I have figured out how the webauth flow works
On the client config, I configured it to ask for username and password. This seems redundant to me, since user has to enter the credential again in SSO webpage, appreciate if anyone can point out how to launch SSO auth without this credential prompt.
On the server side, either in plugin or script of type auth-user-pass-verify,
When the user login, this plugin or script will be executed,
write the following lines to the location stated by environment variable "auth_pending_file"
300
webauth
WEB_AUTH::
https://auth.mycompany.com/login?params
first line is the timeout in seconds, although the timeout seems didn't work also, the client still timeout after 60 seconds
second line is fixed string, just keep it
third line will contains the URL to redirect the VPN user to, together with whatever URL parameters you need
afterwards store the path in environment variable "auth_control_file", which will be used later to notify OpenVPN on the auth result
finally exit the plugin or script with exit code 2, which refers to deferred authentication.
After user successfully authenticated with the SSO, you have to implement your own way to communicate the auth result to the OpenVPN server, then whatever thing on the OpenVPN server receiving the result will write either 0 (auth failed) or 1 (auth success) into the file stated by environment variable "auth_control_file", the connection process will continue after the result is written.
