Hey Al,
I am also trying to authenticate to specific groups on an open ldap server (Open Directory on Mac OS X 10.6.8 server). I contacted support and they supplied me with a PDF explaining how to use a post authentication python script to match the ldap groups to user groups on the OpenVPN AS server. The info they sent me in a PDF is at the bottom.
Download this file:
http://swupdate.openvpn.net/scripts/post_auth_ldap_autologin_dbsave.py
I still am having problems adding my settings to the database, so it is not working for me yet.
Access Server 1.8.4 Explanation of “post_auth”
LDAP group mapping script
1
Authentication and role of post_auth
The post_auth programming hook in Access Server was put in to extend the possibilities of the Access Server to authenticate against a source of credentials. By default without using post_auth the following sources can be authenticated against in Access Server:
● LOCAL
○ This method relies on using an SQLite database that is stored on the Access
Server itself. It contains both the user properties and the user credentials. Management of credentials is handled in the ‘user permissions’ area of the admin web services of the Access Server.
● PAM
○ This is the system that is present on almost all Linux systems, and is the default
choice for the Access Server. This uses the credentials from the Linux system itself to authenticate to. Management of credentials is done in the console/SSH session in the Linux OS itself using standard tools like adduser, deluser, passwd.
● LDAP
○ To connect to an OpenLDAP or Windows AD, the LDAP option is fairly easy to
use. An account must be made on the LDAP server through which the Access Server can talk to the LDAP server to perform authentication against the credentials stored in the LDAP server. Management of credentials is handled by using LDAP browsing and management tools, or in Windows AD by using the “Active Directory Users and Computers” MMC applet.
● RADIUS
○ Like LDAP, the credentials are stored in the RADIUS server, and management of
credentials is handled by using the tools available for browsing and manipulating the contents of the RADIUS credentials database. Windows AD support the ability to allow the Access Server to query the AD over the RADIUS protocol, like LDAP.
As mentioned in the above items, only authentication against stored credentials is possible. It does not pay attention to any of the user’s properties in the external credentials store. Access Server by default only concentrates on the user’s login name and password, and if they check out or not. So if for example in your LDAP server and you have a group of users called “staff” and you want the Access Server to have special access rules set up just for that group, then you need to take extra steps to ensure that the Access Server will actually do something with this group information, as by default it does nothing to with these extra user properties.
Note that if you only need to assign a few users to groups, you can also choose to add the user by its login name to the ‘user permissions’ field in the Access Server, and then assign it to a group. When the user logs in, Access Server will recognize that the user belongs to a group and then the user will inherit the properties of that group. To automate this for larger groups of users, the post_auth script for LDAP group mapping can be obtained from us. Read on to learn more.
2
What is it, where is it, and how do I install it?
The post_auth script is run during the authentication session where a user tries to log in at the Access Server, either through OpenVPN client or the web services. The script runs just after a user’s credentials are checked and found to be working. Hence, post_auth after authentication.
The script itself is a text file in the programming language Python. With it you can do all sorts of interesting things to extend the authentication system. For example, you can send a query to the user for an OTP (One Time Password) right after the username/password session. You can also decide that certain users are not allowed access by checking for their usernames and denying them access in the post_auth script, even though they have valid credentials.
The script itself is stored on the Access Server doesn’t really matter where and then loaded into the Access Server’s configuration database using the sacli script command. We have various post_auth scripts here at OpenVPN Technologies that we can provide to you to perform certain functions. You can also write your own. The script is then stored in the database of the Access Server by copying the entire contents of the filename.py script file into one key in the database designed specifically for this purpose. Access Server then runs that code right after a successful authentication has taken place. This is the command to load the script into the Access Server configuration database:
cd /usr/local/openvpn_as/scripts/
./sacli k auth.module.post_auth_script value_file=filename.py ConfigPut ./sacli start
The post_auth script mentioned and explained in this document can be downloaded from the following URL. It is designed to map LDAP group names to Access Server group names.
http://swupdate.openvpn.net/scripts/post_auth_ldap_autologin_dbsave.py
There is also more documentation and script samples available on your Access Server here: /usr/local/openvpn_as/doc/post_auth/
3
Mapping LDAP groups to Access Server groups
This post_auth example will show you how to use one of our prepared post_auth scripts to make it possible to map certain specific LDAP groups to their Access Server counterpart groups. This will make it so that if a user logs in at the Access Server, and the LDAP server approves the credentials and passes the user’s group details to the Access Server, the post_auth script will read this group information and use a set of fixed rules to assign the user to a specific Access Server group. The user will then inherit the properties that are assign to the Access Server group. These properties could for example determine to which subnets the user has access.
To put this into another view:
● User logs in through web services or through OpenVPN client software
● Access Server contacts the LDAP server and asks if the username/password are OK.
● LDAP server responds with positive answer, also sends along some user properties.
● Access Server sees positive response, runs post_auth script, passes user properties.
● post_auth script reads the passed user properties and reads the group name.
● post_auth script uses specified rules to match LDAP group name to AS group name.
● post_auth script assigns the user to the specified group in Access Server.
● User connects with properties inherited from that Access Server group.
4
Defining the group names in the post_auth script
The following is a short bit of code from the post_auth script:
http://swupdate.openvpn.net/scripts/post_auth_ldap_autologin_dbsave.py
Script excerpt:
# determine the access server group based on LDAP group settings if 'VPN Users' in ldap_groups:
group = "VPNUsers" elif 'Sales' in ldap_groups:
group = "sales"
elif 'Finance' in ldap_groups:
group = "finance"
elif 'Engineering' in ldap_groups:
group = "engineering"
The section of code above is the part in the LDAP post_auth group mapping script that you need to edit in a standard text editor such as nano, vi or vim to assign groups in LDAP to groups in Access Server. The rest of the code should be left intact. In the code you see:
if 'VPN Users' in ldap_groups:
This looks for the phrase “VPN Users” in the LDAP group name(s) that were passed to the post_auth script through the Access Server by the LDAP server after successful authentication. If it is found, meaning, if the user is part of the group called VPN Users, then it will run the following code to assign the user to the Access Server group “VPNUsers”:
group = "VPNUsers"
The other lines underneath all check for different LDAP group names and assign to other groups. Feel free to edit this. If there are too many, simply remove some. If you need more groups, then simply copy and paste the two lines that start with “elif” and “group” to expand the list of group matching criteria. After that, save the file and then load it into the Access Server:
cd /usr/local/openvpn_as/scripts/
./sacli k auth.module.post_auth_script value_file=filename.py ConfigPut ./sacli start
