From: Arne Schwabe <[email protected]> This allows a server to signal a pending authentication that does not require any action from the user or client but can still take a while to complete and enter the auth pending state.
Change-Id: I6217c0541bff81eefa63a987db8904b2feda2546 Signed-off-by: Arne Schwabe <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1919 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1919 This mail reflects revision 3 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru <[email protected]> diff --git a/doc/management-notes.txt b/doc/management-notes.txt index 1126468..efbe757 100644 --- a/doc/management-notes.txt +++ b/doc/management-notes.txt @@ -794,6 +794,36 @@ The client should return the response to the crtext challenge using the cr-response command. +notify +====== +This is notification that there might be some activity that potentially takes +a while to finish is happening beyond the control of the client. This might be +a server side check or an out-of-band authentication like requiring to have +to authorise the connection on a mobile phone app. Beyond the control of +the client is here meant in the strict sense of OpenVPN client program. +This message still might prompt the user to look at their phone for example. + +The syntax of {EXTRA} for notify is: + + NOTIFY:<flags>:<notify_message> + +<flags>: a series of optional, comma-separated flags. No flags have +been defined yet. + +<notify_message>: The message to show the user to inform them about the +ongoing authentication + +An example for a notify EXTRA of a server that does some checks against +well known list of blacklists could be + + NOTIFY::Please wait while your IP is checked against multiple online abuse databases. + +to inform the user that there is a delay in the connection attempt. + +Since the notify pending auth is not requiring any action on the client side +that is required to continue the connection (unlike MFA or opening a browser) +this message is not negotiated but can just be sent as a gratuitous message. + COMMAND -- client-deny (OpenVPN 2.1 or higher) ----------------------------------------------- _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
