Polkit Agent or Secret Agent: Which Prompt Is Missing?

Read the dialog text before touching any configuration. One prompt asks for authority to change the machine's networking; the other asks for the secret a connection needs. They come from different components, fail for different reasons, and fixing one never fixes the other. The message names which one you are dealing with.

Start from that name rather than from the VPN, which is only the reason the operation was requested.

Which Prompt Are You Actually Missing?

A local authorization prompt means the desktop is asking whether this user may perform a privileged operation. A secret prompt means the connection store needs a password, a key passphrase or a token before the tunnel can be built. The first is answered by an authentication agent in your session; the second by a secret agent the network management service can reach. If the message says no authentication agent was found, no VPN password has been requested yet.

That ordering matters when you report the problem. The launch context, the requested local operation, the authorization result and any later connection error are four separate facts, and collapsing them produces a report nobody can act on.

The Polkit Agent Lives in Your Session

Polkit keeps a privileged system operation apart from the ordinary program that asks for it, and an agent in the user's session presents that interaction. A lightweight desktop, a launcher started from a bare terminal, or a session that lost its agent can all leave that interaction unavailable. Check how the application was launched before assuming the policy is wrong. A text-only session needs its own supported agent, not a graphical one borrowed from another login.

Copying session bus addresses or display variables from another user's environment is not an authorization plan. It produces a session that looks connected and still cannot answer the prompt correctly.

The Secret Agent Supplies a Different Thing

The network management service asks a secret agent for credentials it does not store, and the agent shows that request to the user. A command-line client with its own interactive prompt is one such agent; a desktop shell usually provides another. Making a secret available does not grant authority to modify system networking, and repairing local authorization does not create a missing credential. One workflow may need both answers, and always in that sequence.

If the secret dialog never appears, look at which agent the service can reach rather than at the polkit policy.

Repair the Session, Not the Privilege Level

Use the desktop's supported agent and startup integration instead of running the whole VPN interface as root. Granting every user unconditional network administration, or disabling the authorization service, trades a missing dialog for a permanent hole. On managed equipment the administrator may deliberately require an approved operator, and the right fix is to work within that decision. Check the supported permissions view to see what the current user may request.

Do not fold the local answer into the gateway's authentication result; they are two events. Nor does an interactive secret prompt in a terminal exempt anyone from the authorization policy, convenient as it feels.

Record which agent answered, in which session, and what happened next.