diff mbox series

[Openvpn-devel,v3] Document notify as auth pending method

Message ID 20260922160913.20905-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v3] Document notify as auth pending method |

Commit Message

Gert Doering Sept. 22, 2026, 4:09 p.m. UTC 
  From: Arne Schwabe <arne@rfc2549.org>

This allows a server to signal a pending authentication that does
not require any action from the user or client but can still take
a while to complete and enter the auth pending state.

Change-Id: I6217c0541bff81eefa63a987db8904b2feda2546
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1919
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1919
This mail reflects revision 3 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/doc/management-notes.txt b/doc/management-notes.txt
index 1126468..efbe757 100644
--- a/doc/management-notes.txt
+++ b/doc/management-notes.txt
@@ -794,6 +794,36 @@ 
 The client should return the response to the crtext challenge
 using the cr-response command.
 
+notify
+======
+This is notification that there might be some activity that potentially takes
+a while to finish is happening beyond the control of the client. This might be
+a server side check or an out-of-band authentication like requiring to have
+to authorise the connection on a mobile phone app. Beyond the control of
+the client is here meant in the strict sense of OpenVPN client program.
+This message still might prompt the user to look at their phone for example.
+
+The syntax of {EXTRA} for notify is:
+
+    NOTIFY:<flags>:<notify_message>
+
+<flags>: a series of optional, comma-separated flags. No flags have
+been defined yet.
+
+<notify_message>: The message to show the user to inform them about the
+ongoing authentication
+
+An example for a notify EXTRA of a server that does some checks against
+well known list of blacklists could be
+
+    NOTIFY::Please wait while your IP is checked against multiple online abuse databases.
+
+to inform the user that there is a delay in the connection attempt.
+
+Since the notify pending auth is not requiring any action on the client side
+that is required to continue the connection (unlike MFA or opening a browser)
+this message is not negotiated but can just be sent as a gratuitous message.
+
 COMMAND -- client-deny  (OpenVPN 2.1 or higher)
 -----------------------------------------------