AD Authentication and network segmentation

r00ney08

Afternoon,

I am new to Openvpn, however I have successfully configured a working server without too many problems along the way.

The reason I am posting is for advise related to the best way forward for this server.

Firstly although I have got AD auth working, I was wondering if there is a way to authenticate a users based on group membership in AD rather than the presence of the user account?

The second thing I would like advise on, is if there is a way to have both AD authentication and network segmentation as apart of the same configuration. The reason I would like this, is I would like to get my organisation users connected via AD auth, and third party vendors who we use for support should connect via certificate without access to anything other than the specific server that assist with.

Thanks in advance for any advice you can give me on the above!

As I have not got a working config of what I am trying to achieve i have not posted anything, although if need be I can post what I have if anyone requires it.

r00ney08

I have got this working now, it was simply an error on the client config.

One issue I am still having, is the require group membership option,

<LDAP>
# LDAP server URL
URL ldap://192.16.63.45:389 # modify this lin! Replace X's with your Domain Controller's local IP address

BindDN "CN=*****test,OU=*****,OU=*****,OU=******,DC=********,DC=******,DC=dom"

Password "******" # Enter the password of the user account that OpenVPN will use to talk to your domain controller

Timeout 15
TLSEnable no
FollowReferrals no
</LDAP>

<Authorization>
BaseDN "DC=*****,DC=****,DC=dom" # MODIFY THIS LINE!
SearchFilter "(&(sAMAccountName=%u)(!(nsAccountLock=true)))"
# Require Group Membership
RequireGroup true
<Group>
BaseDN "DC=******,DC=******,DC=dom"
SearchFilter "CN=*****,OU=******,DC=*****,DC=******,DC=dom"
MemberAttribute member
</Group>
</Authorization>

Users get authenticated perfectly well without the required group setting, but when turn it on, then it complains that the LDAP user "j****" was not found. Has anyone got group membership working?

Any help would be greatly appreciated.