Repository: jkroepke/openvpn-auth-oauth2 (go)

Issue:
Non interactive refresh don't work since last version
### Current Behavior

I made an update from 1.19 to 1.21.
Since, non interactive refresh don't work.

### Expected Behavior

Each time client reconnect, he have to login again on auth provider, instead of being reconnected automatically.
It was ok on 1.19

### Steps To Reproduce

```Markdown
This is my config.yaml :
  refresh:
    enabled: true
    expires: 8h0m0s
    secret: "9v(...)qu"
    use-session-id: false
    validate-user: false

OpenVPN conf :
# Management options
management localhost 2080
# oauth2 authentication
management-client-auth
auth-user-pass-optional
reneg-sec 28800
auth-gen-token 28800 external-auth
```


### Environment

- openvpn-auth-oauth2 Version: 1.21.0
- OpenVPN Server Version: 2.6
- Server OS: Ubuntu
- OpenVPN Client (flavor, OS): Windows Client, Community Edition
- OIDC Provider: Azure AD


### openvpn-auth-oauth2 logs

```shell
- Some confidential data have been replaced by [...]
- 17:03 : First connection with interactive login : OK
- 17:04 : Second connection, have to be autoreconnected but not.


Apr 22 17:03:25 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:25.272Z level=DEBUG msg=">CLIENT:CONNECT,0,1\r\n>CLIENT:ENV,n_clients=0\r\n>CLIENT:ENV,password=\r\n>CLIENT:ENV,session_id=H2ap7euZd5703VA1\r\n>CLIENT:ENV,session_state=Initial\r\n>CLIENT:ENV,untrusted_port=60081\r\n>CLIENT:ENV,untrusted_ip=[...]\r\n>CLIENT:ENV,common_name=[...]\r\n>CLIENT:ENV,username=\r\n>CLIENT:ENV,IV_SSO=openurl,webauth,crtext\r\n>CLIENT:ENV,IV_GUI_VER=OpenVPN_GUI_11\r\n>CLIENT:ENV,IV_PROTO=990\r\n>CLIENT:ENV,IV_CIPHERS=AES-256-GCM:AES-128-GCM\r\n>CLIENT:ENV,IV_NCP=2\r\n>CLIENT:ENV,IV_MTU=1600\r\n>CLIENT:ENV,IV_TCPNL=1\r\n>CLIENT:ENV,IV_PLAT=win\r\n>CLIENT:ENV,IV_VER=2.6.5\r\n>CLIENT:ENV,tls_serial_hex_0=92:8b:a4:1b:47:f5:a9:5b:5d:e3:5f:95:0d:06:97:31\r\n>CLIENT:ENV,tls_serial_0=194792345124539867531883968029476165425\r\n>CLIENT:ENV,tls_digest_sha256_0=e3:04:61:d2:4b:68:40:a2:f4:5f:72:70:72:4e:96:52:d9:ad:ae:bf:98:cf:74:15:3c:23:8e:cf:06:5d:2c:49\r\n>CLIENT:ENV,tls_digest_0=45:e4:b2:dd:22:ab:d3:fc:2b:e5:71:f6:72:4c:c9:a1:37:7b:fd:63\r\n>CLIENT:ENV,tls_id_0=C=FR, ST=PA, L=Paris, O=[...], OU=Support IT, CN=[...], emailAddress=[...]\r\n>CLIENT:ENV,X509_0_emailAddress=[...]\r\n>CLIENT:ENV,X509_0_CN=[...]\r\n>CLIENT:ENV,X509_0_OU=Support IT\r\n>CLIENT:ENV,X509_0_O=[...]\r\n>CLIENT:ENV,X509_0_L=Paris\r\n>CLIENT:ENV,X509_0_ST=PA\r\n>CLIENT:ENV,X509_0_C=FR\r\n>CLIENT:ENV,tls_serial_hex_1=20:d6:a0:5d:32:f1:e5:4f:ce:ed:87:de:34:d2:1e:51:07:ec:25:e7\r\n>CLIENT:ENV,tls_serial_1=187474033818575017741507640741621240645322286567\r\n>CLIENT:ENV,tls_digest_sha256_1=eb:25:1e:8d:9b:64:40:a2:10:6a:37:dc:69:ef:8f:94:3c:a5:31:13:d1:ae:d0:b5:de:35:dc:38:df:6f:ae:7e\r\n>CLIENT:ENV,tls_digest_1=b7:df:68:22:ae:0d:9c:f5:4a:34:7f:ad:5e:39:d7:c4:e2:8a:7b:4c\r\n>CLIENT:ENV,tls_id_1=CN=Easy-RSA CA\r\n>CLIENT:ENV,X509_1_CN=Easy-RSA CA\r\n>CLIENT:ENV,remote_port_1=16194\r\n>CLIENT:ENV,local_port_1=16194\r\n>CLIENT:ENV,proto_1=udp\r\n>CLIENT:ENV,daemon_pid=807\r\n>CLIENT:ENV,daemon_start_time=1713805308\r\n>CLIENT:ENV,daemon_log_redirect=1\r\n>CLIENT:ENV,daemon=1\r\n>CLIENT:ENV,verb=3\r\n>CLIENT:ENV,config=/etc/openvpn/server.conf\r\n>CLIENT:ENV,ifconfig_local=[...].10.1\r\n>CLIENT:ENV,ifconfig_netmask=255.255.255.0\r\n>CLIENT:ENV,route_net_gateway=[...]\r\n>CLIENT:ENV,route_vpn_gateway=[...].10.2\r\n>CLIENT:ENV,route_network_1=[...].10.0\r\n>CLIENT:ENV,route_netmask_1=255.255.255.0\r\n>CLIENT:ENV,route_gateway_1=[...].10.2\r\n>CLIENT:ENV,script_context=init\r\n>CLIENT:ENV,tun_mtu=1500\r\n>CLIENT:ENV,dev=tun0\r\n>CLIENT:ENV,dev_type=tun\r\n>CLIENT:ENV,redirect_gateway=0\r\n>CLIENT:ENV,END\r\n"
Apr 22 17:03:25 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:25.272Z level=INFO msg="new client connection" ip=[...]:60081 cid=0 kid=1 common_name=[...] reason=CONNECT session_id=H2ap7euZd5703VA1 session_state=Initial
Apr 22 17:03:25 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:25.272Z level=INFO msg="start pending auth" ip=[...]:60081 cid=0 kid=1 common_name=[...] reason=CONNECT session_id=H2ap7euZd5703VA1 session_state=Initial
