Description of problem:

Our organization uses Juniper Pulse for our VPN, with Duo Security for 2FA. If I use the openconnect command line as root to connect, it works perfectly:

$ openconnect --protocol=pulse https://vpn.example.org/it-esp
Connected to 1.2.3.4:443
SSL negotiation with vpn.example.org
Connected to HTTPS on vpn.example.org with ciphersuite (TLS1.2)-(ECDHE-SECP384R1)-(ECDSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.1 101 Switching Protocols
Enter user credentials:
Username:myusername
Password:xxxxxxxxxxxxxxxxxxx
Enter secondary credentials:
Secondary password:push

[confirm Duo Secure prompt]

Connected as 10.64.207.167, using SSL, with ESP in progress
ESP session established with server

$ openconnect --protocol=pulse https://vpn.example.org/it
Connected to 1.2.3.4:443
SSL negotiation with vpn.example.org
Connected to HTTPS on vpn.example.org with ciphersuite (TLS1.2)-(ECDHE-SECP384R1)-(ECDSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.1 101 Switching Protocols
Enter user credentials:
Username:myusername
Password:xxxxxxxxxxxxxxxxxxx
Enter secondary credentials:
Secondary password:push

[confirm Duo Secure prompt]

Set up UDP failed; using SSL instead
Connected as 10.64.207.167, using SSL, with ESP disabled

But if I configure a Pulse VPN connection in NetworkManager, using either the ESP or non-ESP URI, NetworkManager-openconnect fails to connect.  After I confirm the Duo Secure prompt, the connection dialog hangs for about 20 seconds, then vanishes (not giving me a chance to copy the log), and these errors appear in the system logs:

$ cat /etc/NetworkManager/system-connections/myvpn.nmconnection
[connection]
id=myvpn
uuid=819937ae-fbc4-4f0d-a74f-3ebce890aec4
type=vpn
autoconnect=false
permissions=user:myusername:;

[vpn]
authtype=password
autoconnect-flags=0
certsigs-flags=0
cookie-flags=2
enable_csd_trojan=no
gateway=https://vpn.example.org/it-esp
gateway-flags=2
gwcert-flags=2
lasthost-flags=0
pem_passphrase_fsid=no
prevent_invalid_cert=no
protocol=pulse
stoken_source=disabled
xmlconfig-flags=0
service-type=org.freedesktop.NetworkManager.openconnect

[vpn-secrets]
form:pulse_user:username=myusername
lasthost=https:

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto

[proxy]

$ journalctl -u NetworkManager | tail
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.2930] manager: (tun0): new Tun device (/org/freedesktop/NetworkManager/Devices/11)
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3096] device (tun0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3107] device (tun0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3111] device (tun0): Activation: starting connection 'tun0' (923923d0-6b25-4c59-a238-aa96e3da3962)
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3127] device (tun0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3128] device (tun0): state change: prepare -> config (reason 'none', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3134] device (tun0): state change: config -> ip-config (reason 'none', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3135] device (tun0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3207] device (tun0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3208] device (tun0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'external')
Jan 07 17:14:09 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593649.3212] device (tun0): Activation: successful, device activated.
Jan 07 17:14:28 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593668.4309] device (tun0): state change: activated -> unmanaged (reason 'unmanaged', sys-iface-state: 'removed')
Jan 07 17:14:42 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593682.9731] audit: op="connection-update" uuid="819937ae-fbc4-4f0d-a74f-3ebce890aec4" name="myvpn" args="vpn.data" pid=238143 uid=2000 result="success"
Jan 07 17:14:46 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593686.9434] audit: op="connection-activate" uuid="819937ae-fbc4-4f0d-a74f-3ebce890aec4" name="myvpn" pid=3498 uid=2000 result="success"
Jan 07 17:14:46 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593686.9454] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: Started the VPN service, PID 239490
Jan 07 17:14:46 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593686.9511] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: Saw the service appear; activating connection
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593725.0155] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: VPN connection: (ConnectInteractive) reply received
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593725.0171] manager: (vpn0): new Tun device (/org/freedesktop/NetworkManager/Devices/12)
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593725.0184] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: VPN plugin: state changed: starting (3)
Jan 07 17:15:25 shieldbreaker.l33tskillz.private openconnect[239536]: Connected to 1.2.3.4:443
Jan 07 17:15:25 shieldbreaker.l33tskillz.private openconnect[239536]: SSL negotiation with 1.2.3.4
Jan 07 17:15:25 shieldbreaker.l33tskillz.private openconnect[239536]: Server certificate verify failed: signer not found
Jan 07 17:15:25 shieldbreaker.l33tskillz.private openconnect[239536]: Connected to HTTPS on 1.2.3.4 with ciphersuite (TLS1.2)-(ECDHE-SECP384R1)-(ECDSA-SHA512)-(AES-256-GCM)
Jan 07 17:15:25 shieldbreaker.l33tskillz.private openconnect[239536]: Got HTTP response: HTTP/1.1 101 Switching Protocols
Jan 07 17:15:25 shieldbreaker.l33tskillz.private openconnect[239536]: Pulse authentication cookie not accepted
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[239536]: Creating SSL connection failed
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <warn>  [1641593725.2258] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: VPN plugin: failed: connect-failed (1)
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <warn>  [1641593725.2259] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: VPN plugin: failed: connect-failed (1)
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593725.2259] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: VPN plugin: state changed: stopping (5)
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593725.2260] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: VPN plugin: state changed: stopped (6)
Jan 07 17:15:25 shieldbreaker.l33tskillz.private NetworkManager[1496]: <info>  [1641593725.2264] vpn-connection[0x5564b2088740,819937ae-fbc4-4f0d-a74f-3ebce890aec4,"myvpn",0]: VPN service disappeared

The “Server certificate verify failed” error seems suspicious, but since the TLS certificate the VPN presents verifies perfectly with the openconnect command line, I don’t know why that would be the case.

For now, this is trivial to work around: I can simply run openconnect as root by hand, which works perfectly, and has since at least Fedora 33 (possibly as far back as Fedora 29).

But this is klugy. If the openconnect command line works, so should NetworkManager-openconnect. If there are additional settings that need to be specified in the NetworkManager configuration screens to make it work, it’s not obvious what those settings are, given that the openconnect command line works perfectly with just the protocol specification and the URI.

Version-Release number of selected component (if applicable):

openconnect-8.10-7.fc35.x86_64
NetworkManager-openconnect-1.2.6-8.fc35.x86_64
NetworkManager-openconnect-gnome-1.2.6-8.fc35.x86_64

Additional info:

I am a Fedora developer and packager, so I can easily rebuild RPM packages in order to test patches.

I am willing to privately provide non-redacted logs and connection information (sans passwords, of course).