How to use password and profile double authentication

doit2010

How to use password and profile double authentication ?（openvpn-as 2.11）

How to use password and profile double authentication
By default, you can connect with a password. For security reasons, I close the web end to download configuration files, and the administrator generates user profiles in the background. I hope all users must connect with passwords and configuration files. However, your documents are not easy to understand, and I hope they can be answered.

openvpn_inc

Hello doit2020,

I don't know what you mean by profile double authentication, it is a vague description.

In the case that you mean that there should be verification with certificates, and verification with username and password, then that is already happening. The client private key is embedded in the connection profile you generated on the server and verified automatically when you connect. Then on top of that you have to provide your credentials. If you don't have the config file you don't have the required private key to connect.

In the case that you mean that there should be username+password verification and on top of that a multi-factor authentication like with Google Authenticator or such, then you can enable MFA in the authentication settings page in the Admin UI of the access server. Users will then have to enroll in MFA first on the web interface and can then use that to establish the VPN connection.

Kind regards,
Johan

doit2010

openvpn_inc wrote Hello doit2020,

I don't know what you mean by profile double authentication, it is a vague description.

In the case that you mean that there should be verification with certificates, and verification with username and password, then that is already happening. The client private key is embedded in the connection profile you generated on the server and verified automatically when you connect. Then on top of that you have to provide your credentials. If you don't have the config file you don't have the required private key to connect.

In the case that you mean that there should be username+password verification and on top of that a multi-factor authentication like with Google Authenticator or such, then you can enable MFA in the authentication settings page in the Admin UI of the access server. Users will then have to enroll in MFA first on the web interface and can then use that to establish the VPN connection.

Kind regards,
Johan

i mean there should be verification with certificates, and verification with username and password

But the default configuration is that I fill in the server address, account and password on the client, and then I can connect directly,No client.ovpn required。
how can i do，there should be verification with certificates, and verification with username and password？

openvpn_inc

Hello doit2020,

You are referring to the import procedure in the OpenVPN Connect application. It allows the user to import his or her connection profile using just his or her credentials. The imported profile can then be used to start the connection. This is a usability feature, otherwise things get too complicated for a beginner to get started with their own OpenVPN server.

You have some options. You can go to the Admin UI of the Access Server and under Configuration > CWS settings set it to restrict access to the web services only to Access Server administrators, and to turn off the XML-RPC/REST API. That will ensure your users cannot obtain their connection profiles by themselves, but they will have to go through an administrator of the Access Server to obtain these profiles. The administrator of the server can generate and download connection profiles for users and hand them over via whatever medium they feel is safe. The user can then use that connection profile to get connected.

Another option is to use SAML authentication, and in the SAML IdP you can use X509 client authentication, meaning a certificate must be installed on the client system that can validate against the SAML IdP. That way when you start the import process in OpenVPN Connect, you will be redirected to the SAML IdP, that will then do a validation of a certificate that can validate against the SAML IdP, and only then can the connection profile with its own OpenVPN client certificates be imported and used to connect.

Kind regards,
Johan