As a matter of fact, the not answer given by user2000606 leads to success.
The HTTP messages sent to the ASA differ, depending on how you select a group and VPN gateways can be picky about it.
This is my basic call to openconnect
openconnect -v --printcookie --dump-http-traffic \ --passwd-on-stdin \ -u johnsmith \ vpn.ssl.mydomain.tld
Issuing this command and providing my desired VPN group after being prompted results in the followin HTTP chat (I only included the seemingly relevant parts of the XML documents):
[Certificate error, I tell openconnect to continue] Me >> ASA: POST / HTTP/1.1 [...]<group-access>https://vpn.ssl.mydomain.tld</group-access> ASA << ME: HTTP/1.1 200 OK Me >> ASA: POST / HTTP/1.1 [...]<group-access>https://vpn.ssl.mydomain.tld/</group-access><group-select>AnyConnect-MyGroup</group-select> ASA << ME: HTTP/1.1 200 OK Me >> ASA: POST / HTTP/1.1 [...]<auth><username>johnsmith</username><password>secret</password></auth><group-select>AnyConnect-MyGroup</group-select> ASA << ME: HTTP/1.1 200 OK
Notice the group-select-groups and that all requests are POST / HTTP/1.1. The same result is achieved by providing --authgroup AnyConnect-MyGroup with the basic call to openconnect.
When using -g AnyConnect-MyGroup instead of --authgroup AnyConnect-MyGroup the following happens:
Me >> ASA: POST /AnyConnect-MyGroup HTTP/1.1 [...]<group-access>https://vpn.ssl.mydomain.tld/AnyConnect-MyGroup</group-access> ASA << ME: HTTP/1.1 200 OK [...] <error id="91" param1="" param2="">Invalid host entry. Please re-enter.</error>
Notice that this time we don't tell the server group-select but simply squeeze in our group name with group-access and the HTTP request. The same negative result is provoked when adding the group name to the gateway address, i.e. using vpn.ssl.mydomain.tld/AnyConnect-MyGroup as the last line of the basic call to openconnect.
