OpenVPN

This guide explains how to integrate OpenVPN Access Server with Ironchip through SAML or through RADIUS with NPS.

SAML

Requirements

• OpenVPN Access Server configured.
• Access to the Ironchip admin console.

Configure Ironchip

1. Go to Applications and click New Application.

2. Give the application a descriptive name and select the SAML integration type.

   

3. When you select the type, the Download metadata file button appears at the bottom. Download the metadata: you give it to the service provider (SP), in this case OpenVPN.

Configure OpenVPN

1. In OpenVPN, go to Authentication > SAML.

   

2. Enable SAML. Next you enter the metadata you downloaded.

   

3. OpenVPN offers two ways to enter the metadata: with the downloaded file or manually. This guide uses the file: under Configure Identity Provider (IdP) Automatically via Metadata, click Choose file.

   

4. Select the metadata file and click Upload. To check that it was added correctly, go to the manual configuration: the fields must be filled in with the matching data.

   

5. Add the SP (OpenVPN) metadata to the Ironchip application. In Service Provider (SP) identity and URL, copy the SP Identity URL.

   

6. Paste that URL into the Metadata URL field of the application you are creating in the Ironchip admin console.

   Note

   In the current version of the console, this field is in the Service Provider (SP) section of the application: in SP Metadata, select URL, paste the URL and click Import.

7. In OpenVPN, go to Authentication > Settings, select SAML as the authentication method, click Save Settings and then Update Running Server to apply the changes.

   

Give users access

1. Open the application you created in the Ironchip console and click the green Add access button.

   

2. Select the user who will authenticate.

   

3. Select the username the user will use to access the VPN.

   

4. Set the access conditions.

   

Verify with the OpenVPN client

When you create a new connection in the client, it redirects you to the OpenVPN client portal, where you can choose between a local user or SAML.

RADIUS

Requirements

• The NPS role installed on a server.
• Access to the OpenVPN admin interface with administrator permissions.
• Access to the Ironchip admin console with administrator permissions.

Configure Ironchip

1. Go to Applications and select MFA Integrations.

   

2. Click ADD MFA and give it a descriptive name, in this case OpenVPN.

   

3. In the next window, copy or download the credentials.

   

4. Go back to Applications and select New Application. Add a descriptive name, select the integration method you just created and, in the section that becomes available, add the policy you create later on the server.

   

Configure NPS

1. Create two groups in Active Directory: one to authenticate with Ironchip and one for users who do not need MFA.

2. With the groups created and the users assigned, open NPS and create a network policy.

   

3. In the next window, click Add > User Groups and add one of the groups you created.

   

4. Click Next until you reach Configure Authentication Methods. Select Encrypted authentication (CHAP) and Unencrypted Authentication (PAP, SPAP). Click Next until you finish.

   

5. Go to RADIUS Clients and create a RADIUS client that points to OpenVPN Server. Enter a descriptive name (the name of the SP it points to), the IP and the shared secret, which you can type or generate automatically.

   

6. In the Ironchip console, go to Plugins and download the NPS plugin on the server.

   

7. Run the plugin, accept the terms and conditions and fill in the parameters:

   • The API key, which is in the credentials file you downloaded when you created the MFA integration.
   • In NPS Policies, the policy you want to protect with Ironchip.

   

Configure OpenVPN Server

1. In the OpenVPN admin interface, go to Authentication and select RADIUS. Enable RADIUS and the accounting reports.

   

2. Go to RADIUS Server and add the IP of the server where you configured NPS and the secret you set in the RADIUS client.

   

Give users access

For a user to access the VPN, besides being in the Active Directory group, you must create an access for them in the application in the Ironchip console.

1. Open the application in the Ironchip console and click Add Access.

   

2. The platform users and groups appear. Select the user who will authenticate.

   

3. The next window asks for a User Name. By default it is the email: remove the default tag and type the username. If you have Active Directory synchronized, with AD Connect for an on-premises directory or with an enterprise application in Entra ID (formerly Azure AD), you can use the samAccountName tag.

   

4. Set the access conditions.

   

Verify with the OpenVPN client

In the OpenVPN client, create a new profile and use your domain credentials to connect to the VPN.

When you create the profile, it asks you to authenticate.