OpenVPN server + MFA on different domain to users domain

dedicatedorange

Hi,
Is it possible to run Open VPN (including totp/google auth), on a server which is on a different domain from which the users accounts are on?

E.g openvpn linux host on domain abc.com

users accounts in xyz.com < wish users to log in with these creds, including totp/google auth. I have had a look through the docs and it seems like this uses the servers domain it is joined to but is unclear?

Fadim

Hi @dedicatedorange,
Yes, as far as I know, it's possible. OpenVPN doesn't care much about the domain of the server it's running on. It's more about the authentication methods you're using.
You can configure OpenVPN to authenticate against an LDAP or RADIUS server, which could be tied to the user accounts on xyz.com. For TOTP/Google Auth, you might need a plugin like openvpn-plugin-auth-pam.
Keep in mind, you'll need to correctly set up the network to allow the OpenVPN server to communicate with the authentication server.
Hope this helps!

dedicatedorange

Fadim wrote Hi @dedicatedorange,
Yes, as far as I know, it's possible. OpenVPN doesn't care much about the domain of the server it's running on. It's more about the authentication methods you're using.
You can configure OpenVPN to authenticate against an LDAP or RADIUS server, which could be tied to the user accounts on xyz.com. For TOTP/Google Auth, you might need a plugin like openvpn-plugin-auth-pam.
Keep in mind, you'll need to correctly set up the network to allow the OpenVPN server to communicate with the authentication server.
Hope this helps!

Does the openvpn-plugin-auth-pam plugin for the totp/google auth work with the openvpn-auth-ldap plugin for ldap authentication to the users domain?

thanks

Fadim

Hey @dedicatedorange,

Yes, it's indeed possible to use both plugins simultaneously. OpenVPN can handle multiple authentication methods. You can use the openvpn-plugin-auth-pam for TOTP/Google Auth alongside openvpn-auth-ldap for LDAP authentication.

Keep in mind that the order in which you specify the plugins in your OpenVPN configuration file matters. If the first plugin fails to authenticate a user, OpenVPN will not proceed to the next. So, plan your authentication order accordingly.