You are not logged in.

#1 2026-03-18 11:00:34

iamrusty
Member
Registered: 2025-01-11
Posts: 2

networkmanager-l2tp per user password problem

After upgrading the packages networkmanager-l2tp and networkmanager-vpn-plugin-l2tp to versions greater than 1.20.20, they stopped working with saved per-user passwords. I use gnome-keyring to manage passwords of network connections, and when I try to connect using l2tp VPN, I see the following message: "secrets: failed to request VPN secrets #3: User canceled the secrets request". Any ideas why everything works when I downgrade to 1.20.20?

Offline

#2 2026-03-29 23:42:36

PaddraighOS
Member
Registered: 2026-03-29
Posts: 2

Re: networkmanager-l2tp per user password problem

The 'User canceled the secrets request' #3 is NM giving up after three failed attempts to get the VPN credentials -- it is not literally the user canceling, it is the keyring interaction failing.

A few things worth checking based on what changed around 1.20.22:

First, timing. If you are using auto-connect at login, gnome-keyring may not have unlocked yet when NM makes its first attempt. The VPN tries before you have had a chance to authenticate to the keyring session.

Second, check where the password is stored in the connection editor. If it is set to 'Store password for this user only' (per-user keyring), try switching to 'Store password for all users (system secrets)' -- this stores the credential in the system keyring so NM can fetch it without a user session being active.

Third, make sure nm-applet is running when the connection fails. It is the secrets agent in GNOME that handles the keyring requests. You can check with pgrep nm-applet. Without it, NM has nowhere to ask for the password or read from the keyring.

You can also verify the secret is actually present: secret-tool lookup vpn-id your-connection-uuid should return the stored password if it is there.

If none of that sorts it, a workaround to unblock yourself: nmcli connection modify your-conn-name vpn.secrets 'password=yourvpnpassword' -- a bit less elegant but removes the keyring dependency entirely for that connection. Should sort you out.

Offline

Board footer

Powered by FluxBB