Apr 22 17:03:25 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:25.272Z level=DEBUG msg="client-pending-auth 0 1 \"WEB_AUTH::https://[...]:9000/oauth2/start?state=R2XPAkEV3Bg9Pcfe8Hd45hPnyrpfZrn-1MquevDJvDD6YPN_4UVZWBuMiitV7AP7ifDO4lktJgtuqCuTT-jjG6cj6UaKGwYV0TuGWUmsvluDXwF0wG0xI8TszKqFaS_PITv8npyw\" 120"
Apr 22 17:03:25 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:25.557Z level=ERROR msg="http: TLS handshake error from [...]:53301: remote error: tls: unknown certificate"
Apr 22 17:03:25 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:25.626Z level=ERROR msg="http: TLS handshake error from [...]:53302: remote error: tls: unknown certificate"
Apr 22 17:03:25 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:25.691Z level=INFO msg="initialize authorization via oauth2" ip=[...]:60081 cid=0 kid=1 common_name=[...]
Apr 22 17:03:34 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:34.577Z level=ERROR msg="http: TLS handshake error from [...]:53312: remote error: tls: unknown certificate"
Apr 22 17:03:34 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:34.888Z level=WARN msg="provider did not return a id_token. Validation of user data is not possible." ip=[...]:60081 cid=0 kid=1 session_id=H2ap7euZd5703VA1 common_name=[...]
Apr 22 17:03:34 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:34.888Z level=INFO msg="successful authorization via oauth2" ip=[...]:60081 cid=0 kid=1 session_id=H2ap7euZd5703VA1 common_name=[...] user.subject="" user.preferred_username=""
Apr 22 17:03:34 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:34.888Z level=INFO msg="accept OpenVPN client cid 0, kid 1" ip=[...]:60081 cid=0 kid=1 session_id=H2ap7euZd5703VA1 common_name=[...] user.subject="" user.preferred_username=""
Apr 22 17:03:34 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:34.889Z level=DEBUG msg="client-auth 0 1\r\npush \"auth-token-user Z3JlZ29yeS5idXJnZUBtZXRhdm9uaWNzLmNvbQ==\"\r\nEND"
Apr 22 17:03:36 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:36.634Z level=DEBUG msg=">CLIENT:ADDRESS,0,[...].[...]1,1\r\n>CLIENT:ESTABLISHED,0\r\n>CLIENT:ENV,n_clients=1\r\n>CLIENT:ENV,ifconfig_pool_netmask=255.255.255.0\r\n>CLIENT:ENV,ifconfig_pool_remote_ip=[...].[...]1\r\n>CLIENT:ENV,time_unix=1713805405\r\n>CLIENT:ENV,time_ascii=2024-04-22 17:03:25\r\n>CLIENT:ENV,trusted_port=60081\r\n>CLIENT:ENV,trusted_ip=[...]\r\n>CLIENT:ENV,common_name=[...]\r\n>CLIENT:ENV,session_id=H2ap7euZd5703VA1\r\n>CLIENT:ENV,session_state=Initial\r\n>CLIENT:ENV,untrusted_port=60081\r\n>CLIENT:ENV,untrusted_ip=[...]\r\n>CLIENT:ENV,username=\r\n>CLIENT:ENV,IV_SSO=openurl,webauth,crtext\r\n>CLIENT:ENV,IV_GUI_VER=OpenVPN_GUI_11\r\n>CLIENT:ENV,IV_PROTO=990\r\n>CLIENT:ENV,IV_CIPHERS=AES-256-GCM:AES-128-GCM\r\n>CLIENT:ENV,IV_NCP=2\r\n>CLIENT:ENV,IV_MTU=1600\r\n>CLIENT:ENV,IV_TCPNL=1\r\n>CLIENT:ENV,IV_PLAT=win\r\n>CLIENT:ENV,IV_VER=2.6.5\r\n>CLIENT:ENV,tls_serial_hex_0=92:8b:a4:1b:47:f5:a9:5b:5d:e3:5f:95:0d:06:97:31\r\n>CLIENT:ENV,tls_serial_0=194792345124539867531883968029476165425\r\n>CLIENT:ENV,tls_digest_sha256_0=e3:04:61:d2:4b:68:40:a2:f4:5f:72:70:72:4e:96:52:d9:ad:ae:bf:98:cf:74:15:3c:23:8e:cf:06:5d:2c:49\r\n>CLIENT:ENV,tls_digest_0=45:e4:b2:dd:22:ab:d3:fc:2b:e5:71:f6:72:4c:c9:a1:37:7b:fd:63\r\n>CLIENT:ENV,tls_id_0=C=FR, ST=PA, L=Paris, O=[...], OU=Support IT, CN=[...], emailAddress=[...]\r\n>CLIENT:ENV,X509_0_emailAddress=[...]\r\n>CLIENT:ENV,X509_0_CN=[...]\r\n>CLIENT:ENV,X509_0_OU=Support IT\r\n>CLIENT:ENV,X509_0_O=[...]\r\n>CLIENT:ENV,X509_0_L=Paris\r\n>CLIENT:ENV,X509_0_ST=PA\r\n>CLIENT:ENV,X509_0_C=FR\r\n>CLIENT:ENV,tls_serial_hex_1=20:d6:a0:5d:32:f1:e5:4f:ce:ed:87:de:34:d2:1e:51:07:ec:25:e7\r\n>CLIENT:ENV,tls_serial_1=187474033818575017741507640741621240645322286567\r\n>CLIENT:ENV,tls_digest_sha256_1=eb:25:1e:8d:9b:64:40:a2:10:6a:37:dc:69:ef:8f:94:3c:a5:31:13:d1:ae:d0:b5:de:35:dc:38:df:6f:ae:7e\r\n>CLIENT:ENV,tls_digest_1=b7:df:68:22:ae:0d:9c:f5:4a:34:7f:ad:5e:39:d7:c4:e2:8a:7b:4c\r\n>CLIENT:ENV,tls_id_1=CN=Easy-RSA CA\r\n>CLIENT:ENV,X509_1_CN=Easy-RSA CA\r\n>CLIENT:ENV,remote_port_1=16194\r\n>CLIENT:ENV,local_port_1=16194\r\n>CLIENT:ENV,proto_1=udp\r\n>CLIENT:ENV,daemon_pid=807\r\n>CLIENT:ENV,daemon_start_time=1713805308\r\n>CLIENT:ENV,daemon_log_redirect=1\r\n>CLIENT:ENV,daemon=1\r\n>CLIENT:ENV,verb=3\r\n>CLIENT:ENV,config=/etc/openvpn/server.conf\r\n>CLIENT:ENV,ifconfig_local=[...].10.1\r\n>CLIENT:ENV,ifconfig_netmask=255.255.255.0\r\n>CLIENT:ENV,route_net_gateway=[...]\r\n>CLIENT:ENV,route_vpn_gateway=[...].10.2\r\n>CLIENT:ENV,route_network_1=[...].10.0\r\n>CLIENT:ENV,route_netmask_1=255.255.255.0\r\n>CLIENT:ENV,route_gateway_1=[...].10.2\r\n>CLIENT:ENV,script_context=init\r\n>CLIENT:ENV,tun_mtu=1500\r\n>CLIENT:ENV,dev=tun0\r\n>CLIENT:ENV,dev_type=tun\r\n>CLIENT:ENV,redirect_gateway=0\r\n>CLIENT:ENV,END\r\n"
