No auth after openvpn SIGHUP about openvpn-auth-oauth2 HOT 8 CLOSED

The management-hold option in OpenVPN together with systemd introduces the issue here.

In general, if the connection to the management interface terminate, openvpn-auth-oauth2 terminates, too.

openvpn-auth-oauth2 does not support reconnecting. This is necessary, because if OpenVPN service is restarted, client id start from zero again. Since some refresh token are bound to client id, reconnect could result wrong authentications, if client IDs are re-used again.

If management-hold is configured, then systemd blocks the start until the state is resolved.

Since OpenVPN is a dependency of openvpn-auth-oauth2. systemd will start the openvpn-auth-oauth2 service, after the management lock is released. But the management lock will never released. Thats a deadlock.

from openvpn-auth-oauth2.

On SIGHUP, openvpn isn't restarted, so systemd doesn't see the necessity to restart openvpn-auth-oauth2. Somehow, openvpn-auth needs to restart itself... I guess forgetting all cached tokens would be sufficient, but a complete re-init would be on the safe side.

from openvpn-auth-oauth2.

But SIGHUP is documented as "hart restart", I would expect that the management connection will be terminated. Normally. openvpn-auth-oauth2 should also terminate here and restarted by systemd.

Ref: https://openvpn.net/community-resources/controlling-a-running-openvpn-process/

from openvpn-auth-oauth2.

Well that hard restart doesn't change the PID, no chance for systemd to detect.
I guess openvpn-auth-oauth2 needs to regard a "hold, waiting for release" as indication for resetting.

from openvpn-auth-oauth2.

That fine. But openvpn-auth-oauth2 should die anyways and the unit setting

should trigger if openvpn-auth-oauth2 dies.

What are the logs of openvpn-auth-oauth2?

from openvpn-auth-oauth2.

openvpn-auth-oauth2 doesn't die.
Zero syslog entry when SIGHUPing openvpn.

from openvpn-auth-oauth2.

I looked into the issue and issue a kill -HUP does not terminate the management connection. It surprises me, that SIGHUP is documented as hart restart while the connection to the managed client will be alive. I could reproduce the issue and looking forward to implement a fix.

from openvpn-auth-oauth2.

Side note:

It's not intensional that management clients are not dropped at SIGHUP, see also OpenVPN/openvpn#499 (comment)

from openvpn-auth-oauth2.