Android issues on 1.6

[kchudy]

W odpowiedzi do Jacek
hi Jędrzej Sieracki, I see host lookup issues and responses with 428 status code, not sure which one of those is the real problem
Hi :) Please let me know about possible debug points, as of right now we have easy to replicate 1.6 Android clients errors, mostly when connecting over LTE.

Proxy side logs of client-reported "DioException Failed host lookup":

2025-12-23T12:06:11.068138Z INFO defguard_proxy::handlers::polling: 37.30.53.19 POST /api/v1/poll message=Retrieved info for polling request || Tracing data: http_request:
2025-12-23T12:06:11.799911Z INFO defguard_proxy::handlers::desktop_client_mfa: 37.30.53.19 POST /api/v1/client-mfa/start message=Starting desktop client authorization ClientMfaStartRequest { location_id: 3, pubkey: "fIqF709uYGMW2DxSoNpuHnvjKytkAlojQbP7F1UnF1k=", method: Oidc } || Tracing data: http_request:
2025-12-23T12:06:11.810283Z INFO defguard_proxy::handlers::desktop_client_mfa: 37.30.53.19 POST /api/v1/client-mfa/start message=Started desktop client authorization ClientMfaStartRequest { location_id: 3, pubkey: "fIqF709uYGMW2DxSoNpuHnvjKytkAlojQbP7F1UnF1k=", method: Oidc } || Tracing data: http_request:
2025-12-23T12:06:12.805187Z INFO defguard_proxy::handlers::desktop_client_mfa: 37.30.53.19 POST /api/v1/client-mfa/finish message=Finishing desktop client authorization || Tracing data: http_request:
2025-12-23T12:06:12.806840Z ERROR defguard_proxy::handlers: 37.30.53.19 POST /api/v1/client-mfa/finish message=Received an error response from Core service. | status code: 9 message: OIDC authentication not completed yet || Tracing data: http_request: [1.6.0+9e94ddd Debian 13.0.0 x86_64]
2025-12-23T12:06:12.806871Z ERROR defguard_proxy::error: 37.30.53.19 POST /api/v1/client-mfa/finish message=Precondition required: OIDC authentication not completed yet || Tracing data: http_request: [1.6.0+9e94ddd Debian 13.0.0 x86_64]
2025-12-23T12:06:14.844661Z INFO defguard_proxy::handlers::desktop_client_mfa: 37.30.53.19 POST /api/v1/client-mfa/finish message=Finishing desktop client authorization || Tracing data: http_request:
2025-12-23T12:06:14.846290Z ERROR defguard_proxy::handlers: 37.30.53.19 POST /api/v1/client-mfa/finish message=Received an error response from Core service. | status code: 9 message: OIDC authentication not completed yet || Tracing data: http_request: [1.6.0+9e94ddd Debian 13.0.0 x86_64]
2025-12-23T12:06:14.846317Z ERROR defguard_proxy::error: 37.30.53.19 POST /api/v1/client-mfa/finish message=Precondition required: OIDC authentication not completed yet || Tracing data: http_request: [1.6.0+9e94ddd Debian 13.0.0 x86_64]
2025-12-23T12:06:16.900130Z INFO defguard_proxy::handlers::desktop_client_mfa: 37.30.53.19 POST /api/v1/client-mfa/finish message=Finishing desktop client authorization || Tracing data: http_request:
2025-12-23T12:06:16.901308Z ERROR defguard_proxy::handlers: 37.30.53.19 POST /api/v1/client-mfa/finish message=Received an error response from Core service. | status code: 9 message: OIDC authentication not completed yet || Tracing data: http_request: [1.6.0+9e94ddd Debian 13.0.0 x86_64]
2025-12-23T12:06:16.901338Z ERROR defguard_proxy::error: 37.30.53.19 POST /api/v1/client-mfa/finish message=Precondition required: OIDC authentication not completed yet || Tracing data: http_request: [1.6.0+9e94ddd Debian 13.0.0 x86_64]
2025-12-23T12:06:17.604363Z INFO defguard_proxy::enterprise::handlers::desktop_client_mfa: 37.30.53.19 POST /api/v1/openid/callback/mfa message=Processing MFA authentication callback || Tracing data: http_request:
2025-12-23T12:06:17.918645Z INFO defguard_proxy::enterprise::handlers::desktop_client_mfa: 37.30.53.19 POST /api/v1/openid/callback/mfa message=MFA authentication callback completed successfully || Tracing data: http_request:

Core-side logs of the same unsuccessful auth: 2025-12-23T12:06:11.809401Z INFO run_grpc_bidi_stream:proxy_bidi:handle_proxy_message_loop:start_client_mfa_login: defguard_core::db::models::user: message=Checking if Email in in available methods [Email], true [1.6.0+9529d1d][PX:1.6.0+9e94ddd] 2025-12-23T12:06:11.810115Z INFO run_grpc_bidi_stream:proxy_bidi:handle_proxy_message_loop:start_client_mfa_login: defguard_core::grpc::client_mfa: message=Desktop client MFA login started for jedrzej.sieracki at location GAJOWA 6 - INEA - GW2 [1.6.0+9529d1d][PX:1.6.0+9e94ddd] 2025-12-23T12:06:17.918354Z INFO run_grpc_bidi_stream:proxy_bidi:handle_proxy_message_loop:auth_mfa_session_with_oidc: defguard_core::enterprise::grpc::desktop_client_mfa: message=OIDC MFA authentication completed successfully for user: jedrzej.sieracki [1.6.0+9529d1d][PX:1.6.0+9e94ddd] (edytowano)

[filipslezaklab]

Given issue is over LTE and error message is "DioException Failed host lookup" I would guess this is an issue of HTTP communication between phone and proxy. The repeated mfa/finish errors are expected.

[bartoszgolas]

• The issue is not related to connecting over LTE but it is a difference in a Windows and Android client.
• Windows client connects 10/10, but Android has hit and miss 3/10
• At the moment I cannot connect via Android client (couple dozens of tries at different times on WIFI and LTE) abroad, Windows client is able to connect immediately