Apr 22 17:03:36 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:03:36.634Z level=INFO msg="client established" ip=[...]:60081 vpn_ip=[...].[...]1 cid=0 common_name=[...] reason=ESTABLISHED session_id=H2ap7euZd5703VA1 session_state=Initial
Apr 22 17:04:00 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:04:00.705Z level=DEBUG msg=">CLIENT:CONNECT,1,1\r\n>CLIENT:ENV,n_clients=1\r\n>CLIENT:ENV,password=SESS_ID_AT_H2ap7euZd5703VA1AAAAAGYmmF0AAAAAZiaYXd8EjWrxfm9Q0pXOrUNiNW/Hm4/BUt57JMwyjX8W9Zk1\r\n>CLIENT:ENV,session_id=H2ap7euZd5703VA1\r\n>CLIENT:ENV,session_state=AuthenticatedEmptyUser\r\n>CLIENT:ENV,untrusted_port=55052\r\n>CLIENT:ENV,untrusted_ip=[...]\r\n>CLIENT:ENV,common_name=[...]\r\n>CLIENT:ENV,username=\r\n>CLIENT:ENV,IV_SSO=openurl,webauth,crtext\r\n>CLIENT:ENV,IV_GUI_VER=OpenVPN_GUI_11\r\n>CLIENT:ENV,IV_PROTO=990\r\n>CLIENT:ENV,IV_CIPHERS=AES-256-GCM:AES-128-GCM\r\n>CLIENT:ENV,IV_NCP=2\r\n>CLIENT:ENV,IV_MTU=1600\r\n>CLIENT:ENV,IV_TCPNL=1\r\n>CLIENT:ENV,IV_PLAT=win\r\n>CLIENT:ENV,IV_VER=2.6.5\r\n>CLIENT:ENV,tls_serial_hex_0=92:8b:a4:1b:47:f5:a9:5b:5d:e3:5f:95:0d:06:97:31\r\n>CLIENT:ENV,tls_serial_0=194792345124539867531883968029476165425\r\n>CLIENT:ENV,tls_digest_sha256_0=e3:04:61:d2:4b:68:40:a2:f4:5f:72:70:72:4e:96:52:d9:ad:ae:bf:98:cf:74:15:3c:23:8e:cf:06:5d:2c:49\r\n>CLIENT:ENV,tls_digest_0=45:e4:b2:dd:22:ab:d3:fc:2b:e5:71:f6:72:4c:c9:a1:37:7b:fd:63\r\n>CLIENT:ENV,tls_id_0=C=FR, ST=PA, L=Paris, O=[...], OU=Support IT, CN=[...], emailAddress=[...]\r\n>CLIENT:ENV,X509_0_emailAddress=[...]\r\n>CLIENT:ENV,X509_0_CN=[...]\r\n>CLIENT:ENV,X509_0_OU=Support IT\r\n>CLIENT:ENV,X509_0_O=[...]\r\n>CLIENT:ENV,X509_0_L=Paris\r\n>CLIENT:ENV,X509_0_ST=PA\r\n>CLIENT:ENV,X509_0_C=FR\r\n>CLIENT:ENV,tls_serial_hex_1=20:d6:a0:5d:32:f1:e5:4f:ce:ed:87:de:34:d2:1e:51:07:ec:25:e7\r\n>CLIENT:ENV,tls_serial_1=187474033818575017741507640741621240645322286567\r\n>CLIENT:ENV,tls_digest_sha256_1=eb:25:1e:8d:9b:64:40:a2:10:6a:37:dc:69:ef:8f:94:3c:a5:31:13:d1:ae:d0:b5:de:35:dc:38:df:6f:ae:7e\r\n>CLIENT:ENV,tls_digest_1=b7:df:68:22:ae:0d:9c:f5:4a:34:7f:ad:5e:39:d7:c4:e2:8a:7b:4c\r\n>CLIENT:ENV,tls_id_1=CN=Easy-RSA CA\r\n>CLIENT:ENV,X509_1_CN=Easy-RSA CA\r\n>CLIENT:ENV,remote_port_1=16194\r\n>CLIENT:ENV,local_port_1=16194\r\n>CLIENT:ENV,proto_1=udp\r\n>CLIENT:ENV,daemon_pid=807\r\n>CLIENT:ENV,daemon_start_time=1713805308\r\n>CLIENT:ENV,daemon_log_redirect=1\r\n>CLIENT:ENV,daemon=1\r\n>CLIENT:ENV,verb=3\r\n>CLIENT:ENV,config=/etc/openvpn/server.conf\r\n>CLIENT:ENV,ifconfig_local=[...].10.1\r\n>CLIENT:ENV,ifconfig_netmask=255.255.255.0\r\n>CLIENT:ENV,route_net_gateway=[...]\r\n>CLIENT:ENV,route_vpn_gateway=[...].10.2\r\n>CLIENT:ENV,route_network_1=[...].10.0\r\n>CLIENT:ENV,route_netmask_1=255.255.255.0\r\n>CLIENT:ENV,route_gateway_1=[...].10.2\r\n>CLIENT:ENV,script_context=init\r\n>CLIENT:ENV,tun_mtu=1500\r\n>CLIENT:ENV,dev=tun0\r\n>CLIENT:ENV,dev_type=tun\r\n>CLIENT:ENV,redirect_gateway=0\r\n>CLIENT:ENV,END\r\n"
Apr 22 17:04:00 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:04:00.705Z level=INFO msg="new client connection" ip=[...]:55052 cid=1 kid=1 common_name=[...] reason=CONNECT session_id=H2ap7euZd5703VA1 session_state=AuthenticatedEmptyUser
Apr 22 17:04:00 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:04:00.705Z level=INFO msg="start pending auth" ip=[...]:55052 cid=1 kid=1 common_name=[...] reason=CONNECT session_id=H2ap7euZd5703VA1 session_state=AuthenticatedEmptyUser
