Hello, I am trying out OpenVPN and have got it all up and running except for one problem. My configuration consists of the OpenVPN Access Server Virtual Appliance running 1.6, a Windows Server 2008R2 SP1 server running RADIUS and NPS, an AD domain and Windows 7 laptops that are [u][b]not[/b][/u] members of the AD domain. In an existing PPTP setup (non-OpenVPN) with RRAS and NPS on another Windows Server 2008R2 SP1 server and a Windows 7 client not part of the domain (using windows default VPN client), after connecting using AD domain credentials, I am able to connect to server shares as the domain user that I logged onto the VPN as, [u][b]without[/b][/u] being prompted for a login each time I connect to another server share. Using OpenVPN, I want to mirror this usability on the Windows 7 client-side where I am not a domain member. I have tried RADIUS and LDAP authentication methods in OpenVPN and am able to successfully connect and ping and even browse server shares but I am forced to login for each share. Can it somehow transfer the domain user info to the server shares to login, automatically? Yes, I know there is a check box to remember the credentials but that can cause problems with caching and new passwords, etc. Wishful thinking?

Access Windows Server Shares Without Having to login again

wRx7M

Hello,

I am trying out OpenVPN and have got it all up and running except for one problem.

My configuration consists of the OpenVPN Access Server Virtual Appliance running 1.6, a Windows Server 2008R2 SP1 server running RADIUS and NPS, an AD domain and Windows 7 laptops that are not members of the AD domain.

In an existing PPTP setup (non-OpenVPN) with RRAS and NPS on another Windows Server 2008R2 SP1 server and a Windows 7 client not part of the domain (using windows default VPN client), after connecting using AD domain credentials, I am able to connect to server shares as the domain user that I logged onto the VPN as, without being prompted for a login each time I connect to another server share.

Using OpenVPN, I want to mirror this usability on the Windows 7 client-side where I am not a domain member. I have tried RADIUS and LDAP authentication methods in OpenVPN and am able to successfully connect and ping and even browse server shares but I am forced to login for each share.

Can it somehow transfer the domain user info to the server shares to login, automatically? Yes, I know there is a check box to remember the credentials but that can cause problems with caching and new passwords, etc.

Wishful thinking?

janjust

are the PPTP devices trusted (not public) on the Win7 laptops and/or the win2008 domain?
and what about the tap-win32 devices? are they private or publc?

wRx7M

Thanks for the reply.

The network label for Windows 7 on the existing PPTP connections is set to "work".

I had an issue connecting to any network shares when I first setup OpenVPN because the tap 32 device network connection was set to "public" and I was not able to change it manually. I found that I had to push the gateway in order to get it to stop displaying as public.

I hope that I am giving you the answers you are looking for...

Thanks again.

janjust

so the tap-win32 adapter is now also set to "work" ? then I'd expect the same password policy to apply to it compared to the PPTP password policy. This is mostly a Windows domain/registration issue , however. It might help to add

register-dns

to the client conf.

wRx7M

Would that be under Advanced VPN settings and Client Config Directives?

janjust

this is a generic client configuration setting - I've never used the AS product so I'm not sure where to find it.

wRx7M

I tried adding it to the Client Config Directives and it still asks for login when connecting to a windows server share.

As far the appliance goes, is the web interface different than on a standard linux box?

wRx7M

Does anyone have any idea how to get the credentials (RADIUS or LDAP) to transfer/be used automatically when connecting to \\server\share in Windows on a client that is not part of the domain?