Okta-Pritunl deprovisioning

[ppn]

Hi,
We have Pritunl Enterprice connected with Okta via Pritunl app in Okta.

Some of our employees use OpenVPN Connect, some Pritunl Client.
Correct workflow of deactivation the user who connected with Pritunl client:

1. User in Okta deactivated,
2. Active Pritunl VPN connection drops and user can’t connect to our VPN,
3. Profit.

Incorrect workflow with OpenVPN Connect:

1. User in Okta deactivated,
2. Active OpenVPN Connect connection still active and healthy. Only when the user manually disconnects, they can’t reconnect. Update: default time is 60 minutes (app.sso_connection_check_ttl)

Right now I have only ability to manually drop connection by deleting him or push “Disable and disconnect user” button in admin dashboard.

Can it somehow be configured to automatically drop active connections when employee deactivated in Okta?

Thanks!

[ppn]

Pritunl v1.32.3504.68

Pritunl v1.32.3504.68 has been released. This update adds device authentication, Python 3.9, improved single sign-on verification and improved web server security. Device Authentication [device_auth1] Device authentication is a new authentication factor that utilizes the client TPM or Apple Secure Enclave. When a user connects to a server with device authentication for the first time the user will be prompted to contact an administrator with a pin to approve the users physical device. This p…

I found this in release notes, and the question is - can it be changed to less than 30 minutes?

[ppn]

Solved by executing this command:

sudo pritunl set app.sso_connection_check_ttl xxxxx

where xxxxx - time in seconds.

Actual setting can be checked with this command:

sudo pritunl get app.sso_connection_check_ttl

[zach]

The single sign-on check during connection is only available in recent releases. This will re-sync the single sign-on user status at the interval set by app.sso_connection_check_ttl. It is enabled by default at a 1 hour interval. Reducing this interval may cause API limit errors from the single sign-on provider.