Apr 22 17:04:00 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:04:00.705Z level=DEBUG msg="client-pending-auth 1 1 \"WEB_AUTH::https://[...]:9000/oauth2/start?state=IysrLgLhauO0787IPJ71ANzpsVOd21nQ4rc94r3wzipYpGUSvIDek_Gf61MznQyR_ve4IIQY882e2sdwkpgg1Ef4FAwF97yQNTFXfD09etDc102sZQLuPLotSIM6bVghG1vWi9sH\" 120"
Apr 22 17:04:01 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:04:01.785Z level=ERROR msg="http: TLS handshake error from [...]:65086: remote error: tls: unknown certificate"
Apr 22 17:04:01 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:04:01.854Z level=INFO msg="initialize authorization via oauth2" ip=[...]:55052 cid=1 kid=1 common_name=[...]
Apr 22 17:05:59 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:05:59.343Z level=DEBUG msg=">CLIENT:DISCONNECT,0\r\n>CLIENT:ENV,time_duration=154\r\n>CLIENT:ENV,bytes_sent=3897\r\n>CLIENT:ENV,bytes_received=11888\r\n>CLIENT:ENV,trusted_port=60081\r\n>CLIENT:ENV,trusted_ip=[...]\r\n>CLIENT:ENV,ifconfig_pool_netmask=255.255.255.0\r\n>CLIENT:ENV,ifconfig_pool_remote_ip=[...].[...]1\r\n>CLIENT:ENV,time_unix=1713805405\r\n>CLIENT:ENV,time_ascii=2024-04-22 17:03:25\r\n>CLIENT:ENV,common_name=[...]\r\n>CLIENT:ENV,session_id=H2ap7euZd5703VA1\r\n>CLIENT:ENV,session_state=Initial\r\n>CLIENT:ENV,untrusted_port=60081\r\n>CLIENT:ENV,untrusted_ip=[...]\r\n>CLIENT:ENV,username=\r\n>CLIENT:ENV,IV_SSO=openurl,webauth,crtext\r\n>CLIENT:ENV,IV_GUI_VER=OpenVPN_GUI_11\r\n>CLIENT:ENV,IV_PROTO=990\r\n>CLIENT:ENV,IV_CIPHERS=AES-256-GCM:AES-128-GCM\r\n>CLIENT:ENV,IV_NCP=2\r\n>CLIENT:ENV,IV_MTU=1600\r\n>CLIENT:ENV,IV_TCPNL=1\r\n>CLIENT:ENV,IV_PLAT=win\r\n>CLIENT:ENV,IV_VER=2.6.5\r\n>CLIENT:ENV,tls_serial_hex_0=92:8b:a4:1b:47:f5:a9:5b:5d:e3:5f:95:0d:06:97:31\r\n>CLIENT:ENV,tls_serial_0=194792345124539867531883968029476165425\r\n>CLIENT:ENV,tls_digest_sha256_0=e3:04:61:d2:4b:68:40:a2:f4:5f:72:70:72:4e:96:52:d9:ad:ae:bf:98:cf:74:15:3c:23:8e:cf:06:5d:2c:49\r\n>CLIENT:ENV,tls_digest_0=45:e4:b2:dd:22:ab:d3:fc:2b:e5:71:f6:72:4c:c9:a1:37:7b:fd:63\r\n>CLIENT:ENV,tls_id_0=C=FR, ST=PA, L=Paris, O=[...], OU=Support IT, CN=[...], emailAddress=[...]\r\n>CLIENT:ENV,X509_0_emailAddress=[...]\r\n>CLIENT:ENV,X509_0_CN=[...]\r\n>CLIENT:ENV,X509_0_OU=Support IT\r\n>CLIENT:ENV,X509_0_O=[...]\r\n>CLIENT:ENV,X509_0_L=Paris\r\n>CLIENT:ENV,X509_0_ST=PA\r\n>CLIENT:ENV,X509_0_C=FR\r\n>CLIENT:ENV,tls_serial_hex_1=20:d6:a0:5d:32:f1:e5:4f:ce:ed:87:de:34:d2:1e:51:07:ec:25:e7\r\n>CLIENT:ENV,tls_serial_1=187474033818575017741507640741621240645322286567\r\n>CLIENT:ENV,tls_digest_sha256_1=eb:25:1e:8d:9b:64:40:a2:10:6a:37:dc:69:ef:8f:94:3c:a5:31:13:d1:ae:d0:b5:de:35:dc:38:df:6f:ae:7e\r\n>CLIENT:ENV,tls_digest_1=b7:df:68:22:ae:0d:9c:f5:4a:34:7f:ad:5e:39:d7:c4:e2:8a:7b:4c\r\n>CLIENT:ENV,tls_id_1=CN=Easy-RSA CA\r\n>CLIENT:ENV,X509_1_CN=Easy-RSA CA\r\n>CLIENT:ENV,remote_port_1=16194\r\n>CLIENT:ENV,local_port_1=16194\r\n>CLIENT:ENV,proto_1=udp\r\n>CLIENT:ENV,daemon_pid=807\r\n>CLIENT:ENV,daemon_start_time=1713805308\r\n>CLIENT:ENV,daemon_log_redirect=1\r\n>CLIENT:ENV,daemon=1\r\n>CLIENT:ENV,verb=3\r\n>CLIENT:ENV,config=/etc/openvpn/server.conf\r\n>CLIENT:ENV,ifconfig_local=[...].10.1\r\n>CLIENT:ENV,ifconfig_netmask=255.255.255.0\r\n>CLIENT:ENV,route_net_gateway=[...]\r\n>CLIENT:ENV,route_vpn_gateway=[...].10.2\r\n>CLIENT:ENV,route_network_1=[...].10.0\r\n>CLIENT:ENV,route_netmask_1=255.255.255.0\r\n>CLIENT:ENV,route_gateway_1=[...].10.2\r\n>CLIENT:ENV,script_context=init\r\n>CLIENT:ENV,tun_mtu=1500\r\n>CLIENT:ENV,dev=tun0\r\n>CLIENT:ENV,dev_type=tun\r\n>CLIENT:ENV,redirect_gateway=0\r\n>CLIENT:ENV,END\r\n"
Apr 22 17:05:59 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:05:59.344Z level=INFO msg="client disconnected" ip=[...]:60081 cid=0 common_name=[...] reason=DISCONNECT session_id=H2ap7euZd5703VA1 session_state=Initial
Apr 22 17:06:08 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:06:08.604Z level=DEBUG msg=">CLIENT:DISCONNECT,1\r\n>CLIENT:ENV,END\r\n"
Apr 22 17:06:08 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:06:08.604Z level=INFO msg="client disconnected" ip=: cid=1 common_name="" reason=DISCONNECT session_id="" session_state=""
Apr 22 17:06:08 [...] openvpn-auth-oauth2[840]: time=2024-04-22T17:06:08.605Z level=WARN msg="error from token store: value does not exist" ip=: cid=1 common_name="" reason=DISCONNECT session_id="" session_state=""
```


