Groups with Radius

shenderson

I am trying to follow the following https://openvpn.net/vpn-server-resources/integrating-active-directory-with-access-server-using-radius-and-post_auth/ to be able to integrate AD groups in OpenVPN

When I run the sacli command I get the result...

u"ERROR: unknown command '\u2014value_file=AD.py': util/options:79,sagent/sacli:915,<string>:1,sagent/sagent_entry:58,sagent/sacli:920,util/options:79,sagent/sacli:915,util/error:61,util/error:44"

The install is a brand-new HyperV Appliance. I assumed that such an appliance would work the same as an install.

Anybody got any ideas?

The Johan

Try typing the command manually instead of using a copy/paste - it looks like some illegal character got copied along.

shenderson

That worked...thanks!
I now see the following...

root@ig-hh-vpn5:~# /usr/local/openvpn_as/scripts/sacli -k auth.module.post_auth_script -value_file=AD.py ConfigPut && /usr/local/openvpn_as/scripts/sacli start
[True, {}]
RunStart warm None
{
"active_profile": "Default",
"errors": {
"auth": [
[
"error",
"error loading post_auth script: name 'AD' is not defined: svc/svc:631,sagent/authsvc:104,sagent/authsvc:95,<string>:1 (exceptions.NameError)"
]
],
"client_query": [
[
"error",
"'auth': svc/svc:631,sagent/cqsvc:248 (exceptions.KeyError)"
]
]
},
"service_status": {
"api": "on",
"auth": "on",
"bridge": "on",
"client_query": "on",
"crl": "on",
"daemon_pre": "on",
"db_push": "on",
"ip6tables_live": "on",
"ip6tables_openvpn": "on",
"iptables_live": "on",
"iptables_openvpn": "on",
"iptables_web": "on",
"license": "on",
"log": "on",
"openvpn_0": "on",
"openvpn_1": "on",
"user": "on",
"web": "on"
}
}
WILL_RESTART []
ERROR: restart failed (ERRBACK)

The Johan

> "error", "error loading post_auth script: name 'AD' is not defined: svc/svc:631,sagent/authsvc:104,sagent/authsvc:95,<string>:1 (exceptions.NameError)"

It's possible the original script has not been properly configured yet or it is corrupted. Python is very twitchy about formatting. If you change indentation in the file it already breaks the script.

shenderson

I have now done a vanilla install of the HyperV appliance with an update of AS and Ubuntu to the latest version and I still see the error. I have sometimes seen the same error when updating AS within the GUI. No scripts have been changed. Normal authentication works with RADIUS but I want to integrate AD groups.

The error seems to be...

error loading post_auth script: name 'AD' is not defined

What is AD referring to and how to define it? I had a Linux expert look at the underlying scripts and he also could not figure out what it comes up?
I can't believe that no one is integrating AD groups into OpenVPN?

The Johan

It's easier to use LDAP, and more consistent, and that is the recommended method. RADIUS is possible, but there is something going wrong there on your end, apparently.

The Johan

Here. Use LDAP and use this post_auth script to map predefined groups in LDAP to predefined groups in Access Server:
https://docs.openvpn.net/wp-content/uploads/OpenVPN-Access-Server-post_auth-LDAP-group-mapping.pdf