summaryrefslogtreecommitdiff
path: root/src/conf_mode/vpn_openconnect.py
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-05-12 20:14:56 +0200
committerGitHub <noreply@github.com>2023-05-12 20:14:56 +0200
commitc60e9c932cab24bcc324f45752f0528332cc69a4 (patch)
tree9af17678e5a5f6bf786b1c0f22b3b3480ce2deaf /src/conf_mode/vpn_openconnect.py
parent0224707acc7299b02eccdd1d2df434c4a57402b5 (diff)
parent93de3abe1368cab5ab8cd292689466d7af8e86bc (diff)
downloadvyos-1x-c60e9c932cab24bcc324f45752f0528332cc69a4.tar.gz
vyos-1x-c60e9c932cab24bcc324f45752f0528332cc69a4.zip
Merge pull request #1783 from PeppyH/T3896-ocserv-config-per-x
ocserv: T3896: add CLI options to configure ocserv config-per-user/group
Diffstat (limited to 'src/conf_mode/vpn_openconnect.py')
-rwxr-xr-xsrc/conf_mode/vpn_openconnect.py11
1 files changed, 11 insertions, 0 deletions
diff --git a/src/conf_mode/vpn_openconnect.py b/src/conf_mode/vpn_openconnect.py
index 68da70d7d..7b3325d95 100755
--- a/src/conf_mode/vpn_openconnect.py
+++ b/src/conf_mode/vpn_openconnect.py
@@ -173,6 +173,17 @@ def verify(ocserv):
users_wo_pswd.append(user)
if users_wo_pswd:
raise ConfigError(f'password required for users:\n{users_wo_pswd}')
+ # Validate that if identity-based-config is configured all child config nodes are set
+ if 'identity_based_config' in ocserv["authentication"]:
+ if 'disabled' not in ocserv["authentication"]["identity_based_config"]:
+ if 'mode' not in ocserv["authentication"]["identity_based_config"]:
+ raise ConfigError('OpenConnect radius identity-based-config enabled but mode not selected')
+ elif 'group' in ocserv["authentication"]["identity_based_config"]["mode"] and "radius" not in ocserv["authentication"]["mode"]:
+ raise ConfigError('OpenConnect config-per-group must be used with radius authentication')
+ if 'directory' not in ocserv["authentication"]["identity_based_config"]:
+ raise ConfigError('OpenConnect identity-based-config enabled but directory not set')
+ if 'default_config' not in ocserv["authentication"]["identity_based_config"]:
+ raise ConfigError('OpenConnect identity-based-config enabled but default-config not set')
else:
raise ConfigError('openconnect authentication mode required')
else: