Authentication

Local

By default, Access Server uses local authentication. With local auth, Access Server stores user information in a SQLite database included in the package at: /usr/local/openvpn_as/etc/db/userprop.db.

PAM

There are no configuration options for PAM authentication in the Admin Web UI. If you select PAM, the underlying OS manages the PAM user credentials.

RADIUS

To enable RADIUS, you must configure it under Authentication: RADIUS. For more details, click here for information on the RADIUS page.

LDAP

To enable LDAP, you must configure it under Authentication: LDAP. For more details, click here for information on the LDAP page.

SAML

To enable SAML, you must configure it under Authentication: SAML. For more details, click here for the information on the SAML page.

PAS only

To enable post-auth-script-only authentication (PAS only), you must configure it with your own custom post-auth script. For more details, click here for information about PAS-only authentication.

Enable RADIUS Authentication

Set the toggle to Yes to enable RADIUS authentication as the default authentication or for assigned users and groups. With the toggle set to No, RADIUS authentication isn't used as an additional authentication method.

Enable RADIUS Accounting reports

When enabled, Access Server sends accounting requests to the RADIUS server via the accounting port.

Account names are case-sensitive

When you set case-sensitive to Yes, Access Server uses case-sensitive username matching. The user admin is different from Admin; the two different users have their own settings. If you set case-sensitive to No, you could have a lowercase user, admin, on Access Server and an uppercase user, Admin, on the RADIUS server, but Access Server grants both users the same rights.

Hostname or IP Address

Specify the hostname or IP address for each RADIUS server.

Shared Secret

Specify the shared secret. You must configure the RADIUS server with the same shared secret.

Authentication Port

Define the port where the RADIUS protocol sends UDP packets. The default port is 1812.

Accounting Port

Define the port where the RADIUS protocol listens for accounting requests. The default port is 1813, and the accounting port is only required when you enable RADIUS accounting.

Verify Message-Authenticator Attribute

Whether to verify the integrity and authenticity of RADIUS messages. The message-authenticator contains a 16-byte HMAC-MD5 hash of the entire RADIUS packet, including the shared secret, ensuring that the packet hasn't been tampered with and is from a trusted source.

Enable LDAP Authentication

Set the toggle to Yes to enable LDAP as the default authentication or for assigned users and groups. For example, you can create administrators for Access Server that use local authentication and LDAP authentication for VPN users. With the toggle set to No, LDAP authentication isn’t used as an additional authentication method.

Use SSL to connect to LDAP servers

This setting establishes a secure, SSL-protected connection to the LDAP servers(s) for all LDAP operations.

Account names are case-sensitive

This setting determines whether authentication matches case sensitivity for the usernames.

Re-verify autologin user on connect

When enabled, this check forces Access Server to check that a user exists in the LDAP directory when connecting with an autologin profile. If disabled, it’s possible that a user downloaded an autologin profile when the user account matched a user on the LDAP server. However, it has since been removed from the LDAP directory and could still connect with the autologin profile.

Primary Server

Define the primary LDAP server, either as a hostname or IP address.

Secondary Server

(Optional) Define the secondary LDAP server. If present, Access Server attempts to communicate with the secondary server if the connection to the primary server fails.

Credentials for Initial Bind

This setting determines if Access Server binds to the LDAP server anonymously or with specified credentials for the initial bind. We recommend using credentials as a security best practice.

Base DN for User Entries

Access Server uses this base distinguished name (DN) to perform an LDAP query to find the user's entry.

Username Attribute

The username attribute is the field name from the LDAP attributes of your LDAP server that represents the user ID, such as uid or sAMAccountName.

LDAP filter (optional)

This optional setting specifies a restriction (in LDAP query form) on a user's LDAP entry that must be true for the authentication to succeed. You can also use it to require membership in a particular LDAP group (specified by its group DN) for all users permitted to authenticate to Access Server.

Enable SAML authentication

Set the toggle to Yes to enable SAML as the default authentication or for assigned users and groups. For example, you can create administrators for Access Server that use local authentication and use SAML authentication for VPN users. With the toggle set to No, SAML authentication isn’t used as an additional authentication method.

Send ForceAuthn flag to IdP to require user interaction

When set to yes, this forces users to authenticate with the IdP regardless of any authenticated state with the IdP.

Send custom AuthnContext to IdP

Include specific methods in the authentication request sent to the IdP, such as Password, PasswordProtectedPassword, TLSClient, X509, Kerberos, etc. The default (when set to No) is PasswordProtectedTransport.

AuthnContexts to include in the AuthNRequest. This is a space separated list of AuthnContext to request.

Enter the authentication methods as a space-separated list in this text field after setting the AuthnContext flag to Yes.

Service Provider (SP) identity and URL

Provide this information for Access Server as your service provider to the IdP.

VPN Authentication Timeout (seconds)

This timeout determines how long the SAML session is valid. The default is 180 seconds.

Hostname

The hostname is the Access Server hostname as a service provider. The default is the server's hostname. You can optionally set this to a different, SAML-specific hostname.

SP Certificate

The SP certificate is the service provider certificate for your Access Server. It is a PEM-formatted SAML certificate. By default, Access Server generates the certificate provided here. Optionally, you can change it to a custom certificate.

SP Private key

The SP private key is the service provider private key for your Access Server. It is a PEM-formatted SAML private key. By default, Access Server generates the private key provided here. Optionally, you can change it to a custom private key.

IdP Metadata URL

Enter the metadata URL from your IdP and click Get to configure IdP settings automatically.

Select IdP Metadata File

Select a file from your IdP and click Upload to configure IdP settings automatically.

IdP EntityID

Enter the identity provider issuer or identifier.

Sign-on Endpoint

Enter the identity provider's single sign-on URL or login URL.

Log-out Endpoint (optional)

Enter the optional log-out URL.

Certificate (PEM) format

Enter the IdP certificate as text.