I have enabled TLS on my openldap server and all other applications can authenticate, but I cannot get openvpn to authenticate.
I have made the following changes in my auth-ldap.conf:
From:
TLSEnable No
To:
TLSEnable Yes
auth-ldap.conf
<LDAP>
# LDAP server URL
URL ldap://192.168.1.142
# Bind DN (If your LDAP server doesn't support anonymous binds)
# BindDN uid=openvpnuser,dc=example,dc=com
# Bind Password
# Password YOURLDAPPASSWORD
# Network timeout (in seconds)
Timeout 15
# Enable Start TLS
TLSEnable Yes
# Follow LDAP Referrals (anonymously)
FollowReferrals yes
# TLS CA Certificate File
#TLSCACertFile /usr/local/etc/ssl/ca.pem
# TLS CA Certificate Directory
# TLSCACertDir /etc/ssl/certs
# Client Certificate and key
# If TLS client authentication is required
#TLSCertFile /usr/local/etc/ssl/client-cert.pem
#TLSKeyFile /usr/local/etc/ssl/client-key.pem
# Cipher Suite
# The defaults are usually fine here
# TLSCipherSuite ALL:!ADH:@STRENGTH
</LDAP>
<Authorization>
# Base DN
BaseDN "dc=joejoe,dc=net"
# User Search Filter
# SearchFilter "(&(uid=%u)(accountStatus=active))"
# SearchFilter "(&(uid=%u))"
# Limits access to users in "ou=Users,dc=joejoe,dc=net" with an uid and the attribute "employeeType" with the value "openvpn" will only be able to connect using their login, password and certificate.
SearchFilter "(&(uid=%u))"
# Require Group Membership
RequireGroup false
# Add non-group members to a PF table (disabled)
#PFTable ips_vpn_users
# <Group>
# BaseDN "ou=Groups,dc=joejoe,dc=net"
# SearchFilter "(|(cn=developers)(cn=artists))"
# MemberAttribute uniqueMember
# Add group members to a PF table (disabled)
# PFTable ips_vpn_eng
# </Group>
</Authorization>
Is there something else I need to do?