### openvpn server logs

```shell
2024-04-22 17:03:25 SENT CONTROL [[...]]: 'INFO_PRE,WEB_AUTH::https://[...]:9000/oauth2/start?state=R2XPAkEV3Bg9Pcfe8Hd45hPnyrpfZrn-1MquevDJvDD6YPN_4UVZWBuMiitV7AP7ifDO4lktJgtuqCuTT-jjG6cj6UaKGwYV0TuGWUmsvluDXwF0wG0xI8TszKqFaS_PITv8npyw' (status=1)
2024-04-22 17:03:25 [...]:60081 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bits RSA, signature: ecdsa-with-SHA256, peer temporary key: 253 bits X25519
2024-04-22 17:03:25 [...]:60081 [[...]] Peer Connection Initiated with [AF_INET][...]:60081
2024-04-22 17:03:26 [...]:60081 PUSH: Received control message: 'PUSH_REQUEST'
2024-04-22 17:03:31 [...]:60081 PUSH: Received control message: 'PUSH_REQUEST'
2024-04-22 17:03:34 MANAGEMENT: CMD 'client-auth 0 1'
2024-04-22 17:03:36 [...]:60081 PUSH: Received control message: 'PUSH_REQUEST'
2024-04-22 17:03:36 [...]/[...]:60081 MULTI_sva: pool returned IPv4=[...].[...]1, IPv6=(Not enabled)
2024-04-22 17:03:36 [...]/[...]:60081 MULTI: Learn: [...].[...]1 -> [...]/[...]:60081
2024-04-22 17:03:36 [...]/[...]:60081 MULTI: primary virtual IP for [...]/[...]:60081: [...].[...]1
2024-04-22 17:03:36 [...]/[...]:60081 SENT CONTROL [[...]]: 'PUSH_REPLY,route [...].20.0 255.255.255.0,dhcp-option DNS [...].[...],dhcp-option DOMAIN intra,route-gateway [...].10.1,topology subnet,ping 10,ping-restart 60,auth-token-user Z3JlZ29yeS5idXJnZUBtZXRhdm9uaWNzLmNvbQ==,ifconfig [...].[...]1 255.255.255.0,peer-id 0,auth-tokenSESS_ID,cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500' (status=1)
2024-04-22 17:03:37 [...]/[...]:60081 Data Channel: cipher 'AES-256-GCM', peer-id: 0
2024-04-22 17:03:37 [...]/[...]:60081 Timers: ping 10, ping-restart 120
2024-04-22 17:03:37 [...]/[...]:60081 Protocol options: explicit-exit-notify 1, protocol-flags cc-exit tls-ekm dyn-tls-crypt
2024-04-22 17:04:00 [...]:55052 WARNING: Failed to stat CRL file, not reloading CRL.
2024-04-22 17:04:00 [...]:55052 WARNING: Failed to stat CRL file, not reloading CRL.
2024-04-22 17:04:00 [...]:55052 VERIFY OK: depth=1, CN=Easy-RSA CA
2024-04-22 17:04:00 [...]:55052 VERIFY KU OK
2024-04-22 17:04:00 [...]:55052 Validating certificate extended key usage
2024-04-22 17:04:00 [...]:55052 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
2024-04-22 17:04:00 [...]:55052 VERIFY EKU OK
2024-04-22 17:04:00 [...]:55052 VERIFY OK: depth=0, C=FR, ST=PA, L=Paris, O=[...], OU=Support IT, CN=[...], emailAddress=[...]
2024-04-22 17:04:00 [...]:55052 peer info: IV_VER=2.6.5
2024-04-22 17:04:00 [...]:55052 peer info: IV_PLAT=win
2024-04-22 17:04:00 [...]:55052 peer info: IV_TCPNL=1
2024-04-22 17:04:00 [...]:55052 peer info: IV_MTU=1600
2024-04-22 17:04:00 [...]:55052 peer info: IV_NCP=2
2024-04-22 17:04:00 [...]:55052 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
2024-04-22 17:04:00 [...]:55052 peer info: IV_PROTO=990
2024-04-22 17:04:00 [...]:55052 peer info: IV_GUI_VER=OpenVPN_GUI_11
2024-04-22 17:04:00 [...]:55052 peer info: IV_SSO=openurl,webauth,crtext
2024-04-22 17:04:00 [...]:55052 TLS: Username/Password authentication deferred for username ''
2024-04-22 17:04:00 [...]:55052 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
2024-04-22 17:04:00 [...]:55052 WARNING: Failed to stat CRL file, not reloading CRL.
2024-04-22 17:04:00 [...]:55052 TLS: tls_multi_process: initial untrusted session promoted to semi-trusted
2024-04-22 17:04:00 MANAGEMENT: CMD 'client-pending-auth 1 1 "WEB_AUTH::https://[...]:9000/oauth2/start?state=IysrLgLhauO0787IPJ71ANzpsVOd21nQ4rc94r3wzipYpGUSvIDek_Gf61MznQyR_ve4IIQY882e2sdwkpgg1Ef4FAwF97yQNTFXfD09etDc102sZQLuPLotSIM6bVghG1vWi9sH" 120'
2024-04-22 17:04:00 SENT CONTROL [[...]]: 'AUTH_PENDING,timeout 120' (status=1)
2024-04-22 17:04:00 SENT CONTROL [[...]]: 'INFO_PRE,WEB_AUTH::https://[...]:9000/oauth2/start?state=IysrLgLhauO0787IPJ71ANzpsVOd21nQ4rc94r3wzipYpGUSvIDek_Gf61MznQyR_ve4IIQY882e2sdwkpgg1Ef4FAwF97yQNTFXfD09etDc102sZQLuPLotSIM6bVghG1vWi9sH' (status=1)
2024-04-22 17:04:00 [...]:55052 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bits RSA, signature: ecdsa-with-SHA256, peer temporary key: 253 bits X25519
2024-04-22 17:04:00 [...]:55052 [[...]] Peer Connection Initiated with [AF_INET][...]:55052
2024-04-22 17:04:01 [...]:55052 PUSH: Received control message: 'PUSH_REQUEST'
2024-04-22 17:04:05 [...]:55052 PUSH: Received control message: 'PUSH_REQUEST'
2024-04-22 17:04:11 [...]:55052 PUSH: Received control message: 'PUSH_REQUEST'
2024-04-22 17:04:16 [...]:55052 PUSH: Received control message: 'PUSH_REQUEST'
2024-04-22 17:05:59 [...]/[...]:60081 [[...]] Inactivity timeout (--ping-restart), restarting
2024-04-22 17:05:59 [...]/[...]:60081 SIGUSR1[soft,ping-restart] received, client-instance restarting
2024-04-22 17:06:03 [...]:55052 Delayed exit in 5 seconds
2024-04-22 17:06:03 [...]:55052 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
2024-04-22 17:06:03 [...]:55052 SENT CONTROL [[...]]: 'AUTH_FAILED' (status=1)
2024-04-22 17:06:08 [...]:55052 SIGTERM[soft,delayed-exit] received, client-instance exiting
```


