From aa77ce484afa1686a8638298ba6673468fdf7aa5 Mon Sep 17 00:00:00 2001 From: Jamie Austin Date: Mon, 15 May 2023 14:37:27 +1000 Subject: T3896: ocserv: openconnect: document identity based configuration --- docs/configuration/vpn/openconnect.rst | 45 ++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) (limited to 'docs/configuration/vpn') diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst index 1b4d4b4c..8479bcff 100644 --- a/docs/configuration/vpn/openconnect.rst +++ b/docs/configuration/vpn/openconnect.rst @@ -222,6 +222,51 @@ To display the configured OTP user settings, use the command: show openconnect-server user otp +Identity Based Configuration +============================ + +OpenConnect supports a subset of it's configuration options to be applied on a +per user/group basis, for configuration purposes we refer to this functionality +as "Identity based config". The following `OpenConnect Server Manual +`_ +outlines the set of configuration options that are allowed. This can be +leveraged to apply different sets of configs to different users or groups of +users. + +.. code-block:: none + + sudo mkdir -p /config/auth/ocserv/config-per-user + sudo touch /config/auth/ocserv/default-user.conf + + set vpn set vpn openconnect authentication identity-based-config mode user + set vpn openconnect authentication identity-based-config directory /config/auth/ocserv/config-per-user + set vpn openconnect authentication identity-based-config default-config /config/auth/ocserv/default-user.conf + +.. warning:: The above directory and default-config must be a child directory +of /config/auth, since files outside this directory are not persisted after an +image upgrade. + +Once you commit the above changes you can create a config file in the +/config/auth/ocserv/config-per-user directory that matches a username of a +user you have created e.g. "tst". Now when logging in with the "tst" user the +config options you set in this file will be loaded. + +Be sure to set a sane default config in the default config file, this will be +loaded in the case that a user is authenticated and no file is found in the +configured directory matching the users username/group. + +.. code-block:: node + sudo nano /config/auth/ocserv/config-per-user/tst + +The same configuration options apply when Identity based config is configured +in group mode except that group mode can only be used with RADIUS +authentication. + +.. warning:: OpenConnect server matches the filename in a case sensitive +manner, make sure the username/group name you configure matches the +filename exactly. + Configuring RADIUS accounting ============================= -- cgit v1.2.3