diff options
| author | Viacheslav Hletenko <v.gletenko@vyos.io> | 2026-01-05 17:22:09 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-01-05 17:22:09 +0200 |
| commit | 658b27563ebf9e011e54b66dc7d7c06810dc448c (patch) | |
| tree | c95b21abc257dba61b1130832a9315006ecccda2 /docs | |
| parent | bcc3e14815b74831910e2417296859da682a15ff (diff) | |
| parent | 28d352a236aa0e1973d60351b954b4325c200e99 (diff) | |
| download | vyos-documentation-658b27563ebf9e011e54b66dc7d7c06810dc448c.tar.gz vyos-documentation-658b27563ebf9e011e54b66dc7d7c06810dc448c.zip | |
Merge pull request #1662 from giga1699/T7635
T7635: OpenConnect certificate based authentication mode
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/configuration/vpn/openconnect.rst | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst index 09d0574d..653a21e6 100644 --- a/docs/configuration/vpn/openconnect.rst +++ b/docs/configuration/vpn/openconnect.rst @@ -47,7 +47,7 @@ Server Configuration .. code-block:: none set vpn openconnect authentication local-users username <user> password <pass> - set vpn openconnect authentication mode <local password|radius> + set vpn openconnect authentication mode <local password|radius|certificate> set vpn openconnect network-settings client-ip-settings subnet <subnet> set vpn openconnect network-settings name-server <address> set vpn openconnect network-settings name-server <address> @@ -78,6 +78,19 @@ For generating an OTP key in VyOS, you can use the CLI command generate openconnect username <user> otp-key hotp-time +User Certificate Authentication +=============================== + +You can configure users to be authenticated by certificate by setting the authentication mode to certificate, and defining what field (by OID) in the certificate will be used to identify the username. Two pre-defined shortcuts for Common Name (OID 2.5.4.3) and User ID (OID 0.9.2342.19200300.100.1.1) have been provide as cn or uid. Otherwise a specific OID value must be provided. + +The user's certificate must be signed by the certificate authority defined in the configuration for it to be validated for authentication. + +.. code-block:: none + + set vpn openconnect authentication mode certificate + set vpn openconnect authentication mode certificate user-identifier-field cn + set vpn openconnect ssl ca-certificate <cert> + ************ Verification ************ |