My group selection is ignored in the "Connect to VPN" window

Bug #1997277 reported by David McCallum
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
network-manager-openconnect (Ubuntu)
New
Undecided
Unassigned

Bug Description

When I try to connect to my work VPN I get the following error:

AADSTS50105: Your administrator has configured the application Cisco AnyConnect Admin ('b310a2f5-bf0c-4919-ba1d-ad86190ad0c2') to block users unless they are specifically granted ('assigned') access to the application. The signed in user 'User name redacted' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.

I believe the issue is that I'm connecting to the wrong group. In the 'Connect to VPN "<vpn name>"' window, there's a dropdown with the groups my company has defined. (see attached screenshot) However, I believe my choice is being ignored and it's trying to connect to the first group in the dropdown options.

My supporting evidence is that I can get a similar error in Windows with the official Cisco client by selecting the wrong group, and I used to be able to connect with network-manager-openconnect before my company restricted access to the first group in the list.

I've found the following snippet in the network-manager-openconnect-gnome package's source code, file auth-dialog/main.c:

ui_data->combo = gtk_combo_box_text_new();
populate_vpnhost_combo(ui_data);
gtk_box_pack_start(GTK_BOX(hbox), ui_data->combo, TRUE, TRUE, 0);
g_signal_connect_swapped(ui_data->combo, "changed",
                         G_CALLBACK(queue_connect_host), ui_data);
gtk_widget_show(ui_data->combo);

I'm not familiar with the GTK framework, but I think this is the misbehaving dropdown.

lsb_release -rd
Description: Ubuntu 22.04.1 LTS
Release: 22.04

apt-cache policy network-manager-openconnect-gnome
network-manager-openconnect-gnome:
  Installed: 1.2.6-4
  Candidate: 1.2.6-4
  Version table:
 *** 1.2.6-4 500
        500 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        100 /var/lib/dpkg/status

Revision history for this message
David McCallum (dmccallum9) wrote :

I don't see my screenshot anywhere, so here's a direct link to it: http://www.junction404.com/group_error.png

Revision history for this message
David McCallum (dmccallum9) wrote :

In auth-dialog/main.c:

static int nm_process_auth_form (void *cbdata, struct oc_auth_form *form)
    ...
   if (data->entry_text) {
    openconnect_set_option_value(data->opt, data->entry_text);

I've checked, and data->entry_text is indeed set to the correct group. (This is on line 669) It looks like the correct value is being collected by the GUI and sent to the networking logic code. Though I haven't figured out where the group is actually being used.

So there goes my hope of it being a simple GUI fix.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Related questions

Remote bug watches

Bug watches keep track of this bug in other bug trackers.