diff --git a/auth.c b/auth.c
index 83c186d3af830711fb2a3496878d4a804349d176..e476775508c4ba365df29210c0970970f3dcb4d0 100644
--- a/auth.c
+++ b/auth.c
@@ -893,7 +893,8 @@ static int cstp_can_gen_tokencode(struct openconnect_info *vpninfo,
 	}
 #endif
 	/* Otherwise it's an OATH token of some kind. */
-	if (strcmp(opt->name, "secondary_password"))
+	if (strcmp(opt->name, "secondary_password") &&
+        (!form->auth_id || strcmp(form->auth_id, "challenge")))
 		return -EINVAL;
 
 	return can_gen_tokencode(vpninfo, form, opt);