LDAP failing when user password reset required

[deleted]

Hey,

So I've set up OpenVPN to authenticate to my office's domain, and everything seemed to work. However, this morning, I tried to add a new user to the OpenVPN user group, and allow them to log in. Part of our new user process is that the account must change its password on first login -- however, when a user attempts to authenticate to OpenVPN with an account that needs to change its password, they get the following error:

VPN-Server,USER,2014.10.20 10:37:54 CDT,,WEB_CLIENT,,0,127.0.0.1,,,,,"LDAP invalid credentials on ldap://domain.controller/: {'info': '80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 773, v1db1', 'desc': 'Invalid credentials'} (facility='user_bind on u'CN=users name,CN=Users,DC=my domain,DC=LOCAL' via search (u'CN=Users, DC=my domain, DC=local', 2, u'(&(sAMAccountName=username)(memberOf=CN=VPN Users, CN=Users, DC=my domain, DC=local))')')"

This registers to OpenVPN as an authentication failure. The 'data 773' field is the important one here -- this is specifically not a failure of authentication, just that the user needs to reset their password. Is there a way to allow OpenVPN users to authenticate despite this error? It seems that when a user encounters this particular LDAP response they should be allowed to log in.

Traffic

What version of OpenVPN are you using ?

maikcat

AFAIK every services i used (datastage,cognos,db2,tivoli monitoring) when a ldap account is expired
the service is reporting it as a failure...

Michael.

[deleted]

Traffic wroteWhat version of OpenVPN are you using ?

I'm using version 2.0.10

rsenio

To me that behavior is expected and normal.

The Johan

OpenVPN Access Server, like most LDAP connected systems, is not capable of dealing with this particular error code. It will simply fail the connection.

Since LDAP is here used as an authentication system that is outside of the Access Server, any problems with authentication must be handled outside of the Access Server as well. So in your LDAP system there must be some way for the user to change his/her own password before/after it expires. This is not something the Access Server will notify a user about, or give the tools to do that; this is outside of the Access Server.

I'd suggest setting up some sort of automated email alert letting your users know when their password is about to expire, and to set up some sort of system where users can log in and change their own password. Or enforce strong passwords and not expire them automatically.

Good luck.

NoahDarby

novaflash wroteOpenVPN Access Server, like most LDAP connected systems, is not capable of dealing with this particular error code. It will simply fail the connection.

Since LDAP is here used as an authentication system that is outside of the Access Server, any problems with authentication must be handled outside of the Access Server as well. So in your LDAP system there must be some way for the user to change his/her own password before/after it expires. This is not something the Access Server will notify a user about, or give the tools to do that; this is outside of the Access Server.

I'd suggest setting up some sort of automated email alert letting your users know when their password is about to expire, and to set up some sort of system where users can log in and change their own password. Or enforce strong passwords and not expire them automatically.

Good luck.

Yep, we have a script in place to check AD daily and send out two warnings (5 days and 2 days) to users with instructions on how to reset their expired password. Microsoft Exchange Webmail does have this ability for them to reset it.

Unfortunately, some users procrastinate to the last minute only to get themselves locked out due to expired password. Especially on a weekend. OpenVPN-AS is working with LDAP as intended so no problems there. We usually reach out to the procrastinators and get them to change their password ASAP. Even with strong passwords it's good practice to have them expire at one point.

I have noticed the new version of OpenVPN-AS offers Google Two-Factor Authentication. Pretty cool idea which I can use myself for strict security environments. In our scenario 60 day password expire is good enough. Someday I will look into making things easier for our users but for now they will just have to keep their passwords secure and change it when it's time to do so.