# OpenVPN

> Protect OpenVPN Access Server with Ironchip using SAML or RADIUS with NPS: create the application, configure the server, grant access and test the client.

URL: https://docs.ironchip.com/en/identidad/integraciones/red/openvpn/

This guide explains how to integrate **OpenVPN Access Server** with Ironchip through [SAML](https://docs.ironchip.com/en/identidad/protocolos/saml/) or through [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/) with [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/).

## SAML

### Requirements

- OpenVPN Access Server configured.
- Access to the Ironchip admin console.

### Configure Ironchip

1. Go to **Applications** and click **New Application**.
2. Give the application a descriptive name and select the **SAML** integration type.

   [Image: New application window with the SAML type]

3. When you select the type, the **Download metadata file** button appears at the bottom. Download the metadata: you give it to the service provider (SP), in this case OpenVPN.

### Configure OpenVPN

1. In OpenVPN, go to **Authentication > SAML**.

   [Image: Authentication > SAML section in OpenVPN]

2. Enable SAML. Next you enter the metadata you downloaded.

   [Image: Enabling SAML in OpenVPN]

3. OpenVPN offers two ways to enter the metadata: with the downloaded file or manually. This guide uses the file: under **Configure Identity Provider (IdP) Automatically via Metadata**, click **Choose file**.

   [Image: Selecting the metadata file]

4. Select the metadata file and click **Upload**. To check that it was added correctly, go to the manual configuration: the fields must be filled in with the matching data.

   [Image: Manual configuration fields filled in with the metadata]

5. Add the SP (OpenVPN) metadata to the Ironchip application. In **Service Provider (SP) identity and URL**, copy the **SP Identity** URL.

   [Image: Service Provider (SP) identity and URL section]

6. Paste that URL into the **Metadata URL** field of the application you are creating in the Ironchip admin console.

   :::note
   In the current version of the console, this field is in the **Service Provider (SP)** section of the application: in **SP Metadata**, select **URL**, paste the URL and click **Import**.
   :::

7. In OpenVPN, go to **Authentication > Settings**, select SAML as the authentication method, click **Save Settings** and then **Update Running Server** to apply the changes.

   [Image: Settings with SAML as the authentication method]

### Give users access

1. Open the application you created in the Ironchip console and click the green **Add access** button.

   [Image: Add access button of the application]

2. Select the user who will authenticate.

   [Image: Selecting the user who will authenticate]

3. Select the username the user will use to access the VPN.

   [Image: Selecting the username for the VPN]

4. Set the access conditions.

   [Image: Access conditions]

### Verify with the OpenVPN client

When you create a new connection in the client, it redirects you to the OpenVPN client portal, where you can choose between a local user or SAML.

[Image: OpenVPN client portal with the SAML option]

[Image: Authenticating with Ironchip from the portal]

[Image: Connection established in the OpenVPN client]

## RADIUS

### Requirements

- The NPS role installed on a server.
- Access to the OpenVPN admin interface with administrator permissions.
- Access to the Ironchip admin console with administrator permissions.

### Configure Ironchip

1. Go to **Applications** and select **MFA Integrations**.

   [Image: MFA Integrations section]

2. Click **ADD MFA** and give it a descriptive name, in this case `OpenVPN`.

   [Image: Creating the MFA integration named OpenVPN]

3. In the next window, copy or download the credentials.

   [Image: Window to copy or download the credentials]

4. Go back to **Applications** and select **New Application**. Add a descriptive name, select the integration method you just created and, in the section that becomes available, add the policy you create later on the server.

   [Image: New application with the MFA integration and the policy]

### Configure NPS

1. Create two groups in Active Directory: one to authenticate with Ironchip and one for users who do not need MFA.
2. With the groups created and the users assigned, open NPS and create a **network policy**.

   [Image: Creating a network policy in NPS]

3. In the next window, click **Add > User Groups** and add one of the groups you created.

   [Image: Adding a user group to the policy]

4. Click **Next** until you reach **Configure Authentication Methods**. Select **Encrypted authentication (CHAP)** and **Unencrypted Authentication (PAP, SPAP)**. Click **Next** until you finish.

   [Image: CHAP and PAP authentication methods selected]

5. Go to **RADIUS Clients** and create a RADIUS client that points to OpenVPN Server. Enter a descriptive name (the name of the SP it points to), the IP and the shared secret, which you can type or generate automatically.

   [Image: RADIUS client pointing to OpenVPN Server]

6. In the Ironchip console, go to **Plugins** and download the NPS plugin on the server.

   [Image: Plugins section of the Ironchip console]

7. Run the plugin, accept the terms and conditions and fill in the parameters:

   - The API key, which is in the credentials file you downloaded when you created the MFA integration.
   - In **NPS Policies**, the policy you want to protect with Ironchip.

   [Image: NPS plugin parameters]

### Configure OpenVPN Server

1. In the OpenVPN admin interface, go to **Authentication** and select RADIUS. Enable RADIUS and the accounting reports.

   [Image: Enabling RADIUS and accounting reports]

2. Go to **RADIUS Server** and add the IP of the server where you configured NPS and the secret you set in the RADIUS client.

   [Image: NPS server IP and secret in OpenVPN]

### Give users access

For a user to access the VPN, besides being in the Active Directory group, you must create an access for them in the application in the Ironchip console.

1. Open the application in the Ironchip console and click **Add Access**.

   [Image: Add Access button in the application]

2. The platform users and groups appear. Select the user who will authenticate.

   [Image: List of platform users and groups]

3. The next window asks for a **User Name**. By default it is the email: remove the default tag and type the username. If you have Active Directory synchronized, with [AD Connect](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/ad-connect/) for an on-premises directory or with an [enterprise application](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/entra-id/) in Entra ID (formerly Azure AD), you can use the `samAccountName` tag.

   [Image: User Name field with the samAccountName tag]

4. Set the access conditions.

   [Image: Access conditions]

### Verify with the OpenVPN client

In the OpenVPN client, create a new profile and use your domain credentials to connect to the VPN.

[Image: New profile in the OpenVPN client]

When you create the profile, it asks you to authenticate.

[Image: Authentication prompt when connecting]