### Anything else?

I had many trouble with enhanced security and apparmor. 
Apparmor don't show error anymore.

Thanks for your help

Pull request:
fix: do not set auth-token-user, if username is given
#### What this PR does / why we need it

#### Which issue this PR fixes

*(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

- fixes #251

#### Special notes for your reviewer

#### Particularly user-facing changes

#### Checklist

Complete these before marking the PR as `ready to review`:

<!-- [Place an '[x]' (no spaces) in all applicable fields.] -->

- [ ] [DCO](https://github.com/prometheus-community/helm-charts/blob/main/CONTRIBUTING.md#sign-off-your-work) signed
- [ ] The PR title has a summary of the changes
- [ ] The PR body has a summary to reflect any significant (and particularly user-facing) changes introduced by this PR


Patch:
diff --git a/docs/Configuration.md b/docs/Configuration.md
index 7e30171..05dc707 100644
--- a/docs/Configuration.md
+++ b/docs/Configuration.md
@@ -87,7 +87,7 @@ oauth2:
         validate-user: true
 openvpn:
     addr: "unix:///run/openvpn/server.sock"
-    auth-token-user: true
+    auth-token-user: false
     auth-pending-timeout: 2m
     bypass:
         # common-names:
@@ -197,7 +197,7 @@ Usage of openvpn-auth-oauth2:
   --openvpn.auth-pending-timeout duration
     	How long OpenVPN server wait until user is authenticated (env: CONFIG_OPENVPN_AUTH__PENDING__TIMEOUT) (default 3m0s)
   --openvpn.auth-token-user
-    	Define auth-token-user for all sessions (env: CONFIG_OPENVPN_AUTH__TOKEN__USER) (default true)
+    	Override the username of a session with the username from the token by using auth-token-user, if the client username is empty (env: CONFIG_OPENVPN_AUTH__TOKEN__USER) (default true)
   --openvpn.bypass.common-names value
     	bypass oauth authentication for CNs. Comma separated list. (env: CONFIG_OPENVPN_BYPASS_COMMON__NAMES)
   --openvpn.common-name.environment-variable string
diff --git a/go.mod b/go.mod
index c18b0a3..713e1a1 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/madflojo/testcerts v1.1.1
 	github.com/stretchr/testify v1.9.0
 	github.com/zitadel/logging v0.6.0
-	github.com/zitadel/oidc/v3 v3.23.2
+	github.com/zitadel/oidc/v3 v3.24.0
 	golang.org/x/net v0.25.0
 	golang.org/x/oauth2 v0.20.0
 	golang.org/x/text v0.15.0
@@ -25,7 +25,7 @@ require (
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/go-chi/chi/v5 v5.0.12 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.2 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
diff --git a/go.sum b/go.sum
index b6726eb..5874e34 100644
--- a/go.sum
+++ b/go.sum
@@ -10,8 +10,8 @@ github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nos
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/go-chi/chi/v5 v5.0.12 h1:9euLV5sTrTNTRUU9POmDUvfxyj6LAABLUcEWO+JJb4s=
 github.com/go-chi/chi/v5 v5.0.12/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-jose/go-jose/v4 v4.0.1 h1:QVEPDE3OluqXBQZDcnNvQrInro2h0e4eqNbnZSWqS6U=
-github.com/go-jose/go-jose/v4 v4.0.1/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
+github.com/go-jose/go-jose/v4 v4.0.2 h1:R3l3kkBds16bO7ZFAEEcofK0MkrAJt3jlJznWZG0nvk=
+github.com/go-jose/go-jose/v4 v4.0.2/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -71,8 +71,8 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/zitadel/logging v0.6.0 h1:t5Nnt//r+m2ZhhoTmoPX+c96pbMarqJvW1Vq6xFTank=
 github.com/zitadel/logging v0.6.0/go.mod h1:Y4CyAXHpl3Mig6JOszcV5Rqqsojj+3n7y2F591Mp/ow=
-github.com/zitadel/oidc/v3 v3.23.2 h1:vRUM6SKudr6WR/lqxue4cvCbgR+IdEJGVBklucKKXgk=
-github.com/zitadel/oidc/v3 v3.23.2/go.mod h1:9snlhm3W/GNURqxtchjL1AAuClWRZ2NTkn9sLs1WYfM=
+github.com/zitadel/oidc/v3 v3.24.0 h1:TK2qUpVoX0A8Rd0Z9/1jxf+/nm5gstRKReIEG808xCI=
+github.com/zitadel/oidc/v3 v3.24.0/go.mod h1:A6rYWOlTb/FtvZvUP8tl2wRCJ+wXMovfwcX80yXjMZQ=
 github.com/zitadel/schema v1.3.0 h1:kQ9W9tvIwZICCKWcMvCEweXET1OcOyGEuFbHs4o5kg0=
 github.com/zitadel/schema v1.3.0/go.mod h1:NptN6mkBDFvERUCvZHlvWmmME+gmZ44xzwRXwhzsbtc=
 go.opentelemetry.io/otel v1.26.0 h1:LQwgL5s/1W7YiiRwxf03QGnWLb2HW4pLiAhaA5cZXBs=
diff --git a/internal/config/flags.go b/internal/config/flags.go
index 931d349..e16d2c2 100644
--- a/internal/config/flags.go
+++ b/internal/config/flags.go
@@ -155,7 +155,7 @@ func flagSetOpenVPN(flagSet *flag.FlagSet) {
 	flagSet.Bool(
 		"openvpn.auth-token-user",
 		Defaults.OpenVpn.AuthTokenUser,
-		"Define auth-token-user for all sessions",
+		"Override the username of a session with the username from the token by using auth-token-user, if the client username is empty",
 	)
 	flagSet.Duration(
 		"openvpn.auth-pending-timeout",
diff --git a/internal/openvpn/callbacks.go b/internal/openvpn/callbacks.go
index 0fb8067..b283f02 100644
--- a/internal/openvpn/callbacks.go
+++ b/internal/openvpn/callbacks.go
@@ -13,7 +13,7 @@ func (c *Client) AcceptClient(logger *slog.Logger, client state.ClientIdentifier
 
 	var err error
 
-	if c.conf.OpenVpn.AuthTokenUser {
+	if c.conf.OpenVpn.AuthTokenUser && client.UsernameIsDefined == 0 {
 		tokenUsername := base64.StdEncoding.EncodeToString([]byte(username))
 		_, err = c.SendCommandf("client-auth %d %d\r\npush \"auth-token-user %s\"\r\nEND", client.CID, client.KID, tokenUsername)
 	} else {
diff --git a/internal/openvpn/connection/client.go b/internal/openvpn/connection/client.go
index 8abf067..37894d2 100644
--- a/internal/openvpn/connection/client.go
+++ b/internal/openvpn/connection/client.go
@@ -9,16 +9,17 @@ import (
 )
 
 type Client struct {
-	KID          uint64
-	CID          uint64
-	Reason       string
-	IPAddr       string
-	IPPort       string
-	VPNAddress   string
-	CommonName   string
-	SessionID    string
-	SessionState string
-	IvSSO        string
+	KID               uint64
+	CID               uint64
+	Reason            string
+	IPAddr            string
+	IPPort            string
+	VPNAddress        string
+	CommonName        string
+	UsernameIsDefined int
+	SessionID         string
+	SessionState      string
+	IvSSO             string
 }
 
