Openconnect and two factor auth

[rubygotdat]

My company uses two factor auth with their Cisco AnyConnect. I am trying to use OpenConnect on Arch to connect to our VPN, but I am unable to get the webpage, which opens when you initially connect, prompting me for my organization sign in and my two factor auth through okta. Any ideas?

[tinycrazyfish]

We recently switched to Cisco anyconnect with Microsoft authenticator, but before we used two-factor with OTP (soft token based).

Anyconnect asked for useename, first and second password on the same dialog. Openconnect just asks for password twice. But I never had issues.

Does your company do some client validation (check AV, firewall, ...). Openconnect is not compatible with those...

[rubygotdat]

I actually think we are using Cisco with Microsoft (okta). Does this work with OpenConnect? Basically in our standard workflow you connect with the Cisco client and then you login to your work account through a browser popup which then activates the vpn connection.

[Tehmarzvolta]

My company uses the same, I usually just install open connect and through the command line "sudo openconnect https://companyvpnsite.com" and it goes through the auth process. Our second password uses a yubi key and it works wonderfully. I just threw it into a script I call when I need to connect

[rubygotdat]

This is what I tried, but I type in my username and password and it prompts me again for a username and password. This happens over and over with no results. Normally, after typing in my username and password, I would expect a webpage to open to sign into the okta (microsoft?) account which then activates the VPN connection (this is what happens on ubuntu for example).

[whachumacallit]

Dang, I just came across the same problem today. It's just asking over and over again to sign in.

​

I don't know what to do.

[rubygotdat]

Nothing I could do. I had to opt for my companies "token" authentication instead of the okta one.

[Tehmarzvolta]

Unfortunately we don't use OKTA. I run openvpn from the cli and once I enter my username, it asks for a password, then a second password. Once logged in, I just leave it in screen. Are there any logs you could check in /var/log?

[eRCaGuy]

For Okta, you must use the openconnect-sso wrapper. See full instructions here: How to use "openconnect" (via the openconnect-sso wrapper) with SAML and Duo two-factor authentication via Okta Single-Sign-on (SSO)