2

Is it possible for an OpenVPN client to log into a Windows AD domain on the server end of the tunnel?

In my set up, my OpenVPN server is running on a linux box joined to the domain and I'm using the centrifyDC package to authenticate OpenVPN client against the AD domain. Clients can access all the domain resources - they are prompted to provide their domain credentials when they attempt to access a resource.

That's all fine, but when a client accesses SQL Server via SSMS, when they select 'Windows Authentication' they can't independently supply their domain credentials; they need to be logged into the domain for this to work.

Ideally, I would be able to do this transparently when they log in to OpenVPN.

2

I haven't actually tried it, but assuming you run the OpenVPN client as a Windows service and set it to start automatically you should be able to logon to the domain from a client computer. I highly doubt computer Group Policy processing will work properly (since it's really, really picky about being able to communicate with a Domain Controller during boot) and depending only how long it takes for your OpenVPN client to establish the tunnel it may be possible for clients to attempt to logon "too soon". It should be possible, though, to do what you're looking for. (It would be fun to try this sometime.)

  • Thanks. Any ideas on what mechanism the client would use? A batch file? Is something built in to the OpenVPN client? Setting on the Windows service? That's actually one of my main sticking points - how to initiate the login. – Steve Mallory Jun 4 '13 at 14:15
  • Perhaps I'm missing something. Why not just have the user logon? You could use the built-in autologon functionality in Windows if the user can't be bothered to logon. – Evan Anderson Jun 4 '13 at 16:05

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.