From 28d352a236aa0e1973d60351b954b4325c200e99 Mon Sep 17 00:00:00 2001 From: Giga Murphy Date: Fri, 25 Jul 2025 00:33:36 +0000 Subject: T7635: Show OpenConnect certificate based authentication mode option in configuration example. --- docs/configuration/vpn/openconnect.rst | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'docs') diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst index 09d0574d..653a21e6 100644 --- a/docs/configuration/vpn/openconnect.rst +++ b/docs/configuration/vpn/openconnect.rst @@ -47,7 +47,7 @@ Server Configuration .. code-block:: none set vpn openconnect authentication local-users username password - set vpn openconnect authentication mode + set vpn openconnect authentication mode set vpn openconnect network-settings client-ip-settings subnet set vpn openconnect network-settings name-server
set vpn openconnect network-settings name-server
@@ -78,6 +78,19 @@ For generating an OTP key in VyOS, you can use the CLI command generate openconnect username otp-key hotp-time +User Certificate Authentication +=============================== + +You can configure users to be authenticated by certificate by setting the authentication mode to certificate, and defining what field (by OID) in the certificate will be used to identify the username. Two pre-defined shortcuts for Common Name (OID 2.5.4.3) and User ID (OID 0.9.2342.19200300.100.1.1) have been provide as cn or uid. Otherwise a specific OID value must be provided. + +The user's certificate must be signed by the certificate authority defined in the configuration for it to be validated for authentication. + +.. code-block:: none + + set vpn openconnect authentication mode certificate + set vpn openconnect authentication mode certificate user-identifier-field cn + set vpn openconnect ssl ca-certificate + ************ Verification ************ -- cgit v1.2.3