Integrate OpenVPN

OpenVPN is a virtual private network system to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications. See https://www.openvpn.net. You can protect access to OpenVPN by integrating OpenVPN with Identity as a Service. Once integrated, users can use single sign-on to log in to their OpenVPN account through Identity as a Service.

Note: This integration was tested using Identity as a Service version 5.33 and a trial OpenVPN version. Other versions of OpenVPN may require integration and configuration steps that differ from those documented in this procedure. In the event of other issues, contact support@entrust.com for assistance

To integrate OpenVPN with Identity as a Service, you must do the following:

Before you begin, open two browser windows. In one window, log in to your OpenVPN administrator account. In the other window, log in to your IDaaS administrator account.

Step 1: Complete the prerequisites

To complete this integration, you must do the following before you begin the integration:

1. Create and configure a Gateway.

2. Make note of the following:

● Gateway IP address

● Gateway shared secret (password)

Step 2: Configure OpenVPN for Identity as a Service authentication

1. Log in to OpenVPN as an administrator. The Status Overview page appears.

2. Expand User Management and select User Permissions. The User Permissions page appears.

3. Click More Settings select the IDaaS username for your integration admin account, for example, IDaaSuser. The User Permissions page updates to display the configuration settings.

4. Set the Configure user authentication method to RADIUS.

5. Set the TOPT-based Multi-Factor Authentication to the Default.

6. Set IP Addressing to Use Dynamic.

7. Set the Access Control to Use Nat.

8. Set the Allow Access From to all other VPN clients.

9. Set the VPN gateway to No.

10. Set the DMZ settings to No.

11. Click Save Settings.

12. Restart the VPN server, as follows:

a. In the menu pane, expand Status and select Status Overview. The Status Overview page appears.

b. Click Stop VPN services.

c. Click Confirm Stop on the confirmation prompt.

d. Click Start VPN services.

13. In the menu pane, click Authentication > RADIUS. The RADIUS page appears.

14. Open a text editor and copy the IP address in the Hostname or IP Address field. You need this value for Step 3: Add OpenVPN to Identity as a Service.

15. In the Shared Secret field, enter the shared secret that is shared with IDaaS.

16. Make note of the Authentication Port and Accounting Port. You need these in Step 3: Add OpenVPN to Identity as a Service.

17. Scroll to RADIUS Authentication Method and set PAP to Yes.

18. Click Save Settings.

19. Restart the VPN server, as follows:

a. In the menu pane, expand Status and select Status Overview. The Status Overview page appears.

b. Click Stop VPN services.

c. Click Confirm Stop on the confirmation prompt.

d. Click Start VPN services.

Step 3: Add OpenVPN to Identity as a Service

Integrate OpenVPN with Identity as a Service

1. Log in to Identity as a Service.

2. Click > Security > Applications. The Add Applications page appears.

3. Click Add. The Select an Application Template page appears.

4. Do one of the following:

● Select RADIUS and VPN Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.

- or -

● In the Search bar, enter a search option to filter for the application you want to add to IDaaS.

5. Click OpenVPN. The Add Open VPN page appears.

6. In the Application Name field, enter a name for your RADIUS client.

7. Enter a Description for your application.

8. Optional. Add an application logo:

a. Click next to Application Logo. The Upload Logo dialog box appears.

b. Click to select an image file to upload.

c. Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.

d. If required, resize your image.

e. Click OK

9. Click Next. The General page appears.

10. In the Hosts field, click Add to add the host IP address that you copied in Step 2: Configure OpenVPN for Identity as a Service authentication. The RADIUS agent receives the request on this host.

Note: If you enter multiple host names, separate each one with a comma but do not leave any spaces between them. Multiple host names indicates that the RADIUS application is running multiple replicas on multiple hosts.

11. In the Port field, enter the port on which the RADIUS agent accepts messages, enter 1812.

Attention: The RADIUS agent uses the host name that sent a request and the port number that it received the request from to determine which RADIUS application made the request. Because of that:
–Two RADIUS applications with the same port value cannot share any host names.
–Two RADIUS applications that have one or more matching host names must have different port values.

12. In the Shared Secret field, enter the shared secret that you copied in Step 2: Configure OpenVPN for Identity as a Service authentication.

13. From the Select RADIUS Agent drop-down list, select the name of the Gateway containing the RADIUS agent to OpenVPN will be assigned.

14. Optional: From the Select RADIUS Attribute for IP Address drop-down list, select TUNNEL-CLIENT-ENDPOINT (66).

15. Set the Challenge Response Queue Max Time to 180, to set the number of seconds that the RADIUS agent waits for a response to first-factor authentication.

16. In the Challenge Response Queue Max Size field, set the maximum number of second-factor challenge requests allowed in the queue of your RADIUS application. The default value is 1000 requests. The maximum value is 10,000.

17. In the Request Cache Timeout field, set the number of seconds to cache requests. The default value is 10 seconds.

18. From the Character Set drop-down list, select the character set used to decode and encode string values (including the user ID and password values) in RADIUS messages. The options are UTF-8 and ISO-8859-1.

19. Optional: Select Log RADIUS messages to enable RADIUS message logging. When enabled, messages for the RADIUS agent are logged to the same log file as the gateway logs.

20. Optional. Enable the Authentication Settings:

a. Select When authenticating the user will be asked to select their second-factor authenticator. When selected, after the user responds to the first-factor challenge, they are prompted to select their second-factor authenticator. The list of available second-factor authenticators is set by the resource rule.

The following is a list of supported strings matched to the authentication types:

– Grid: grid

– Knowledge-based Authentication: kba

– One-time password: email, sms, voice

– Smart Credential Push: scpush

– Temporary Access Code: tac

– Token: token

– Token push: push

b. Select Indicate if requests must include the message-authenticator attribute for outgoing messages to include the message-authenticator attribute for outgoing messages.

21. Leave all other settings at the default values.

22. Click Submit.

Step 4: Add a resource rule

Step 5: Test the integration

1. Open a Web browser and enter the URL for your OpenVPN client UI.

2. Log in with your username and password and then click Sign-in.

3. You are prompted to select your second-factor authentication method.

4. In the blank field, type your second-factor authentication method. For example, type grid.

5. Click Continue.

6. Enter the second-factor challenge response, for example, the grid coordinates.

7. Click Continue. The OpenVPN Access Server page appears.

8. Click the icon. The openvpn-connect.3.4.0.3121_signed.msi file downloads.

9. Install the file.

10. Navigate to your desktop and open the OpenVPN Connector. The Profiles page appears.

11. Toggle to Connect.

12. Enter the required credentials.

13. Respond to the second-factor authentication challenge.

14. Click Send. You are connected to OpenVPN.