openvpn-auth-oauth2

openvpn-auth-oauth2 is a management client for OpenVPN that handles the single sign-on (SSO) authentication of connecting users against OIDC providers like

• Microsoft Entra ID (Azure AD)
• GitHub
• Okta
• Google Workspace
• Zittal
• Digitalocean
• Keycloak
• ... any other OIDC compatible auth server

Version requirements

• Server: 2.6.2 or later (OpenVPN Access Server not supported)
• Client: 2.6.0 or later (OpenVPN Client 2.x requires a management client to handle WebAuth, e.g. Viscosity or Tunnelblick)

Tested environment

Server

Working

• OpenVPN 2.6.6 on Linux

Non-Working

• OpenVPN Access Server (any)

Client

Working

• OpenVPN Community Client for Windows 2.6.0+
• Tunnelblick 4.0.0beta10+
• OpenVPN 3 core library 3.9+
• Viscosity

Partial Working

• OpenVPN Connect v3 for Windows/macOS/Linux (REAUTH issues; workaround: --oauth2.refresh.enabled=true)

Non-Working

• network-manager-openvpn-gnome - See https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/124

Installation

https://github.com/jkroepke/openvpn-auth-oauth2/wiki/Installation

Configuration

https://github.com/jkroepke/openvpn-auth-oauth2/wiki/Configuration#

Related projects

• https://github.com/CyberNinjas/openvpn-auth-aad
• https://github.com/vitaliy-sn/openvpn-oidc
• https://github.com/jkroepke/openvpn-auth-azure-ad

Copyright and license

© 2023 Jan-Otto Kröpke (jkroepke)

Licensed under the MIT License

Thanks

• JetBrains IDEs