We use Google SSO for client connections. Every time we connect, Google shows its “You’re signing back in to Pritunl” page, and the user has to click Continue.
The Google sign-in URL built by auth.pritunl.com includes prompt=consent (along with access_type=offline). That makes Google ask for approval again on every sign-in, even when the user has already given it. Our other Google Workspace apps don’t send this, so they sign in without the page.
Would you consider one of these?
A setting such as app.sso_google_prompt, with options like consent (current behaviour, the default), select_account and none. Leaving the parameter out would also be fine.
If you need prompt=consent to get a refresh token from Google, only sending it on a user’s first sign-in, or when no refresh token is stored for them.
Either would remove an extra click on every VPN connect. Happy to test a build or setting.
This is intentional, when a prompt is needed it should be a full login prompt. To reduce the number of prompts use the Pritunl Authentication Cache in the top right settings. The offline OAuth verification will always be done every connection and also every 30 minutes while the user is connected. This is done with an OAuth refresh and also a check with the Google Workspace API to verify the user exists and is not disabled.
The authentication cache has a very secure design and does not store anything on the client disk. The token is only stored in memory and will be lost when the system is powered off. Additionally in the latest client release a NaCl based asymmetric signature was added to pin a temporary keypair to each token. This allows the NaCl private key to remain in the memory of the client and the data needed to reproduce a token will never leave the memory of the client process. This feature will be completed with the next server release.