LDAP authentication with certificates

noteirak

Hi,

I am currently trying to centralize my infrastructure authentication and authorisation by setting up a LDAP server so all my boxes and services use it as a central point.
I have been searching for a way to provide normal certificate authentication to my openvpn users (just like it would work normally) but any info on how to setup LDAP server with OpenVPN link to old posts and only show how to perform this authentication with a username/password, and NOT with the client certificate.
It is possible to store a client certificate within LDAP for a given user, but I never came across a single example of using that...

Is is actually possible to do so? if yes, is there a place where I could find some documentation about this?
Or is there an open source projet that actually implements this where I could inspire myself on how to proceed?
If this is not possible, is it a technical limitation or simply something that nobody implemented yet?

Thanks for your time

maikcat

hi there,

It is possible to store a client certificate within LDAP for a given user,

my opinion is to search at ldap forums (openldap maybe?) for the necessary schema (if any)...

AFAIK keep in mind that client must have a cert locally in order TLS to work.. (both parties exchange their public keys)

regards

Michael.

noteirak

Hi maikcat,

The part you quoted wasn't the question, only saying that it is definitly possible to store a certificate within LDAP for a user.

My question is : how do you make OpenVPN use it?
All the examples I came accross use a login/password but there is no mention of the client certificate, there is even a directive "client-cert-not-required" in the config files in the example found accross the net.

You say that the client must have a cert locally, does that mean that even if I store the certificate in LDAP, it still needs to be present physically on the OpenVPN server as a file? If yes, using LDAP is pretty much useless then...

To summarize my requirements : I want to use my LDAP server, add the client certificate to LDAP only, nothing on the openvpn server, and use that in OpenVPN. Is it possible?