Bug 2376504 - HTTP CONNECT response: HTTP/1.1 401 Unauthorized - Cisco AnyConnect external authentication (SAML)
Summary: HTTP CONNECT response: HTTP/1.1 401 Unauthorized - Cisco AnyConnect external ...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: openconnect
Version: 42
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Nikos Mavrogiannopoulos
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-07-05 07:43 UTC by romsu
Modified: 2026-03-20 14:46 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:


Attachments (Terms of Use)
manually patched git commit 94e0b16c011b7b88708b8a8505fac6bfbe2e3cca (2.74 MB, application/octet-stream)
2025-11-17 12:01 UTC, Moritz Baumann
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Gitlab openconnect openconnect issues 659 0 None closed Got inappropriate HTTP CONNECT response: HTTP/1.1 401 Unauthorized - Cisco AnyConnect external authentication (SAML) whe... 2025-07-05 07:43:18 UTC

Description romsu 2025-07-05 07:43:18 UTC
Description of problem: got inappropriate HTTP CONNECT response: HTTP/1.1 401 Unauthorized - Cisco AnyConnect external authentication (SAML) when connecting to /CSCOSSLC/tunnel


Version-Release number of selected component (if applicable): 9.12-7


How reproducible: Add and activate a new VPN connection (Cisco AnyConnect) in NetworkManager


Steps to Reproduce:
1. Add a connection name
2. Add the gateway address
3. Add the agent name (AnyConnect)
4. Leave everything else unchanged
5. Complete SAML authentication

Actual results: HTTP/1.1 401 Unauthorized 


Expected results: successful authorization


Additional info: This issue has already been fixed in newer OpenConnect versions, which is why an update is needed.

Comment 1 Moritz Baumann 2025-11-17 12:01:54 UTC
Created attachment 2114777 [details]
manually patched git commit 94e0b16c011b7b88708b8a8505fac6bfbe2e3cca

pulled source rpm and applied this commit to it

https://gitlab.com/openconnect/openconnect/-/commit/94e0b16c011b7b88708b8a8505fac6bfbe2e3cca

We need this ( --no-external-auth) to connect against my universities cisco-annyconnect, and --no-external-auth is not exposed via NetworkManager-openconnect-gui

Comment 2 Moritz Baumann 2025-11-17 12:06:04 UTC
ok description is unclear.

The attached file is the openconnect source rpm of F43 with the git commit patch applied.

I just realized that this was filed against F42. My srpm if for F43

Comment 3 Jan Hamal Dvořák 2026-03-20 13:57:03 UTC
Hi. I am confirming the existence of the issue and this being fixed upstream.

Except in my case (SMS 2FA) back-porting just the above patch did not suffice. I had to bump to the latest master.

Comment 4 romsu 2026-03-20 14:46:03 UTC
Well, this issue still affects openconnect-9.12-9 provided in the Fedora 43 repositories.


Note You need to log in before you can comment on or make changes to this bug.