Pritunl Single sign-on timeout - Authenticating status stuck

vdevis · June 10, 2025, 11:06am

Hello team,
We continuously facing the Single sign-on timeout issue. Here are more information about the system installed here.

Pritunl version: was pritunl v1.32.4057.36, today upgraded to pritunl v1.32.4278.46. Single host, 7 servers.
MongoDB version: was 8.0.3, today upgraded to 8.0.10. Self-hosted community edition version, deployed on a separate VM in the same network as pritunl.
SSO provider - Azure
On most servers - Single-sign on should be configured.

What is the problem?

User is connecting to profile from Client app and the following is happening:

Clicking Connect button
Redirecting to browser for authenticating with Azure
Green message: Successfully authenticated connection
On client app Status is still “Authenticating”.
After some time I receive error Connection timed out on <server_name>.
There are logs:

Post "https://<PUBLIC_IP>/key/ovpn_wait/<org_id>/<user_id>/<server_id>/": context canceled
ORIGINAL STACK TRACE:
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).EncRequest
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:987 +0x1027fb614
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:545 +0x1027f8ae7
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:653 +0x1027f923b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).connectPreAuth
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:287 +0x1027f72ef
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:189 +0x1027f64ff
github.com/pritunl/pritunl-client-electron/service/connection.(*Ovpn).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/ovpn.go:107 +0x1027fd96f
github.com/pritunl/pritunl-client-electron/service/connection.(*Connection).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/connection.go:127 +0x1027fd958
github.com/pritunl/pritunl-client-electron/service/handlers.profilePost.func1
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/handlers/profile.go:148 +0x102824abb
runtime.goexit
	/opt/homebrew/Cellar/go@1.22/1.22.8/libexec/src/runtime/asm_arm64.s:1222 +0x1022b2343
[2025-06-10 13:09:11][ERRO] ▶ profile: Failed to start profile ◆ profile_id="7f2ac329a667557a"
profile: Request put error
Post "https://<PUBLIC_IP>/key/ovpn_wait/<org_id>/<user_id>/<server_id>/": context canceled
ORIGINAL STACK TRACE:
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).EncRequest
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:987 +0x1027fb614
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:545 +0x1027f8ae7
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:653 +0x1027f923b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).connectPreAuth
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:287 +0x1027f72ef
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:189 +0x1027f64ff
github.com/pritunl/pritunl-client-electron/service/connection.(*Ovpn).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/ovpn.go:107 +0x1027fd96f
github.com/pritunl/pritunl-client-electron/service/connection.(*Connection).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/connection.go:127 +0x1027fd958
github.com/pritunl/pritunl-client-electron/service/handlers.profilePost.func1
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/handlers/profile.go:148 +0x102824abb
runtime.goexit
	/opt/homebrew/Cellar/go@1.22/1.22.8/libexec/src/runtime/asm_arm64.s:1222 +0x1022b2343
