It's a very lightly modified version of the SAML post_auth script I found here. <
https://openvpn.net/vpn-server-resources/access-server-post-auth-script-saml-group-mapping/> I've put a slightly redacted version below.
The basic idea is we have a default deny group unless you are in a few specific SAML groups.
What I've found is I have to set GROUP_SELECT to True in order for SAML to authorize a new user. Without it their SAML groups are ignored and they just get that default deny. However when it's True, autologin won't work because the script passes back a blank/empty group assignment rather than using the stored one from the database.
If I turn GROUP_SELECT back off, autologin works using group membership from the database, but SAML doesn't, new users get "Your account has been suspended." because they've been dumped in the deny group before the SAML processing happens.
import re,subprocess
from pyovpn.plugin import *
# When True, indicates that script will select the user's group
# by setting proplist['conn_group'] and that user properties
# will be fetched from the DB after the post_auth method returns
# rather than before.
GROUP_SELECT = True
# this function is called by the Access Server after normal authentication
def post_auth(authcred, attributes, authret, info):
# default group assignment
group = ""
# user properties to save
proplist_save = {}
# set this to error string, if auth fails
error = ""
saml_username = None
if info.get('auth_method') == 'saml': # this code only operates when the Access Server auth method is set to SAML
group_attribute_name = 'groups' # if your SAML IdP sends group information in another attribute, change this
saml_username = authret['user']
saml_groups = info['saml_attr'].get(group_attribute_name, None)
if saml_groups:
print(f"***** POST_AUTH: List of received SAML groups: {saml_groups}")
# determine the Access Server group based on SAML group settings
mapped_group = determine_group(saml_groups)
if mapped_group:
group = mapped_group
else:
print(f'***** POST_AUTH: Groups for user {saml_username} are not reported, please check your IdP configuration')
if saml_username and group:
print("***** POST_AUTH: User group mapping found for %r, setting OpenVPN connection group to %r ..." % (saml_username, group))
authret['proplist']['conn_group'] = group
proplist_save['conn_group'] = group
elif authret['user'] == "openvpn":
authret['proplist']['conn_group'] = "admin"
proplist_save['conn_group'] = "admin"
elif saml_username:
print(
"***** POST_AUTH: No group mapping matches found for %r ... Using default group settings..." % saml_username)
# process error, if one occurred
if error:
authret['status'] = FAIL
authret['reason'] = error # this error string is written to the server log file
authret['client_reason'] = error # this error string is reported to the client user
return authret, proplist_save
# Adjust these to map the user's SAML group membership to an Access Server group.
def determine_group(saml_groups):
group = "deny"
if 'idautoID=a8732512-b539-4175-8cbb-24113652bff6,ou=Groups,dc=meta' in saml_groups :
if 'idautoID=88089db6-0aea-458c-8f53-26b68cb9f690,ou=Groups,dc=meta' in saml_groups :
group = "networkservices"
elif 'idautoID=2bcbb15a-4c77-484b-9642-2ddc74e36691,ou=Groups,dc=meta' in saml_groups :
group = "technology"
elif 'idautoID=269bd882-db94-4a04-9555-c9330f58c871,ou=Groups,dc=meta' in saml_groups:
group = "risk"
elif 'idautoID=5d01a737-7ce5-470e-bd88-690cb4dbdb48,ou=Groups,dc=meta' in saml_groups:
group = "fshr"
elif 'idautoID=36bf4aaa-c0c2-49a8-a63d-7031db40ffda,ou=Groups,dc=meta' in saml_groups:
group = "facilities"
elif 'idautoID=8eff0dc3-3e6c-4047-a1cc-7685e5c66c46,ou=Groups,dc=meta' in saml_groups:
group = "contractor"
else:
group = "allow"
return group
