@@ -1194,6 +1194,12 @@ tls_multi_free (struct tls_multi *multi, bool clear)

   cert_hash_free (multi->locked_cert_hash_set);

+  if (multi->auth_token)

+    {

+      memset (multi->auth_token, 0, AUTH_TOKEN_SIZE);

+      free (multi->auth_token);

+    }

+

   for (i = 0; i < TM_SIZE; ++i)

     tls_session_free (&multi->session[i], false);

@@ -351,6 +351,9 @@ struct tls_options

 /** @} name Index of key_state objects within a tls_session structure */

 /** @} addtogroup control_processor */

+#define AUTH_TOKEN_SIZE 32      /**< Size of server side generated auth tokens.

+                                 *   32 bytes == 256 bits

+                                 */

 /**

  * Security parameter state of a single session within a VPN tunnel.

@@ -525,6 +528,11 @@ struct tls_multi

   uint32_t peer_id;

   bool use_peer_id;

+  char *auth_token;      /**< If server sends a generated auth-token,

+                          *   this is the token to use for future

+                          *   user/pass authentications in this session.

+                          */

+  time_t auth_token_tstamp; /**< timestamp of the generated token */

   /*

    * Our session objects.

    */

@@ -39,6 +39,8 @@

 #include "misc.h"

 #include "manage.h"

+#include "otime.h"

+#include "base64.h"

 #include "ssl_verify.h"

 #include "ssl_verify_backend.h"

@@ -1174,6 +1176,43 @@ verify_user_pass(struct user_pass *up, struct tls_multi *multi,

       if (man_def_auth != KMDA_UNDEF)

 	ks->auth_deferred = true;

 #endif

+

+      if ((session->opt->auth_token_generate) && (NULL == multi->auth_token))

+	{

+	  /* Server is configured with --auth-gen-token but no token has yet

+	   * been generated for this client.  Generate one and save it.

+	   */

+	  uint8_t tok[AUTH_TOKEN_SIZE];

+

+	  if (!rand_bytes(tok, AUTH_TOKEN_SIZE))

+	    {

+	      msg( M_FATAL, "Failed to get enough randomness for "

+                   "authentication token");

+	    }

+

+	  /* The token should be longer than the input when

+           * being base64 encoded

+           */

+	  if( openvpn_base64_encode(tok, AUTH_TOKEN_SIZE,

+                                    &multi->auth_token) < AUTH_TOKEN_SIZE)

+	    {

+	      msg(D_TLS_ERRORS, "BASE64 encoding of token failed. "

+                  "No auth-token will be activated now");

+	      if (multi->auth_token)

+		{

+		  memset (multi->auth_token, 0, AUTH_TOKEN_SIZE);

+		  free (multi->auth_token);

+		  multi->auth_token = NULL;

+		}

+	    }

+	  else

+	    {

+	      multi->auth_token_tstamp = now;

+	      dmsg (D_SHOW_KEYS, "Generated token for client: %s",

+                    multi->auth_token);

+	    }

+	}

+

       if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME))

 	set_common_name (session, up->username);

 #ifdef ENABLE_DEF_AUTH