whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

This forum is for admins who are looking to build or expand their OpenVPN setup.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
ashwanikp42
OpenVpn Newbie
Posts: 7
Joined: Tue Mar 09, 2021 6:24 am

whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ashwanikp42 » Tue Mar 09, 2021 6:28 am

Hi Team,

We have OpenVPN-CE setup in azure VM and also we integrated Google LDAP for authentication, But the problem we are facing now is whenever a user is authenticating at that time the already connected users are getting 1-2 sec delay(They are like getting stuck screen in between their work)

Please help us here.

Thanks

ashwanikp42
OpenVpn Newbie
Posts: 7
Joined: Tue Mar 09, 2021 6:24 am

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ashwanikp42 » Wed Mar 10, 2021 8:01 am

Team,

Any update here?

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 8873
Joined: Fri Jun 03, 2016 1:17 pm

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by TinCanTech » Thu Mar 11, 2021 12:36 am

Yes, openvpn does that.

ashwanikp42
OpenVpn Newbie
Posts: 7
Joined: Tue Mar 09, 2021 6:24 am

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ashwanikp42 » Thu Mar 11, 2021 7:06 am

Thanks for the responce.

Any solution for this? Actually, we have around 400+ Users in OpenVPN currently and the login logout will happens very frequently and the existing users are facing a lot of problems because of this.

ashwanikp42
OpenVpn Newbie
Posts: 7
Joined: Tue Mar 09, 2021 6:24 am

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ashwanikp42 » Fri Mar 12, 2021 8:15 am

Team,

Any update here?

ashwanikp42
OpenVpn Newbie
Posts: 7
Joined: Tue Mar 09, 2021 6:24 am

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ashwanikp42 » Mon Mar 15, 2021 6:32 am

Team,

Any update here?

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 8873
Joined: Fri Jun 03, 2016 1:17 pm

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by TinCanTech » Mon Mar 15, 2021 2:56 pm

Openvpn is a single threaded process. If it has to wait for your back-end to authenticate users then it has to wait ..

ashwanikp42
OpenVpn Newbie
Posts: 7
Joined: Tue Mar 09, 2021 6:24 am

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ashwanikp42 » Tue Mar 16, 2021 7:04 am

Is this issue will persist with OpenVPN access server?

Can we run multiple instances of OpenVPN process in a server? (If yes please provide the reference DOC)

Also wanted to mention that this issue was not there without G-LDAP

ashwanikp42
OpenVpn Newbie
Posts: 7
Joined: Tue Mar 09, 2021 6:24 am

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ashwanikp42 » Wed Mar 24, 2021 6:56 am

Team,

Any update here?

ultramage
OpenVpn Newbie
Posts: 4
Joined: Wed Mar 24, 2021 8:03 am

Re: whenever user is authenticating at that time the already connected users are getting 1-2 sec delay

Post by ultramage » Wed Mar 24, 2021 4:01 pm

Okay, so the problem is that OpenVPN runs authentication on its main thread, synchronous / blocking mode, and this makes all traffic hang.

This is a known wontfix problem, OpenVPN instead provides an API for auth plugins to do 'deferred' asynchronous authentication.
- https://community.openvpn.net/openvpn/ticket/222
- https://community.openvpn.net/openvpn/ticket/585

OpenVPN ships with a single plugin, openvpn-auth-pam, which can be used for LDAP auth on linux, but async mode needs to be enabled through an environment variable. If you can make the auth work through the OS's PAM, see https://github.com/OpenVPN/openvpn/blob ... E.auth-pam

There are third-party plugins that act as an async wrapper for auth scripts. One is mentioned here, but you'd need to write a script...
- https://redmine.pfsense.org/issues/7905

Openvpn-auth-ldap is a third-party plugin. If that's what you're using to do ldap auth, then see https://github.com/threerings/openvpn-a ... /issues/66 and https://github.com/threerings/openvpn-auth-ldap/pull/67 however it seems the plugin's development has stopped in 2018.


Post Reply