I retried again. This time a group named DEFAULT shown, I picked that and everything works fine now. Thank you Nikos. sskaje http://sskaje.me/ sskaje at gmail.com ? 2014?8?29??15:08?sskaje <sskaje at gmail.com> ??? > Forget to reply all. > > ? 2014?8?29??15:05?sskaje <sskaje at gmail.com> ??? > >> Nicos, >> I pulled your latest commit and changed config: >> >> # grep group /opt/ocserv/etc/config |grep -v '^#' >> cert-group-oid = 2.5.4.11 >> run-as-group = daemon >> config-per-group = /opt/ocserv/etc/config-per-group/ >> default-group-config = /opt/ocserv/etc/defaults/group.conf >> select-group = vpn >> select-group = dnsonly >> default-select-group = DEFAULT >> auto-select-group = true >> >> >> auto-select-group was set both true and false for testing, same result. >> >> Then I removed all mobileconfig on iPhone and remove Cisco AnyConnect App, then installed both. >> >> The first time I tried to establish connection on cn=sskaje, a group selection was prompted again, and this time I picked group=vpn, connected. >> Disconnect and choose to connect with cn=dnsonly, failed. >> error: >> >> >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Accept: */* >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Accept-Encoding: identity >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-Transcend-Version: 1 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-Transcend-Version: 1 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-ClientVersion: 3.0.09440 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-Platform: apple-ios >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-PlatformVersion: 7.1.2 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-DeviceType: iPhone6,2 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-Device-UniqueID: UIDUIDUIDUID >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-Aggregate-Auth: 1 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Connection: close >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Content-Length: 353 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Content-Type: application/x-www-form-urlencoded >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP POST / >> ocserv[5568]: worker: IPIPIPIP:18887 POST body: '<?xml version="1.0" encoding="UTF-8"?> >> <config-auth client="vpn" type="init"> >> <device-id platform-version="7.1.2" device-type="iPhone6,2" unique-id="UIDUIDUIDUID">apple-ios</device-id> >> <version who="vpn">3.0.09440</version> >> <group-select>vpn</group-select> >> <group-access>https://sskaje.me:PORT/</group-access> >> </config-auth> >> ' >> ocserv[5568]: TLS[<2>]: ASSERT: common.c:1792 >> ocserv[5568]: TLS[<2>]: ASSERT: dn.c:310 >> ocserv[5568]: TLS[<2>]: ASSERT: dn.c:420 >> ocserv[5568]: TLS[<2>]: ASSERT: x509.c:507 >> ocserv[5568]: worker: IPIPIPIP:18887 sending message 'sm: auth init' to secmod >> ocserv[5550]: sec-mod: received request from pid 5568 and uid 65534 >> ocserv[5550]: sec-mod: cmd [size=47] sm: auth init >> ocserv[5550]: sec-mod: user '' requested group 'vpn' but is not included on his certificate groups >> ocserv[5550]: sec-mod: error processing data for 'sm: auth init' command (-1) >> ocserv[5568]: common.c:316: recvmsg returned zero >> ocserv[5568]: worker: IPIPIPIP:18887 worker-auth.c:684: error receiving auth reply message >> ocserv[5568]: worker: IPIPIPIP:18887 worker-auth.c:1236: failed authentication for '' >> ocserv[5568]: TLS[<4>]: REC[0x176b060]: Preparing Packet Application Data(23) with length: 62 and min pad: 0 >> ocserv[5568]: TLS[<9>]: ENC[0x176b060]: cipher: AES-128-CBC, MAC: SHA1, Epoch: 1 >> >> .... >> >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Accept: */* >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Accept-Encoding: identity >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-Transcend-Version: 1 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-Transcend-Version: 1 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-ClientVersion: 3.0.09440 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-Platform: apple-ios >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-PlatformVersion: 7.1.2 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-DeviceType: iPhone6,2 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-AnyConnect-Identifier-Device-UniqueID: UIDUIDUIDUID >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: X-Aggregate-Auth: 1 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Connection: close >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Content-Length: 353 >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP: Content-Type: application/x-www-form-urlencoded >> ocserv[5568]: worker: IPIPIPIP:18887 HTTP POST / >> ocserv[5568]: worker: IPIPIPIP:18887 POST body: '<?xml version="1.0" encoding="UTF-8"?> >> <config-auth client="vpn" type="init"> >> <device-id platform-version="7.1.2" device-type="iPhone6,2" unique-id="UIDUIDUIDUID">apple-ios</device-id> >> <version who="vpn">3.0.09440</version> >> <group-select>vpn</group-select> >> <group-access>https://sskaje.me:PORT/</group-access> >> </config-auth> >> ' >> ocserv[5568]: TLS[<2>]: ASSERT: common.c:1792 >> ocserv[5568]: TLS[<2>]: ASSERT: dn.c:310 >> ocserv[5568]: TLS[<2>]: ASSERT: dn.c:420 >> ocserv[5568]: TLS[<2>]: ASSERT: x509.c:507 >> ocserv[5568]: worker: IPIPIPIP:18887 sending message 'sm: auth init' to secmod >> ocserv[5550]: sec-mod: received request from pid 5568 and uid 65534 >> ocserv[5550]: sec-mod: cmd [size=47] sm: auth init >> ocserv[5550]: sec-mod: user '' requested group 'vpn' but is not included on his certificate groups >> ocserv[5550]: sec-mod: error processing data for 'sm: auth init' command (-1) >> ocserv[5568]: common.c:316: recvmsg returned zero >> ocserv[5568]: worker: IPIPIPIP:18887 worker-auth.c:684: error receiving auth reply message >> ocserv[5568]: worker: IPIPIPIP:18887 worker-auth.c:1236: failed authentication for '' >> ocserv[5568]: TLS[<4>]: REC[0x176b060]: Preparing Packet Application Data(23) with length: 62 and min pad: 0 >> ocserv[5568]: TLS[<9>]: ENC[0x176b060]: cipher: AES-128-CBC, MAC: SHA1, Epoch: 1 >> >> .... >> >> ocserv[5569]: worker: IPIPIPIP:18930 HTTP: X-AnyConnect-Identifier-DeviceType: iPhone6,2 >> ocserv[5569]: worker: IPIPIPIP:18930 HTTP: X-AnyConnect-Identifier-Device-UniqueID: UIDUIDUIDUID >> ocserv[5569]: worker: IPIPIPIP:18930 HTTP: X-Aggregate-Auth: 1 >> ocserv[5569]: worker: IPIPIPIP:18930 HTTP: Connection: close >> ocserv[5569]: worker: IPIPIPIP:18930 HTTP: Content-Length: 353 >> ocserv[5569]: worker: IPIPIPIP:18930 HTTP: Content-Type: application/x-www-form-urlencoded >> ocserv[5569]: worker: IPIPIPIP:18930 HTTP POST / >> ocserv[5569]: worker: IPIPIPIP:18930 POST body: '<?xml version="1.0" encoding="UTF-8"?> >> <config-auth client="vpn" type="init"> >> <device-id platform-version="7.1.2" device-type="iPhone6,2" unique-id="UIDUIDUIDUID">apple-ios</device-id> >> <version who="vpn">3.0.09440</version> >> <group-select>vpn</group-select> >> <group-access>https://sskaje.me:PORT/</group-access> >> </config-auth> >> ' >> ocserv[5569]: TLS[<2>]: ASSERT: common.c:1792 >> ocserv[5569]: TLS[<2>]: ASSERT: dn.c:310 >> ocserv[5569]: TLS[<2>]: ASSERT: dn.c:420 >> ocserv[5569]: TLS[<2>]: ASSERT: x509.c:507 >> ocserv[5569]: worker: IPIPIPIP:18930 sending message 'sm: auth init' to secmod >> ocserv[5550]: sec-mod: received request from pid 5569 and uid 65534 >> ocserv[5550]: sec-mod: cmd [size=47] sm: auth init >> ocserv[5550]: sec-mod: user '' requested group 'vpn' but is not included on his certificate groups >> ocserv[5550]: sec-mod: error processing data for 'sm: auth init' command (-1) >> ocserv[5569]: common.c:316: recvmsg returned zero >> ocserv[5569]: worker: IPIPIPIP:18930 worker-auth.c:684: error receiving auth reply message >> ocserv[5569]: worker: IPIPIPIP:18930 worker-auth.c:1236: failed authentication for '' >> ocserv[5569]: TLS[<4>]: REC[0x176b060]: Preparing Packet Application Data(23) with length: 62 and min pad: 0 >> >> >> >> sskaje >> http://sskaje.me/ >> sskaje at gmail.com >> >> >> >> ? 2014?8?29??14:34?Nikos Mavrogiannopoulos <n.mavrogiannopoulos at gmail.com> ??? >> >>> On Thu, Aug 28, 2014 at 10:22 AM, sskaje <sskaje at gmail.com> wrote: >>>> Nikos, >>>> I have these in my config file: >>>> >>>> # grep group /opt/ocserv/etc/config |grep -v '^#' >>>> cert-group-oid = 2.5.4.11 >>>> run-as-group = daemon >>>> config-per-group = /opt/ocserv/etc/config-per-group/ >>>> default-group-config = /opt/ocserv/etc/defaults/group.conf >>>> select-group = vpn >>>> select-group = dnsonly >>>> default-select-group = vpn >>> ^^^^^ >>> >>> I believe the above is what causes the issue. I've tried to clarified >>> what default-select-group is in the documentation. It is a virtual >>> group that allows a user to select the default assigned to him (in >>> case he belongs to multiple groups). The way you use it shouldn't do >>> any harm however, but it had the bug you noticed. It should be fixed >>> in the master branch now though. >>> >>> regards, >>> Nikos >> >