[2025-06-10 13:43:51][INFO] ▶ profile: Connecting ◆ device_auth=true ◆ disable_dns=false ◆ disable_gateway=false ◆ dynamic_firewall=false ◆ force_connect=false ◆ force_dns=false ◆ geo_sort="" ◆ mode="ovpn" ◆ profile_id="7f2ac329a667557a" ◆ reconnect=true ◆ sso_auth=true
[2025-06-10 13:43:51][INFO] ▶ connection: Resolved remotes ◆ public_address="" ◆ public_address6="" ◆ remotes=[]string{"<PUBLIC_IP>"} ◆ sort_method="random"
[2025-06-10 13:43:51][INFO] ▶ connection: Attempting remote ◆ client_disconnect=false ◆ client_disconnect_waiters=0 ◆ client_disconnected=false ◆ client_provider=true ◆ client_startime=0 ◆ data_iface="" ◆ data_mode="" ◆ data_remotes=[]string{"<PUBLIC_IP>"} ◆ data_status="connecting" ◆ data_timestamp=0 ◆ data_tun_iface="" ◆ ovpn_auth_failed=false ◆ ovpn_cmd=false ◆ ovpn_connected=false ◆ ovpn_dir="" ◆ ovpn_last_auth_failed=-1 ◆ ovpn_management_pass=false ◆ ovpn_management_port=0 ◆ ovpn_path="/Applications/Pritunl.app/Contents/Resources/pritunl-openvpn" ◆ ovpn_remotes=[]string{} ◆ ovpn_running=0 ◆ ovpn_tap_iface="" ◆ profile_device_auth=true ◆ profile_disable_dns=false ◆ profile_disable_gateway=false ◆ profile_dynamic_firewall=false ◆ profile_force_connect=false ◆ profile_force_dns=false ◆ profile_geo_sort=false ◆ profile_id="7f2ac329a667557a" ◆ profile_mode="ovpn" ◆ profile_reconnect=true ◆ profile_sso_auth=true ◆ profile_system_profile=false ◆ profile_timeout=false ◆ remote="<PUBLIC_IP>" ◆ state_closed=false ◆ state_closed_waiters=0 ◆ state_deadline=false ◆ state_delay=false ◆ state_id="445e74e4e050d208" ◆ state_interactive=true ◆ state_no_reconnect=false ◆ state_stop=false ◆ state_system_interactive=false ◆ state_temp_paths=[]string{} ◆ state_time=time.Date(2025, time.June, 10, 13, 43, 51, 862947000, time.Local) ◆ wg_bash_path="/Applications/Pritunl.app/Contents/Resources/bash" ◆ wg_conf_path="" ◆ wg_conf_path2="" ◆ wg_connected=false ◆ wg_last_handshake=0 ◆ wg_path="/Applications/Pritunl.app/Contents/Resources/wg" ◆ wg_priv_key=false ◆ wg_pub_key=false ◆ wg_quick_path="/Applications/Pritunl.app/Contents/Resources/wg-quick" ◆ wg_server_pub_key=false ◆ wg_sso_start=time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC) ◆ wg_sso_token=false ◆ wg_util_path=""
[2025-06-10 13:45:23][ERRO] ▶ profile: All connection requests failed
connection: Single sign-on timeout
ORIGINAL STACK TRACE:
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:559 +0x1027f8be3
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:564 +0x1027f8c7b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).authorize
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:653 +0x1027f923b
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).connectPreAuth
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:287 +0x1027f72ef
github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/client.go:189 +0x1027f64ff
github.com/pritunl/pritunl-client-electron/service/connection.(*Ovpn).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/ovpn.go:107 +0x1027fd96f
github.com/pritunl/pritunl-client-electron/service/connection.(*Connection).Start
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/connection/connection.go:127 +0x1027fd958
github.com/pritunl/pritunl-client-electron/service/handlers.profilePost.func1
	/Users/apple/go/src/github.com/pritunl/pritunl-client-electron/service/handlers/profile.go:148 +0x102824abb
runtime.goexit

