Integrate Okta With OpenVPN Access Server Via RADIUS

Introduction

Configuring OpenVPN Access Server to authenticate against Okta can be done with RADIUS. Using RADIUS, it supports Multi-Factor Authentication (MFA), which is not supported by LDAP. That’s one of the benefits of a lengthier setup.

The following pieces will make up the RADIUS integration between Okta and OpenVPN Access Server:

Okta RADIUS app
Okta RADIUS agent
OpenVPN Access Server
Okta directory

Add Generic RADIUS application in Okta

To start, you’ll need to add a RADIUS app on your Okta Admin Console. This is because the RADIUS port and shared secret must go through the Console to connect a RADIUS agent with the VPN.

NOTE: Okta RADIUS only supports PAP-based authentication, which is supported by OpenVPN Access Server.

From your Okta Admin Console, click on Applications > Applications.
Click on Add Application, then search for RADIUS.
From the search results, choose RADIUS App and click on Add.
After creating the app, you need to configure it starting with the Sign on tab:

Authentication: Leave this as default.
UDP Port: 1812
Secret Key: Enter the secret key that will be used to encrypt and decrypt the user password. It will be identical to what is configured on the OpenVPN Access Server.
Application username format: Select from the drop-down how the RADIUS client sends the username.
Password Reveal: Check if you want your users to securely see their password.
The final step is to add users to the app. All Users or Groups here will have access to OpenVPN Access Server’s Client UI using their Okta credentials.

Install the Okta RADIUS Agent

You can install the agent on a Windows Server or request the Linux agent from Okta, which is considered Early Access. The steps for the Windows Server are first, followed by the Linux agent after that.

Install Okta RADIUS Agent on Windows Server

From your Okta Administrator Dashboard, select Settings > Downloads, then scroll down to the Okta RADIUS Server Agent and click Download Latest
Run the downloaded file to install the agent on your Windows Server
For the proxy information, choose whether to define specifics or use a direct connection
Enter your Okta org ID for the subdomain
Sign on with Okta admin credentials
Click the Allow Access button
The RADIUS agent completes installation
Click Finish to complete the RADIUS agent installation on Windows Server
Next, open your Windows Defender Firewall with Advanced Security and click on New Rule
Select Port
Select the UDP protocol and enter the port number you’re using
Select Allow the connection
Set Profile for your network needs, then enter a name such as Okta RADIUS and click Finish.

Install Okta RADIUS Agent on Linux

Installing Okta RADIUS agent on Linux requires contacting Okta Support. It’s considered an early access feature. You’ll need to request to have it added to your downloads.

After Support has added the Linux agent for you, in your Okta admin panel, click on Settings > Downloads. Select the link next to the Okta RADIUS Server Agent for your Linux OS.
Upload the file to your Linux server. Then validate the download by entering the following command to generate the hash on your local machine. Note: replace ‘setup’ with the file path to your downloaded file.
```
sha512sum 
```
Verify that the generated hash matches the hash in your Okta Admin Console on the Downloads page.

These next steps should be done with root privileges. Install the agent using either rpm or apt (for DEB).

rpm -Uvh OktaRadiusSetupRPM-{version#}.rpm

apt install /${PATH_TO_FILE}/OktaRadiusAgentSetup-{version#}.deb

During installation, you’ll be prompted to enter your base URL for Okta. Example: https://yourbiz.okta.com.
After that, you’ll be prompted to authenticate with your Okta tenant. Copy the URL into a web browser.
In the browser, click on Allow Access.
The Linux terminal will display a message that installation is complete .

For more detailed information about the agent, refer to Okta’s Linux RADIUS agent documentation.

Configuring OpenVPN Admin Web UI RADIUS

Now you’ll configure OpenVPN Access Server to use Okta for credentials via RADIUS.

Login to the OpenVPN Admin Web UI and click on Authentication > RADIUS. Click on User Radius then Update Running Server.
Next, enter your RADIUS Authentication details. The following four are required. Other fields are optional.

Select RADIUS Authentication Method	Select PAP
Hostname or IP Address	Hostname or IP Address of your server with the Okta RADIUS agent
Shared secret	The shared secret in the Okta RADIUS app
Authentication port	The port in the Okta RADIUS app

Click on Save Settings and Update Running Server.
OpenVPN Access Server will now use Okta for login credentials.

Logging in to Client UI

When a user now logs in, they will use their Okta credentials as well as the MFA setup in the Okta admin panel.

User goes to the OpenVPN Access Server Client UI in their browser, enters credentials and clicks Sign In.
After clicking sign in, they see the MFA, based on what is set up with Okta (for example, using SMS).
Once they complete the multi-factor authentication, they successfully log in and can choose the client or config file needed.

Troubleshooting

MFA is not setup in Okta admin panel:

If you encounter an error message, Access denied, or invalid creds, it may be that you haven’t completed the multifactor configuration in the security section of your Okta admin panel. Also, if you check the logging in your RADIUS app, you’ll see the error message, “User does not have a valid factor enrolled.”

This is because the RADIUS app has a requirement to use multifactor, through a default sign on rule:

To resolve the error, you can either set up Multifactor for users or create a new sign-on rule with a higher priority.

Setup Okta Multifactor

In your Okta admin panel, go to Security > Multifactor.
Set up and configure the MFA factor of your choice.

Create a rule that doesn’t require MFA for logging in

From the Sign On tab for your RADIUS application, scroll to the bottom and click on Add Rule.
Enter the new rule without the Multifactor box checked and click Save.
Make sure your new rule is a higher priority than the default rule and your users will no longer be prompted for an additional authorization.

MFA causes user lockout in OpenVPN Access Server

If your user receives a ‘LOCKOUT’ error message when attempting to login, it may be due to the steps it takes to enroll in MFA through their OpenVPN Client UI. This is caused by Access Server's lockout policy. Refer to Authentication failure lockout policy for the default values and how to adjust settings. The steps below show you the error as received by the user.

If your user hasn’t enrolled in MFA yet, when they first login, they will be prompted:

After entering their credentials, they are asked to login with MFA available.
After enrolling, they are asked for a phone number.
Once entering their phone number, they must then enter the code sent to their phone.
They then receive a LOCKOUT message.

This happens because the CHALLENGES are seen as login attempts from the OpenVPN Access Server. If you review your logs in the Admin Web UI, you’ll see those.

If the user waits 15 minutes, they can then login again. In that case they will only go through the login credentials step and one MFA step.

Questions