Options error: --verify-client-cert none|optional must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin

[jkroepke]

IMPORTANT NOTE
Bugs about OpenVPN Access Server, OpenVPN Connect or any other product by OpenVPN Inc. should be directly reported to OpenVPN Inc. at https://support.openvpn.net

Describe the bug

While testing #299 I got the note that the server can't start because of an configuration issue:

Options error: --verify-client-cert none|optional must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin

To Reproduce
Download the following docker-compose.yaml and run docker compose up. The used server configuration can be seen here: https://github.com/jkroepke/openvpn-auth-oauth2/blob/85baba40dfb65fc62f8f25e8e84f39d293b901f8/tests/docker-compose.yaml#L65-L106

Expected behavior
If verify-client-cert none and management-client-auth is set in the configuration, the error should not appear.

Version information (please complete the following information):

• OS: Ubuntu 24.04
• OpenVPN version: master (6bb20fa)

Additional context
Seems like it worked before db48cea

[schwabe]

Yeah it looks like the clean up commit db48cea of accidentially added a negetion in the check in line 2754 of options.c.

   if (!options->auth_user_pass_verify_script
            || PLUGIN_OPTION_LIST(options)
            || MAN_CLIENT_AUTH_ENABLED(options))

Can you remove the ! and see if that fixes the problem for you?

[jkroepke]

I change it to this:

         if (options->auth_user_pass_verify_script
             || PLUGIN_OPTION_LIST(options)
             || MAN_CLIENT_AUTH_ENABLED(options))

but still the same error.

[schwabe]

Can you try this fix? https://gerrit.openvpn.net/c/openvpn/+/912

[jkroepke]

OpenVPN 2.7_git [git:HEAD/ca2f496faa8947a6]

works for me.