It took me a while to decipher the answer that novaflash provided, but it is correct.
I had to implement this from the CLI in order to achieve some Google Auth implementation we needed. We wanted to restrict google auth to only a certain group. So, my group will be called
googleauth.
The first thing I did to understand what's going on here is I added the group via the web interface, using the name
googleauth. Then, via some trial and error, I identified the properties I need to pass to confdba. I need
--userdb which says to query the Users's config database. I need
--show which just means show me general information. I need
--prof to identify which profile (think of profile as username or group name) to show.
So, I issued the command:
Code: Select all
cd /usr/local/openvpn_as/scripts
./confdba --userdb --show --prof googleauth
This produced the following result:
Code: Select all
{
"googleauth": {
"c2s_dest_s": "false",
"c2s_dest_v": "false",
"group_declare": "true",
"prop_autologin": "false",
"prop_deny": "false",
"prop_google_auth": "true",
"prop_superuser": "false",
"type": "group"
}
}
Now I know that I essentially need to emulate this setup, but from the CLI.
-----------------------------
Step 1. Create the group using
sacli.
Code: Select all
cd /usr/local/openvpn_as/scripts
./sacli --user googleauth --key type --value group UserPropPut
The original example provided by novaflash includes a
-m parameter, however sacli does not have that option. The above command creates group named
googleauth.
Step 2. Configure the group options to match the JSON above, that was produced by creating the user from the UI
Code: Select all
cd /usr/local/openvpn_as/scripts
./confdba --userdb --prof googleauth --mod --key c2s_dest_s --value false
./confdba --userdb --prof googleauth --mod --key c2s_dest_v --value false
./confdba --userdb --prof googleauth --mod --key group_declare --value true
./confdba --userdb --prof googleauth --mod --key prop_autologin --value false
./confdba --userdb --prof googleauth --mod --key prop_deny --value false
./confdba --userdb --prof googleauth --mod --key prop_google_auth --value true
./confdba --userdb --prof googleauth --mod --key prop_superuser --value false
./confdba --userdb --prof googleauth --mod --key type --value group
Note that the
--mod directive is required above.
Step 3. Start sacli
Code: Select all
cd /usr/local/openvpn_as/scripts
./sacli start
-----------------------------
After doing the above steps, I now have a new group that requires Google Authentication.