 func NewClient(conf config.Config, message string) (Client, error) { //nolint:cyclop
@@ -57,12 +58,17 @@ func NewClient(conf config.Config, message string) (Client, error) { //nolint:cy
 				client.IPPort = envValue
 			case conf.OpenVpn.CommonName.EnvironmentVariableName:
 				client.CommonName = envValue
+				if conf.OpenVpn.CommonName.EnvironmentVariableName == "username" {
+					client.UsernameIsDefined = 1
+				}
 			case "IV_SSO":
 				client.IvSSO = envValue
 			case "session_id":
 				client.SessionID = envValue
 			case "session_state":
 				client.SessionState = envValue
+			case "username":
+				client.UsernameIsDefined = 1
 			}
 		case client.Reason == "" && isClientReason(line):
 			client.Reason, client.CID, client.KID, err = parseClientReason(line)
diff --git a/internal/state/state.go b/internal/state/state.go
index 3afb637..3b51541 100644
--- a/internal/state/state.go
+++ b/internal/state/state.go
@@ -23,6 +23,7 @@ type ClientIdentifier struct {
 	CID                  uint64
 	KID                  uint64
 	SessionID            string
+	UsernameIsDefined    int
 	AuthFailedReasonFile string
 	AuthControlFile      string
 }
@@ -64,6 +65,7 @@ func (state *State) decode(encodedState, secretKey string) error {
 		&state.Client.AuthFailedReasonFile,
 		&state.Client.AuthControlFile,
 		&state.Client.SessionID,
+		&state.Client.UsernameIsDefined,
 		&state.IPAddr,
 		&state.IPPort,
 		&state.CommonName,
@@ -105,6 +107,8 @@ func (state *State) Encode(secretKey string) (string, error) {
 	data.WriteString(" ")
 	data.WriteString(encodeString(state.Client.SessionID))
 	data.WriteString(" ")
+	data.WriteString(strconv.Itoa(state.Client.UsernameIsDefined))
+	data.WriteString(" ")
 	data.WriteString(encodeString(state.IPAddr))
 	data.WriteString(" ")
 	data.WriteString(encodeString(state.IPPort))
diff --git a/pkg/plugin/go.mod b/pkg/plugin/go.mod
index 107d370..caaeade 100644
--- a/pkg/plugin/go.mod
+++ b/pkg/plugin/go.mod
@@ -7,7 +7,7 @@ require github.com/jkroepke/openvpn-auth-oauth2 v0.0.0-00000000000000-0000000000
 require (
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.2 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.0.0-alpha.1 // indirect
@@ -25,7 +25,7 @@ require (
 	github.com/muhlemmer/gu v0.3.1 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/zitadel/logging v0.6.0 // indirect
-	github.com/zitadel/oidc/v3 v3.23.2 // indirect
+	github.com/zitadel/oidc/v3 v3.24.0 // indirect
 	github.com/zitadel/schema v1.3.0 // indirect
 	go.opentelemetry.io/otel v1.26.0 // indirect
 	go.opentelemetry.io/otel/metric v1.26.0 // indirect
diff --git a/pkg/plugin/go.sum b/pkg/plugin/go.sum
index b5843f2..4f711db 100644
--- a/pkg/plugin/go.sum
+++ b/pkg/plugin/go.sum
@@ -9,8 +9,8 @@ github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nos
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/go-chi/chi/v5 v5.0.12 h1:9euLV5sTrTNTRUU9POmDUvfxyj6LAABLUcEWO+JJb4s=
 github.com/go-chi/chi/v5 v5.0.12/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-jose/go-jose/v4 v4.0.1 h1:QVEPDE3OluqXBQZDcnNvQrInro2h0e4eqNbnZSWqS6U=
-github.com/go-jose/go-jose/v4 v4.0.1/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
+github.com/go-jose/go-jose/v4 v4.0.2 h1:R3l3kkBds16bO7ZFAEEcofK0MkrAJt3jlJznWZG0nvk=
+github.com/go-jose/go-jose/v4 v4.0.2/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -70,8 +70,8 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/zitadel/logging v0.6.0 h1:t5Nnt//r+m2ZhhoTmoPX+c96pbMarqJvW1Vq6xFTank=
 github.com/zitadel/logging v0.6.0/go.mod h1:Y4CyAXHpl3Mig6JOszcV5Rqqsojj+3n7y2F591Mp/ow=
-github.com/zitadel/oidc/v3 v3.23.2 h1:vRUM6SKudr6WR/lqxue4cvCbgR+IdEJGVBklucKKXgk=
-github.com/zitadel/oidc/v3 v3.23.2/go.mod h1:9snlhm3W/GNURqxtchjL1AAuClWRZ2NTkn9sLs1WYfM=
+github.com/zitadel/oidc/v3 v3.24.0 h1:TK2qUpVoX0A8Rd0Z9/1jxf+/nm5gstRKReIEG808xCI=
+github.com/zitadel/oidc/v3 v3.24.0/go.mod h1:A6rYWOlTb/FtvZvUP8tl2wRCJ+wXMovfwcX80yXjMZQ=
 github.com/zitadel/schema v1.3.0 h1:kQ9W9tvIwZICCKWcMvCEweXET1OcOyGEuFbHs4o5kg0=
 github.com/zitadel/schema v1.3.0/go.mod h1:NptN6mkBDFvERUCvZHlvWmmME+gmZ44xzwRXwhzsbtc=
 go.opentelemetry.io/otel v1.26.0 h1:LQwgL5s/1W7YiiRwxf03QGnWLb2HW4pLiAhaA5cZXBs=


