> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # OpenVPN OpenVPN is a virtual private network system to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications. See . You can protect access to OpenVPN by integrating OpenVPN with Identity as a Service. Once integrated, users can use single sign-on to log in to their OpenVPN account through Identity as a Service. note This integration was tested using Identity as a Service version 5.33 and a trial OpenVPN version. Other versions of OpenVPN may require integration and configuration steps that differ from those documented in this procedure. In the event of other issues, contact for assistance Before you begin, open two browser windows. In one window, log in to your OpenVPN administrator account. In the other window, log in to your IDaaS administrator account. ### Step 1: Complete the prerequisites To complete this integration, you must do the following before you begin the integration: 1. [Create and configure a Gateway](/docs/gateways/create-and-configure-a-gateway.md). 2. Make note of the following: - Gateway IP address - Gateway shared secret (password) ### Step 2: Configure OpenVPN for Identity as a Service authentication 1. Log in to OpenVPN as an administrator. The **Status Overview** page appears. 2. Expand **User Management** and select **User Permissions**. The **User Permissions** page appears. 3. Click **More Settings** select the IDaaS username for your integration admin account, for example, IDaaSuser. The **User Permissions** page updates to display the configuration settings. 4. Set the **Configure user authentication method** to **RADIUS**. 5. Set the **TOPT-based Multi-Factor Authentication** to the **Default**. 6. Set **IP Addressing** to **Use Dynamic**. 7. Set the **Access Control** to **Use Nat**. 8. Set the **Allow Access From** to **all other VPN clients**. 9. Set the **VPN gateway** to **No**. 10. Set the **DMZ settings** to **No**. 11. Click **Save Settings**. 12. Restart the VPN server, as follows: 1. In the menu pane, expand **Status** and select **Status Overview**. The **Status Overview** page appears. 2. Click **Stop VPN services**. 3. Click **Confirm Stop** on the confirmation prompt. 4. Click **Start VPN services**. 13. In the menu pane, click **Authentication > RADIUS**. The **RADIUS** page appears. 14. Open a text editor and copy the IP address in the **Hostname or IP Address** field. You need this value for _Step 3: Add OpenVPN to Identity as a Service_. 15. In the **Shared Secret** field, enter the shared secret that is shared with IDaaS. 16. Make note of the Authentication Port and Accounting Port. You need these in _Step 3: Add OpenVPN to Identity as a Service._ 17. Scroll to **RADIUS Authentication Method** and set **PAP** to **Yes**. 18. Click **Save Settings**. 19. Restart the VPN server, as follows: 1. In the menu pane, expand **Status** and select **Status Overview**. The **Status Overview** page appears. 2. Click **Stop VPN services**. 3. Click **Confirm Stop** on the confirmation prompt. 4. Click **Start VPN services**. ### Step 3: Add OpenVPN to Identity as a Service 1. Log in to Identity as a Service. 2. Click Menu icon **>** **Security > Applications**. The **Add Applications** page appears. 3. Click **Add**. The **Select an Application Template** page appears. 4. Do one of the following: - Select **RADIUS and VPN Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS. - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS. 5. Click **OpenVPN**. The **Add Open VPN** page appears. 6. In the **Application Name** field, enter a name for your RADIUS client. 7. Enter a **Description** for your application. 8. Optional. Add an application logo: 1. Click Circle Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears. 2. Click Arrow Up From Line icon to select an image file to upload. 3. Browse to select your file and click **Open**. The **Upload Logo** **dialog box** displays your selected image. 4. If required, resize your image. 5. Click **OK**. 9. Click **Next**. The **General** page appears. 10. In the **Hosts** field, click **Add** to add the host IP address that you copied in _Step 2: Configure OpenVPN for Identity as a Service authentication_. The RADIUS agent receives the request on this host. note If you enter multiple host names, separate each one with a comma but do not leave any spaces between them. Multiple host names indicates that the RADIUS application is running multiple replicas on multiple hosts. 11. In the **Port** field, enter the port on which the RADIUS agent accepts messages, enter **1812**. warning The RADIUS agent uses the host name that sent a request and the port number that it received the request from to determine which RADIUS application made the request. Because of that: - Two RADIUS applications with the same port value cannot share any host names. - Two RADIUS applications that have one or more matching host names must have different port values. 12. In the **Shared Secret** field, enter the shared secret that you copied in _Step 2: Configure OpenVPN for Identity as a Service authentication_. 13. From the **Select** **RADIUS Agent** drop-down list, select the name of the Gateway containing the **RADIUS agent** to OpenVPN will be assigned. 14. Optional: From the **Select RADIUS Attribute for IP Address** drop-down list, select **TUNNEL-CLIENT-ENDPOINT (66)**. 15. Set the **Challenge Response Queue Max Time** **to** **180**, to set the number of seconds that the RADIUS agent waits for a response to first-factor authentication. 16. In the **Challenge Response Queue Max Size** field, set the maximum number of second-factor challenge requests allowed in the queue of your RADIUS application. The default value is 1000 requests. The maximum value is 10,000. 17. In the **Request Cache Timeout** field, set the number of seconds to cache requests. The default value is 10 seconds. 18. From the **Character Set** drop-down list, select the character set used to decode and encode string values (including the user ID and password values) in RADIUS messages. The options are ISO-8859-1. 19. Optional: Select **Log RADIUS messages** to enable RADIUS message logging. When enabled, messages for the RADIUS agent are logged to the same log file as the gateway logs. 20. Optional. Enable the **Authentication Settings**: 1. Select **When authenticating the user will be asked to select their second-factor authenticator**. When selected, after the user responds to the first-factor challenge, they are prompted to select their second-factor authenticator. The list of available second-factor authenticators is set by the resource rule. The following is a list of supported strings matched to the authentication types: - Grid: grid - Knowledge-based Authentication: kba - One-time password: email, sms, voice - Smart Credential Push: scpush - Temporary Access Code: tac - Token: token - Token push: push 2. Select **Indicate if requests must include the message-authenticator attribute for outgoing messages** to include the message-authenticator attribute for outgoing messages. 21. Leave all other settings at the default values. 22. Click **Submit**. ### Step 4: Add a resource rule See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md). ### Step 5: Test the integration 1. Open a Web browser and enter the URL for your OpenVPN client UI. 2. Log in with your username and password and then click **Sign-in**. 3. You are prompted to select your second-factor authentication method. 4. In the blank field, type your second-factor authentication method. For example, type **grid**. 5. Click **Continue**. 6. Enter the second-factor challenge response, for example, the grid coordinates. 7. Click **Continue**. The **OpenVPN Access Server** page appears. 8. Download the OpenVPN Connector. 9. Install the file. 10. Navigate to your desktop and open the OpenVPN Connector. The **Profiles** page appears. 11. Toggle to **Connect**. 12. Enter the required credentials. 13. Respond to the second-factor authentication challenge. 14. Click **Send**. You are connected to OpenVPN.