OpenVPN Access Server System Administrator Guide

7 How to authenticate users with Active Directory
OpenVPN Access Server's LDAP authentication feature is general in that it interoperates with
various LDAP servers. A popular specific case is configuring Access Server to authenticate users
with a Windows Active Directory server. You will need to know a few details about your Active
Directory configuration to perform this configuration with Access Server.
Note: "DN" means Distinguished Name, a name encoding with multiple attribute=value pairs, such as
CN=Joan Smith, CN=Users, OU=Finance Group, DC=example, DC=com
What you need to know:
The "Base DN" for User Entries of all users to be authenticated by Access Server.
For an AD domain of "example.net", a typical Base DN for User Entries would be:
CN=Users, DC=example, DC=net
The Full DN and password of a user with administrative privileges in Active
Directory.
This user's credentials are used by Access Server to bind to the Active Directory server so
that it can perform a search for a given VPN user's entry in the LDAP database.
7.1.1 Configuring Access Server LDAP Authentication
On the LDAP page in the Access Server Admin Web UI,
Enter the hostname or IP address of the Active Directory server (typically also the Domain
Controller) for the domain in the Primary Server field. If there is a secondary/backup
Active Directory server, enter its hostname or IP address in the Secondary Server field.
Configure the Base DN for User Entries setting with the Base DN described above.
Note that all users to be authenticated by Access Server must have full DNs that end with
the specified Base DN. For example, with a Base DN of
CN=Users, DC=example, DC=net
these user DNs are valid:
CN=David Jones, CN=Users, DC=example, DC=net
CN=Users, DC=example, DC=net
However, these user DNs are not valid:
CN=Fred Murtok, DC=example, DC=net
CN=Alice Barnes, CN=Users, OU=Eng Group, DC=example, DC=net
For the Credentials for Initial Bind: setting, choose Using these credentials:
Then enter the Full DN and password of the administrative user (see above). Note that you
cannot simply enter "Administrator". The Full DN must be used, such as
CN=Administrator, CN=Users, DC=example, DC=net
Be sure that the Username Attribute setting is set to "sAMAccountName". This is the
attribute name that Active Directory uses to store a user's username (e.g., "abarnes")
OpenVPN Access Server System Administrator Guide
52