Recognise auth forms named "challenge" as token requests

This was found in the wild on an AnyConnect instance which is hooked up
to a Microsoft 2FA platform.

Signed-off-by: James Laird-Wah <james-oc@laird-wah.net>

diff --git a/auth.c b/auth.c
index 83c186d3af830711fb2a3496878d4a804349d176..e476775508c4ba365df29210c0970970f3dcb4d0 100644 (file)
--- a/auth.c
+++ b/auth.c
@@ -893,7 +893,8 @@ static int cstp_can_gen_tokencode(struct openconnect_info *vpninfo,
        }
 #endif
        /* Otherwise it's an OATH token of some kind. */
-       if (strcmp(opt->name, "secondary_password"))
+       if (strcmp(opt->name, "secondary_password") &&
+        (!form->auth_id || strcmp(form->auth_id, "challenge")))
                return -EINVAL;
 
        return can_gen_tokencode(vpninfo, form, opt);