Integrating OpenVPN with Google Single Sign-On (SSO) streamlines user authentication and access management processes, enhancing security and user experience. By leveraging Google as the identity provider, users can log in to OpenVPN using their Google credentials, eliminating the need for separate usernames and passwords

Prerequisites

• LDAP Gsuite
• stunnel
• openvpn-auth-ldap

Create LDAP Client

Download the certificate.

Install package dependencies

Install OpenVPN auth LDAP

• openvpn-auth-ldap
• stunnel

apt install openvpn-auth-ldap stunnel4 -y

On this scenario the OpenVPN server is already running, so we just enable integration with google sso

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
local 172.31.24.60
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "route 172.31.0.0 255.255.0.0"
push "route 172.35.0.0 255.255.0.0"
push "route 172.69.0.0 255.255.0.0"
ifconfig-pool-persist ipp.txt
log /var/log/openvpn/openvpn.log
status /var/log/openvpn/openvpn-status.log
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
##plugin auth-ldap
verb 3 
crl-verify crl.pem
username-as-common-name
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth-ldap.conf
verify-client-cert optional
####
max-clients 1022
duplicate-cn
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Move the LDAP credentials to /etc/openvpn

mv ldap* /etc/openpn

Create config file in /etc/openvpn/auth-ldap.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<LDAP>
  URL ldaps://ldap.google.com:636 #
  Timeout 15
  TLSEnable false
  TLSCACertDir /etc/ssl/certs
  TLSCertFile /etc/openvpn/ldap-client.pem
  TLSKeyFile /etc/openvpn/ldap-client.key
</LDAP>
<Authorization>
  BaseDN "dc=rotreein,dc=my.id"
  SearchFilter "(uid=%u)" # (or choose your own LDAP filter for users)
  RequireGroup false
</Authorization>
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Create config file in /etc/stunnel/google-ldap.conf

1
2
3
4
5
6
[ldap]
client = yes
accept = 127.0.0.1:1636
connect = ldap.google.com:636
cert = /etc/openvpn/ldap-client.pem
key = /etc/openvpn/ldap-client.key
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX