duplicate-cn ineffective when combined with override-username in SSO/OAuth2 scenarios

Problem

When OpenVPN is used with OAuth2/SSO authentication (e.g., via openvpn-auth-oauth2), the duplicate-cn option becomes ineffective. Here's why:

The .ovpn config is shared across all users and contains an inline auth-user-pass block with a placeholder username — this is the recommended approach per OpenVPN documentation for SSO scenarios (see --auth-user-pass in client-options.rst):

<auth-user-pass>
username
no_password
</auth-user-pass>

Since all users share the same placeholder credentials:

• Every client connects with CN=username (the placeholder)
• duplicate-cn check runs at connect time — sees CN=username, allows the connection (it's the same CN after all)
• The plugin then sends client-auth with override-username: true, changing CN to the real user (e.g. alice)
• But by now duplicate-cn has already done its check and has no effect

Result: the same user can have multiple active OpenVPN sessions simultaneously (from different devices), with no built-in mechanism to prevent it.

Why this matters

• Orphaned sessions accumulate, consuming server resources
• No security enforcement of "one session per user"
• The workaround (duplicate-cn) exists in OpenVPN but is broken in SSO flows by design, since the real identity is only known after authentication completes

Suggested options for OpenVPN core

1. Deferred duplicate check — run duplicate-cn check after client-auth / override-username has set the final CN, not at connect time
2. client-kill on duplicate CN — when a new connection completes with a real CN that already has an active session, automatically client-kill the old one
3. duplicate-cn re-evaluation — when CN changes via management interface (client-auth with override), re-evaluate the duplicate-cn constraint

Related

• openvpn-auth-oauth2 issue #992 — same problem from auth-plugin perspective
• PR #993 — proposed kill-duplicate-username feature
• OpenVPN docs --auth-user-pass: the username-only flag and inline dummy password approach are both documented as valid SSO patterns

Trace the duplicate-cn check and the client-auth path where override-username changes the CN, including the management-interface handling mentioned in the issue. First determine which deferred check, re-evaluation, or client-kill behavior fits OpenVPN core; done means duplicate-cn reliably enforces one active session after the final username is known.