Plugins Using Access Server's Post-Authentication Programming Hook

Access Server requests a MAC address or UUID from the OpenVPN client to authenticate with hardware addresses after username and password.

The script supports automatic address registration by default.

It can also run in manual mode, in which you must manually add approved hardware addresses on the server for users and their devices.

Using a properly configured post-auth script, you can implement an entirely new custom authentication method in Access Server.

The script indicates that it doesn’t need the Access Server to handle authentication by setting the AUTH_NULL parameter to true and must then manage authentication in the script. You then set this authentication method for specific users or groups or as the default authentication method.

You can use the custom authentication method against any credential or authentication backend that Access Server doesn’t support out of the box.

You can assign users to Access Server groups so they inherit specific access rules and settings, a task you can automate using our LDAP group mapping script.

Suppose you assign users in your LDAP directory server to groups using the group membership property memberOf. In that case, you can use the memberOf property in a post-auth script when a user signs in to Access Server.

Based on rules you must define in the post-auth script, you can automatically have users in specified LDAP groups assigned to specified Access Server groups when they authenticate.

You can assign users to Access Server groups so they inherit specific access rules and settings, a task you can automate with the RADIUS group mapping script. You can also include other settings in the script based on particular RADIUS properties.

Users in a RADIUS server can be part of groups with specific properties set. The post-auth script reads and uses these properties to automatically apply group membership and other settings.

The post-auth script is primarily designed for Windows Server and mapping users to Access Server groups but may also work on other RADIUS solutions.

You can assign users to Access Server groups with specific access rules and other settings inherited from the group, a task you can automate with our SAML group mapping script.

Users in the SAML IdP can be part of groups. You must configure this property on the SAML IdP; we provide tutorials for configuring SAML, and this property is usually the group property you can use in the post-auth script when a user logs in at the Access Server.

Based on the rules you define in the post-auth script, you can automatically assign users in specified SAML groups to specified Access Server groups when they log in at the Access Server.

You can integrate Access Server with Duo and add two-factor authentication options such as SMS, push notifications, Yubikey, etc.

If you use PAM, RADIUS, LDAP, or local authentication, you can use the provided post-auth script to integrate Duo Security into Access Server.

To set this up, you download the Duo Security post-auth script for OpenVPN Access Server from GitHub, add an API key obtained from Duo Security into the script in the appropriate section, and load the script into the Access Server.

You can create a post-auth script restricting users based on their IP addresses.

The sample script automatically registers an IP address for a user when they first authenticate and restricts their access to the registered IP address.

Users are denied access if they sign in from a new IP address.

Integrate your server with LastPass's two-factor authentication solution.

You can set up a host-checker query file in Access Server to check for specific applications on client devices and report their version numbers.

This feature enhances security and compliance by ensuring users meet certain software requirements before connecting to the VPN. You can incorporate these checks into a post-auth script to allow or deny connections based on the results.

Create a custom static or dynamic challenge/response authentication method. (This is different from the built-in MFA TOTP functionality.)

Use dynamic challenge/response for flexible, per-session challenges or static challenge/response when you need consistent, predefined challenges embedded in the connection profiles.