OpenVPN authenticate against Windows Server 2008 Active Directory

[Guest]

[wdupreez]

I thought I'd share my experience after battling to get this to work for a long time.

To get OpenVPN to authenticate against Windows Server 2008 Active Directory, follow the KB article (kb.endian.com/entry/64), but with the following exceptions:

1. In the LDAP_USER_SEARCHFILTER value, substitute "uid" with "sAMAccountName", and remove the "loginShell" filter, eg.

Code:

LDAP_USER_SEARCHFILTER=(&(sAMAccountName=%(u)s))

2. In the LDAP_GROUP_MEMBERATTRIBUTE value, substitute "uniqueMember" with "member", eg.

Code:

LDAP_GROUP_MEMBERATTRIBUTE=member

My final configuration looks something like this:

Code:

AUTH_TYPE=certpsk
CLIENT_TO_CLIENT=on
DOMAIN=corp.mydomain.com
DROP_DHCP=on
GLOBAL_DNS=192.168.1.20
OPENVPN_ENABLED=on
PURPLECLIENT_BEGIN_DEVICE=tap2
PURPLE_DEVICE=tap0
PURPLE_IP_BEGIN=192.168.1.200
PURPLE_IP_END=192.168.1.210
PUSH_DOMAIN=on
PUSH_GLOBAL_DNS=on
PUSH_GLOBAL_NETWORKS=
AUTHENTICATION_STACK=ldap,local
LDAP_URI=ldap://192.168.1.20
LDAP_BIND_DN=cn=MyAccount,ou=UserAccounts,dc=corp,dc=mydomain,dc=com
LDAP_BIND_PASSWORD=123456
LDAP_USER_BASEDN=ou=UserAccounts,dc=corp,dc=mydomain,dc=com
LDAP_USER_SEARCHFILTER=(&(sAMAccountName=%(u)s)(objectCategory=person)(objectClass=user))
LDAP_REQUIRE_GROUP=on
LDAP_GROUP_BASEDN=ou=UserAccounts,dc=corp,dc=mydomain,dc=com
LDAP_GROUP_SEARCHFILTER=(cn=VPN Users)
LDAP_GROUP_MEMBERATTRIBUTE=member

[leso]

Thank you for your feedback , did you use endian community ver 2.4.1?

[wdupreez]

I use 2.4 - IMO there are way too many issues outstanding on 2.4.1 to use it in a production environment.

[mrkroket]

The LDAP_BIND_DN user what priviliges must have?

[wdupreez]

The LDAP_BIND_DN user what priviliges must have?

The only requirement is that the LDAP_BIND_DN user must be able to read user information from AD. Using an account that is part of the "Domain Administrators" security group ("super-user" as per the KB article) is one option, but I won't recommended it, unless you are in a test environment.

What I did was to create a user account in AD and then delegate the "Reading all user information" task to the account. Very simple.