How it started?

Before upgrading to new versions we sometimes faced with this issue.
I read topics from the Pritunl forum, I understand that there is the issue with host to host messaging communication.
When I executed command sudo pritunl clear-message-cache it helped and I continued working with VPN. I was thinking it’ll be a good idea to clear messages cache by cron each day, but sometimes I was receiving this error even after few hours after running this command.

How is it going now?

I decided to upgrade Pritunl version and MongoDB version. I upgraded Pritunl from pritunl v1.32.4057.36 to pritunl v1.32.4278.46 and MongoDB version from 8.0.3 to 8.0.10.

And issue not even gone, it’s became permanent. sudo pritunl clear-message-cache doesn’t help now, I’m checking the messages collection inside the DB and it’s not cleared. There are still the same records that I had before upgrade.
I tried both: MacOS and Windows 11, not working.

I have few questions:

How to fix it and make it work again?
How to prevent such issues for the future? Maybe some MongoDB or Pritunl options that I can adjust, so it’ll not happen again?
What are the reasons for this to happen? We don’t have a lot of active users for now.

zach · June 10, 2025, 12:51pm

The context cancelled in the client logs is from an issue fixed in Pritunl Client v1.3.4275.94. With the right timing the client was cancelling the context before the response is read causing the context cancelled in the logs. It may be more common with the newer server because of the effects the changes had on the timing of the single sign-on requests.

The other single sign-on issues are caused by problems with capped collections in MongoDB. It seems to start in v7, before being fixed then started again in recent v8 releases. The issues in v8 seem to be far more common on standalone databases than in replica sets. The capped collections and tailable cursors allow creating a publish-subscribe event system that is used to send events between hosts.

One of the ways the event system is used is to notify the client that the single sign-on authentication request has been completed. If the event system doesn’t work, the connection will time out.

The latest release v1.32.4278.46 should avoid these issues with an added token sync that runs at a 3 second interval. This will allow single sign-on connections to work without the event system, although it would add up to 3 seconds to connection time.

vdevis · June 10, 2025, 1:34pm

Hey @zach
Thank you for the quick response.

I updated my Pritunl Client version to v1.3.4275.94 and it’s not working as well. I still see context canceled errors in logs.

Regarding the server version, as you can see from my initial request - I perform an upgrade today and installed the newest (I was assuming that) version of Pritunl on Ubuntu.
I used to install pritunl using apt package manager on Ubuntu and now the current version is:

pritunl-ndppd/unknown,now 0.2.5-0ubuntu1~noble amd64 [installed,automatic]
pritunl-strongswan/unknown,now 5.9.14-0ubuntu1~noble amd64 [installed,auto-removable]
pritunl/unknown,now 1.32.4258.38-0ubuntu1~noble amd64 [installed]

However, I see that in this installation the pritunl version is 1.32.4258.38 while the latest one is pritunl v1.32.4278.46 (Release pritunl v1.32.4278.46 · pritunl/pritunl · GitHub). I assume I should install it by downloading the deb package then.

I want to clarify regarding the Pritunl Client version. You mentioned the following:

The latest release v1.32.4278.46 should avoid these issues with an added token sync that runs at a 3 second interval. This will allow single sign-on connections to work without the event system, although it would add up to 3 seconds to connection time.

Does it mean that it will work only if the SERVER version also updated to the latest version?
Is it possible that it’ll not work if the client version is v1.3.4275.94, but the server version is still 1.32.4258.38? I think it may be important, because there is the following mentioning in the latest server release version: Improve connection single sign-on.

Regarding MongoDB:

The issues in v8 seem to be far more common on standalone databases than in replica sets.

Does it mean that we should ideally use MongoDB Atlas for working with Pritunl?
If not Atlas - then self-hosted one, but deployed as replica set?

zach · June 10, 2025, 2:39pm

Those are two separate issues. The cancelled context can occur with any web request made from the client. The server update does not effect compatibility with client versions.

If you updated the client verify the latest release is shown in the menu to confirm it is running the new version. It can still show context cancelled if the connection is cancelled by clicking disconnect or by some other events. If issues are still occurring with single sign-on timeouts that is likely the server side issue not the client.

The v1.32.4278.46 release is for the server not the client. If the update isn’t available run sudo dnf clean all or sudo apt clean to clear the cache before updating.

The majority of the issues are reported with MongoDB Atlas databases, using it won’t improve reliability. The shared tier Atlas databases specifically are not intended for production and will have issues.

vdevis · June 11, 2025, 8:49am

Upgrading both - Pritunl client and Pritunl server to the mentioned versions solved the problem.
Tried also to use the older version of the client with the new version of the server - works as well.

Going to perform few more tests, but for now it seems to be working.
Thank you very much @zach !