jfc
This is a slightly unusual question, so bear with me. (Also, it's more of a client question than a server question.)
Can I force OVPN to always establish a new session if a connection drops, rather than trying to reconnect to the established session?
We've recently started using AWS Client VPN Endpoints with ActiveDirectory authentication on the back-end, and discovered an unwelcome quirk: the AWS endpoints don't seem to be "session-aware." If they receive a session token from a VPN client, they think it's a password and pass it over to the domain controller with predictable results.
And most of our users are connected to multiple (split-tunneled) VPNs at once, so when people transition between wired/wireless, they get a bunch of "password failed" messages, and then when they hit "retry" on each one, it uses their username/password to reconnect and succeeds.
Absent a fix on AWS' side, the solution seems to me to be forcing the OVPN client to always submit a username/password for authentication, and never attempt to use a session token - but I can't figure out how to do that.
Any ideas?
jfc
Strictly speaking, it's not a problem with OpenVPN - the OVPN client is doing exactly what it's supposed to, which is pass a session token (rather than the user's password) to the server if an established connection drops. I want to know if it's possible to have the client do something else instead.
The root problem is that AWS' client-facing VPN endpoints (apparently) don't handle session tokens correctly - but I can't do anything about that, so I'm trying to see if I can come up with a client-side workaround.
