openvpn-auth-oauth2 compare openvpn username with token prefered_username

shylion

Hello.
We are using openvpn-auth-oauth2 with keycloak for authentication.
Problem is that user can set any username in openvpn client and enter correct username in keycloak.
I need to use actual username in client-connect script, but it is set to the one, which user enters in openvpn client, not keycloak

there is validate option in openvpn-auth-oauth2 config, but i can't figure out how to compare this usernames and deny access if they differ.

shylion

Figured it out myself:


validate:
    expression: >
      has(token.claims.preferred_username)
      && openvpn.commonName.lowerAscii() == string(token.claims.preferred_username).lowerAscii()

Mohsin

Nice, that validation expression looks like a clean way to handle it. Comparing openvpn.commonName directly with the Keycloak preferred username also avoids relying on whatever username the client happens to send. I’m curious though does this approach also behave as expected when the Keycloak username is changed later, or would existing client configurations need to be updated separately?

Mohammad Montazeri

Mohsin That expression checks equality; it doesn't synchronize the two names. If a later preferred_username no longer matches openvpn.commonName after lowerAscii(), validation will fail when the expression is evaluated.

Whether client configuration needs changing depends on what supplies that common name. The configuration reference defaults to common_name; when using username-as-common-name, it says to select username for that purpose.

Could you confirm your openvpn.common-name.environment-variable-name setting, whether username-as-common-name is enabled, and the OpenVPN/openvpn-auth-oauth2 versions? That would clarify what needs updating without assuming certificates must be replaced.

Mohsin

Mohammad Montazeri Got it, that clears it up. I was mainly thinking about what happens after a username change, so the difference between validation and syncing makes sense now. I’ll check which value is actually being used on my side first. It’s kinda similar to keeping employee records consistent in payroll software, where a small change in an identifier can affect other parts of the setup. I’ve seen Vertex HCM use cases where keeping those records consistent is important too.