4

I'm looking to build a set of services that require a single sign on. Basically, you login to my oAuth provider, and you have access to an openvpn connection(or wireguard) and a website, without additional security needed, with the possible exception of an original setup.

My question therefore is: How do I automate openVpn so that I can do either one of two things:

  1. Authenticate my connection with a token instead of a password/username

Or

  1. Authenticate my connection with a username/password, that I can then send to my oAuth provider and return a token to the client, for other applications
SoftwareRocks
  • 41
  • 1
  • 3

3 Answers3

2

Read man openvpn. It is the definitive source of information about OpenVPN.

Let me just copy-paste a part of that page. I think this should completely answer your question:

--auth-token token

This is not an option to be used directly in any configuration files, but rather push this option from a --client-connect script or a --plugin which hooks into the OPENVPN_PLUGIN_CLIENT_CONNECT or OPENVPN_PLUGIN_CLIENT_CONNECT_V2 calls. This option provides a possibility to replace the clients password with an authentication token during the lifetime of the OpenVPN client.

Whenever the connection is renegotiated and the --auth-user-pass-verify script or --plugin making use of the OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY hook is triggered, it will pass over this token as the password instead of the password the user provided. The authentication token can only be reset by a full reconnect where the server can push new options to the client. The password the user entered is never preserved once an authentication token have been set. If the OpenVPN server side rejects the authentication token, the client will receive an AUTH_FAIL and disconnect.

The purpose of this is to enable two factor authentication methods, such as HOTP or TOTP, to be used without needing to retrieve a new OTP code each time the connection is renegotiated. Another use case is to cache authentication data on the client without needing to have the users password cached in memory during the life time of the session.

To make use of this feature, the --client-connect script or --plugin needs to put

push "auth-token UNIQUE_TOKEN_VALUE"

into the file/buffer for dynamic configuration data. This will then make the OpenVPN server to push this value to the client, which replaces the local password with the UNIQUE_TOKEN_VALUE.

Nikita Kipriyanov
  • 8,033
  • 1
  • 21
  • 39
1

I have come across a few references while I was searching for a similar Single Sign On requirement for WireGuard. I am listing them down below.

Prathamesh Gharat
  • 11
  • 1
1

Depends which provider you are using, but there's an open-source WireGuard VPN (https://github.com/firezone/firezone) that supports any SSO provider with an OIDC connector.

jgong
  • 11
  • 1
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Jun 17 '22 at 07:26