Mitigate authorizing third person

### Problem Statement Hi, SSO is giving us a small headache. Our VPN implementation works as follows: - User has to enter his credentials, this is checked via openvpn-auth-ldap plugin. - If ldap auth succeeds, then the user will get the redirect URI for oAuth2. Our clients are internal (always have the right for VPN) and external (some have the rights, others do not). The scenario we want to mitigate: - Rogue user has managed to break into the ldap auth. - As the rogue user has no SSO credentials, he will be blocked. - But the rogue user sends a phishing email to an internal user who very possibily has SSO in place - The user clicks the link giving rogue user access to VPN. What we have seen: - Even though the username and password is passed to oauth2 or microsoft, the values are not used? Question: According to FAQ (passing usernames from oauth2 provider to openvpn), one should file a feature request to openvpn. Does this include my seen behavior? Or did I miss a configuration to match username given for ldap auth and SSO user? Thanks for shining some light the internals of oAuth2. BR ### openvpn-auth-oauth2 logs ```shell none ``` ### Environment - openvpn-auth-oauth2 Version: 1.26.4 - OpenVPN Server Version: 2.7_rc5 - Server OS: Debian Trixie - OpenVPN Client (flavor, OS): any (for example Openvpn3 connect 3.8.1 Windows) ### Preflight Checklist - [x] I could not find a solution in the [documentation](https://github.com/jkroepke/openvpn-auth-oauth2/wiki), the [FAQ](https://github.com/jkroepke/openvpn-auth-oauth2/wiki/FAQ), the existing issues or discussions.