My group selection is ignored in the "Connect to VPN" window

[David McCallum]

When I try to connect to my work VPN I get the following error:

AADSTS50105: Your administrator has configured the application Cisco AnyConnect Admin ('b310a2f5-bf0c-4919-ba1d-ad86190ad0c2') to block users unless they are specifically granted ('assigned') access to the application. The signed in user 'User name redacted' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.

I believe the issue is that I'm connecting to the wrong group. In the 'Connect to VPN "<vpn name>"' window, there's a dropdown with the groups my company has defined. (see attached screenshot) However, I believe my choice is being ignored and it's trying to connect to the first group in the dropdown options.

My supporting evidence is that I can get a similar error in Windows with the official Cisco client by selecting the wrong group, and I used to be able to connect with network-manager-openconnect before my company restricted access to the first group in the list.

I've found the following snippet in the network-manager-openconnect-gnome package's source code, file auth-dialog/main.c:

ui_data->combo = gtk_combo_box_text_new();
populate_vpnhost_combo(ui_data);
gtk_box_pack_start(GTK_BOX(hbox), ui_data->combo, TRUE, TRUE, 0);
g_signal_connect_swapped(ui_data->combo, "changed",
                         G_CALLBACK(queue_connect_host), ui_data);
gtk_widget_show(ui_data->combo);

I'm not familiar with the GTK framework, but I think this is the misbehaving dropdown.

lsb_release -rd
Description: Ubuntu 22.04.1 LTS
Release: 22.04

apt-cache policy network-manager-openconnect-gnome
network-manager-openconnect-gnome:
  Installed: 1.2.6-4
  Candidate: 1.2.6-4
  Version table:
 *** 1.2.6-4 500
        500 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        100 /var/lib/dpkg/status

[David McCallum (dmccallum9)]

I don't see my screenshot anywhere, so here's a direct link to it: http://www.junction404.com/group_error.png

[David McCallum (dmccallum9)]

In auth-dialog/main.c:

static int nm_process_auth_form (void *cbdata, struct oc_auth_form *form)
    ...
   if (data->entry_text) {
    openconnect_set_option_value(data->opt, data->entry_text);

I've checked, and data->entry_text is indeed set to the correct group. (This is on line 669) It looks like the correct value is being collected by the GUI and sent to the networking logic code. Though I haven't figured out where the group is actually being used.

So there goes my hope of it being a simple GUI fix.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Nate Wiebe (natew)]

I can confirm this is still happening in 22.04.