diff options
| author | Giga Murphy <giga1699@gmail.com> | 2025-07-25 00:33:36 +0000 |
|---|---|---|
| committer | Giga Murphy <giga1699@gmail.com> | 2025-12-05 20:25:15 +0000 |
| commit | 28d352a236aa0e1973d60351b954b4325c200e99 (patch) | |
| tree | f0810fd20ca20e060153f6d0cfb109ba89ec1896 | |
| parent | f39b25611e3717034b29c7e884ad96370cdd4731 (diff) | |
| download | vyos-documentation-28d352a236aa0e1973d60351b954b4325c200e99.tar.gz vyos-documentation-28d352a236aa0e1973d60351b954b4325c200e99.zip | |
T7635: Show OpenConnect certificate based authentication mode option in configuration example.
| -rw-r--r-- | docs/configuration/vpn/openconnect.rst | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst index 09d0574d..653a21e6 100644 --- a/docs/configuration/vpn/openconnect.rst +++ b/docs/configuration/vpn/openconnect.rst @@ -47,7 +47,7 @@ Server Configuration .. code-block:: none set vpn openconnect authentication local-users username <user> password <pass> - set vpn openconnect authentication mode <local password|radius> + set vpn openconnect authentication mode <local password|radius|certificate> set vpn openconnect network-settings client-ip-settings subnet <subnet> set vpn openconnect network-settings name-server <address> set vpn openconnect network-settings name-server <address> @@ -78,6 +78,19 @@ For generating an OTP key in VyOS, you can use the CLI command generate openconnect username <user> otp-key hotp-time +User Certificate Authentication +=============================== + +You can configure users to be authenticated by certificate by setting the authentication mode to certificate, and defining what field (by OID) in the certificate will be used to identify the username. Two pre-defined shortcuts for Common Name (OID 2.5.4.3) and User ID (OID 0.9.2342.19200300.100.1.1) have been provide as cn or uid. Otherwise a specific OID value must be provided. + +The user's certificate must be signed by the certificate authority defined in the configuration for it to be validated for authentication. + +.. code-block:: none + + set vpn openconnect authentication mode certificate + set vpn openconnect authentication mode certificate user-identifier-field cn + set vpn openconnect ssl ca-certificate <cert> + ************ Verification ************ |