adrienverge / openfortivpn

is there any solution to connect to fortigate if the system ask for token sent to your email when you try to connect?

I think this is one variant of the OTP feature. Even in case the fortigate otp prompt is somehow non-standard, you can supply a string to search for in the data sent by the fortigate. Once openfortivpn finds this string, it asks you to enter the code and sends it to the fortigate. The default way is to install a fortitoken app or buy hardware tokens, but depending on the authentication infrastructure already in place, there may be other variants.

Let me rephrase the author's question. Is it possible to somehow transfer the PIN/OPT to a running program without restarting? After authorization, you need to enter a PIN/OPT, which is sent to your phone via SMS.

Let me rephrase the answer to the author's question. Yes, it should be possible, but you may have to supply a specific string for openfortivpn to look for and trigger the OTP mechanism.

It all happens in auth_log_in() and the functions it calls:

openfortivpn/src/http.c

Lines 675 to 682 in 2f9ae3d

    
           /* Probably one-time password required */ 
        
           if (strncmp(res, "HTTP/1.1 401 Authorization Required\r\n", 37) == 0) { 
        
           	delay_otp(tunnel); 
        
           	ret = try_otp_auth(tunnel, res, &res, &response_size); 
        
           	if (ret != 1) 
        
           		goto end; 
        
           }

By the way, see https://github.com/adrienverge/openfortivpn/wiki#reporting-issues.

Apparently you didn't quite understand. If you start the service with the -otp=123456 parameter at the time of startup, the token is recognized and sent at the right time, but it is not known in advance. If the token is not specified at the time of launch, then an empty string is sent to the token request coins and authorization fails.

Sorry, translated via Google

Apparently you didn't quite understand. Just don't start openfortivpn with the -otp=123456 parameter.

how to launch it so that you can enter or pass the opt parameter to the program after authorization?

Just run openfortivpn. It should ask for the password and the OTP, doesn't it?

	/* Probably one-time password required */
	if (strncmp(res, "HTTP/1.1 401 Authorization Required\r\n", 37) == 0) {
	delay_otp(tunnel);

	ret = try_otp_auth(tunnel, res, &res, &response_size);
	if (ret != 1)
	goto end;
	}

dynamic token