vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-11-02 20:02:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

OpenVPN: add Active Directory auth example

Browse Source
This commit is contained in:
Christian Poessinger 2019-08-04 17:54:28 +02:00
parent 8d3fcd5bbe
commit 1c7898bc20
1 changed files with 39 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
docs/vpn/openvpn.rst
View File

@ -246,7 +246,7 @@ The required config file may look like:
# LDAP server URL # LDAP server URL
URL ldap://ldap.example.com URL ldap://ldap.example.com
# Bind DN (If your LDAP server doesn't support anonymous binds) # Bind DN (If your LDAP server doesn't support anonymous binds)
BindDN cn=Manager,dc=example,dc=com BindDN cn=LDAPUser,dc=example,dc=com
# Bind Password password # Bind Password password
Password S3cr3t Password S3cr3t
# Network timeout (in seconds) # Network timeout (in seconds)
@ -258,10 +258,47 @@ The required config file may look like:
BaseDN "ou=people,dc=example,dc=com" BaseDN "ou=people,dc=example,dc=com"
# User Search Filter # User Search Filter
SearchFilter "(&(uid=%u)(objectClass=shadowAccount))" SearchFilter "(&(uid=%u)(objectClass=shadowAccount))"
# Require Group Membership # Require Group Membership - allow all users
RequireGroup false RequireGroup false
</Authorization> </Authorization>
Active Directory
****************
Despite the fact that AD is a superset of LDAP
.. code-block:: sh
<LDAP>
# LDAP server URL
URL ldap://dc01.example.com
# Bind DN (If your LDAP server doesn’t support anonymous binds)
BindDN CN=LDAPUser,DC=example,DC=com
# Bind Password
Password mysecretpassword
# Network timeout (in seconds)
Timeout 15
# Enable Start TLS
TLSEnable no
# Follow LDAP Referrals (anonymously)
FollowReferrals no
</LDAP>
<Authorization>
# Base DN
BaseDN "DC=example,DC=com"
# User Search Filter, user must be a member of the VPN AD group
SearchFilter "(&(sAMAccountName=%u)(memberOf=CN=VPN,OU=Groups,DC=example,DC=com))"
# Require Group Membership
RequireGroup false # already handled by SearchFilter
<Group>
BaseDN "OU=Groups,DC=example,DC=com"
SearchFilter "(|(cn=VPN))"
MemberAttribute memberOf
</Group>
</Authorization>
A complete LDAP auth OpenVPN configuration could look like the following example: A complete LDAP auth OpenVPN configuration could look like the following example:
.. code-block:: sh .. code-block:: sh