On 18/01/2019 16:52, Gert Doering wrote: Just clarifying this one
> Approach 2: work with auth tokens, but this is somewhat "work in progress" > on the openvpn side (you need to use fairly recent openvpn versions and > some sort of token-aware authenticaiton plugin). If the authentication mechanism (--user-pass-verify coupled with --client-connect or the --plugin) can generate an authentication token, they can send that via a '--push "auth-token $TOKEN_VALUE"' to the client and it should work just fine. But quite few auth-plugins out there in the wild does that. This works with at least v2.3.x (and possibly v2.2.x) clients and servers. But there is a third approach which requires a v2.4.x _server_ ... using the new --auth-gen-token feature. This is being worked on for further improvements, but should work okay-ish unless there a much more advanced setup required. With this, in the server config you just need to add this option, with an optional argument with an expiry time. The issues we have is related to expired/invalidated tokens, which is needs improvements also on the client side. So using the expiry feature is a bit rougher on the edges. -- kind regards, David Sommerseth OpenVPN Inc
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
