username=denis_kuzakov@domain.com user_subject=4d9431ed-6959-476e-b481-740135a7f99f user_preferred_username=denis_kuzakov@domain.com time=2025-12-29T22:56:41.142+03:00 level=INFO msg="client established" ip=109.245.170.254:61454 cid=20 kid=0 common_name="" reason=ESTABLISHED session_id=X7o6H2qROoHIhO3g session_state=Initial vpn_ip=172.16.97.19 time=2025-12-29T22:57:04.032+03:00 level=INFO msg="client disconnected" ip=109.245.170.254:61454 cid=20 kid=0 common_name="" reason=DISCONNECT session_id=X7o6H2qROoHIhO3g session_state=Initial ``` ### Environment - openvpn-auth-oauth2 Version: 1.26.4 - OpenVPN Server Version: 2.6.14 - Server OS: Ubuntu 24.04.3 - OpenVPN Client (flavor, OS): OpenVPN Connect 3.8.0 (Windows 11 Pro ARM) - Keycloak: 26.4.7 (tried 26.3.5 - the same result) ### Preflight Checklist - [x] I could not find a solution in the [documentation](https://github.com/jkroepke/openvpn-auth-oauth2/wiki), the [FAQ](https://github.com/jkroepke/openvpn-auth-oauth2/wiki/FAQ), the existing issues or discussions.