Test patch:
diff --git a/internal/oauth2/handler_test.go b/internal/oauth2/handler_test.go
index 78b17f1..2d333d0 100644
--- a/internal/oauth2/handler_test.go
+++ b/internal/oauth2/handler_test.go
@@ -25,11 +25,11 @@ func TestHandler(t *testing.T) {
 	tests := []struct {
 		name          string
 		conf          config.Config
-		ipaddr        string
+		state         state.State
+		invalidState  bool
 		xForwardedFor string
 		preAllow      bool
 		postAllow     bool
-		state         string
 	}{
 		{
 			"default",
@@ -56,11 +56,42 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.1",
+			state.New(state.ClientIdentifier{CID: 0, KID: 1}, "127.0.0.1", "12345", "name"),
+			false,
+			"",
+			true,
+			true,
+		},
+		{
+			"with username defined",
+			config.Config{
+				HTTP: config.HTTP{
+					Secret: testutils.Secret,
+					Check: config.HTTPCheck{
+						IPAddr: false,
+					},
+				},
+				OAuth2: config.OAuth2{
+					Provider:  "generic",
+					Endpoints: config.OAuth2Endpoints{},
+					Scopes:    []string{"openid", "profile"},
+					Validate: config.OAuth2Validate{
+						Groups: make([]string, 0),
+						Roles:  make([]string, 0),
+						Issuer: true,
+						IPAddr: false,
+					},
+				},
+				OpenVpn: config.OpenVpn{
+					Bypass:        config.OpenVpnBypass{CommonNames: []string{}},
+					AuthTokenUser: true,
+				},
+			},
+			state.New(state.ClientIdentifier{CID: 0, KID: 1, UsernameIsDefined: 1}, "127.0.0.1", "12345", "name"),
+			false,
 			"",
 			true,
 			true,
-			"-",
 		},
 		{
 			"with acr values",
@@ -90,11 +121,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.1",
+			state.New(state.ClientIdentifier{CID: 0, KID: 1}, "127.0.0.1", "12345", "name"),
+			false,
 			"",
 			true,
 			false,
-			"-",
 		},
 		{
 			"with template",
@@ -122,11 +153,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.1",
+			state.New(state.ClientIdentifier{CID: 0, KID: 1}, "127.0.0.1", "12345", "name"),
+			false,
 			"",
 			true,
 			true,
-			"-",
 		},
 		{
 			"with ipaddr",
@@ -153,11 +184,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.1",
+			state.New(state.ClientIdentifier{CID: 0, KID: 1}, "127.0.0.1", "12345", "name"),
+			false,
 			"",
 			true,
 			true,
-			"-",
 		},
 		{
 			"with ipaddr + forwarded-for",
@@ -185,11 +216,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.2",
+			state.New(state.ClientIdentifier{CID: 0, KID: 1}, "127.0.0.2", "12345", "name"),
+			false,
 			"127.0.0.2",
 			true,
 			true,
-			"-",
 		},
 		{
 			"with ipaddr + disabled forwarded-for",
@@ -217,11 +248,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.2",
+			state.New(state.ClientIdentifier{CID: 0, KID: 1}, "127.0.0.2", "12345", "name"),
+			false,
 			"127.0.0.2",
 			false,
 			false,
-			"-",
 		},
 		{
 			"with ipaddr + multiple forwarded-for",
@@ -249,11 +280,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.2",
+			state.New(state.ClientIdentifier{CID: 0, KID: 1}, "127.0.0.2", "12345", "name"),
+			false,
 			"127.0.0.2, 8.8.8.8",
 			true,
 			true,
-			"-",
 		},
 		{
 			"with empty state",
@@ -281,11 +312,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.1",
+			state.State{},
+			false,
 			"127.0.0.1",
 			true,
 			true,
-			"",
 		},
 		{
 			"with invalid state",
@@ -313,11 +344,11 @@ func TestHandler(t *testing.T) {
 					AuthTokenUser: true,
 				},
 			},
-			"127.0.0.1",
+			state.State{},
+			true,
 			"127.0.0.1",
 			true,
 			true,
-			"test",
 		},
 	}
 
@@ -349,7 +380,7 @@ func TestHandler(t *testing.T) {
 
 				testutils.ExpectVersionAndReleaseHold(t, managementInterfaceConn, reader)
 
-				if tt.state != "-" {
+				if tt.state == (state.State{}) {
 					return
 				}
 
@@ -358,6 +389,8 @@ func TestHandler(t *testing.T) {
 					testutils.ExpectMessage(t, managementInterfaceConn, reader, `client-deny 0 1 "http client ip 127.0.0.1 and vpn ip 127.0.0.2 is different."`)
 				case !tt.postAllow:
 					testutils.ExpectMessage(t, managementInterfaceConn, reader, `client-deny 0 1 "client rejected"`)
+				case tt.state.Client.UsernameIsDefined == 1:
+					testutils.ExpectMessage(t, managementInterfaceConn, reader, "client-auth-nt 0 1")
 				default:
 					testutils.ExpectMessage(t, managementInterfaceConn, reader, "client-auth 0 1\r\npush \"auth-token-user aWQx\"\r\nEND")
 				}
@@ -384,14 +417,18 @@ func TestHandler(t *testing.T) {
 
 				time.Sleep(time.Millisecond * 100)
 
-				var err error
-
-				session := tt.state
-
-				if tt.state == "-" {
-					sessionState := state.New(state.ClientIdentifier{CID: 0, KID: 1}, tt.ipaddr, "12345", "name")
-					session, err = sessionState.Encode(tt.conf.HTTP.Secret.String())
+				var (
+					session string
+					err     error
+				)
 
+				switch {
+				case tt.invalidState:
+					session = "invalid"
+				case tt.state == (state.State{}):
+					session = ""
+				default:
+					session, err = tt.state.Encode(tt.conf.HTTP.Secret.String())
 					if !assert.NoError(t, err) {
 						return
 					}
@@ -426,7 +463,7 @@ func TestHandler(t *testing.T) {
 
 				resp.Body.Close()
 
-				if tt.state != "-" {
+				if tt.state == (state.State{}) {
 					assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 
 					return
diff --git a/internal/openvpn/connection/client_test.go b/internal/openvpn/connection/client_test.go
index aa42d86..f458aad 100644
--- a/internal/openvpn/connection/client_test.go
+++ b/internal/openvpn/connection/client_test.go
@@ -38,7 +38,7 @@ func TestNewClientConnection(t *testing.T) {
 				CID: 0, KID: 1, Reason: "CONNECT", CommonName: "common_name",
 				IPAddr: "127.0.0.1", IPPort: "12345",
 				VPNAddress: "127.0.1.1", IvSSO: "webauth",
-				SessionID: "K3waLcCGyUuzkdXh",
+				SessionID: "K3waLcCGyUuzkdXh", UsernameIsDefined: 1,
 			},
 			"",
 		},
@@ -55,7 +55,8 @@ func TestNewClientConnection(t *testing.T) {
 				">CLIENT:ENV,END",
 			},
 			connection.Client{
-				CID: 0, KID: 1, Reason: "CONNECT", CommonName: "common_name", IPAddr: "::1", IvSSO: "webauth", SessionID: "K3waLcCGyUuzkdXh",
+				CID: 0, KID: 1, Reason: "CONNECT", CommonName: "common_name",
+				IPAddr: "::1", IvSSO: "webauth", SessionID: "K3waLcCGyUuzkdXh", UsernameIsDefined: 1,
 			},
 			"",
 		},
@@ -76,7 +77,7 @@ func TestNewClientConnection(t *testing.T) {
 				">CLIENT:ENV,END",
 			},
 			connection.Client{
-				CID: 0, KID: 1, Reason: "CONNECT", CommonName: "username", IPAddr: "127.0.0.1", IvSSO: "webauth",
+				CID: 0, KID: 1, Reason: "CONNECT", CommonName: "username", IPAddr: "127.0.0.1", IvSSO: "webauth", UsernameIsDefined: 1,
 			},
 			"",
 		},