Different Client Profiles Based on LDAP Group Membership

smithy1235

Hi all,

I'm trying to find out if it is possible to configure an openvpn server with multiple client access policies which are controlled by LDAP or some other external auth mechanism. I've googled this quite a lot and tried searching these forums but nothing immediate has popped up.

The scenario I have is that I have multiple users which are authed via a LDAP system and based on the group that they are members of I want them to have different policies applied . I know how to configure the LDAP auth bit, the bit I am having trouble find out if I can do is the policy section. I have read that I can use the 'client-config-dir' directive but that appears to only be able to use local information such as the CN from a certificate. What I would like to be able to do is use the CN from a cert and the users password to do and LDAP lookup, this then returns the group specification for that user such as 'HR'. This value will then be used by the cdd to get the policy applied to that user. As users move through the organisation I do not want to have to revoke and reissue a new certificate each time an employee changes department, I'd like to be able to make the change once in the centralised authentication system and then the VPN servers pick this us.

I hope that makes sense. If they answer is no, then at least I can change tack on this and approach the problem in a different way.

Cheers for any advice

Richard

john.skinner

Hey Richard,

I'm sorry I don't have a working solution for you. I have the same desire as you though. I have an LDAP directory (Open Directory that comes with Mac OS X 10.6.8 Server) that I want to authenticate and get group memberships from.
I am looking at both the free community version and the Access Server version to see if either can do this. So far, on both, I can authenticate to LDAP, but not get the LDAP group to affect any VPN preferences. The OpenVPN Access Server (paid version) has a mechanism that OpenVPN support tells me that should work. I have posted about it here...
https://forums.openvpn.net/topic15513.html