Multiple OU User Search for OpenVPN Server with AD/LDAP Authentication

Question

I have an OpenVPN server that authenticates against a single AD domain.

Here is my auth-ldap.conf that is used with OpenVPN

    <LDAP>
            URL             ldap://ad1.test.company:389,ldap://ad2.test.company:389
            BindDN          "CN=openvpnauth,CN=Users,DC=test,DC=company"
            Password        "A!thP123w00rd"
            Timeout         15
            TLSEnable       no
            FollowReferrals yes
    </LDAP>

    <Authorization>
            BaseDN          "DC=test,DC=company"
            SearchFilter    "(sAMAccountName=%u)"
            RequireGroup    true
                    <Group>
                            BaseDN  "CN=Users,DC=test,DC=company"
                            SearchFilter "(cn=VPN Users)"
                            MemberAttribute "member"
                    </Group>

So, the above authenticates users against AD and works as designed.

It searches for the user group "VPN Users" within "CN=Users,DC=test,DC=company" (the default '/Users' OU)

If the user has the proper group set VPN Users then it allows a user in!

I want to add a user to another separate OU, for example: Team1/Desktop-users/Standard users could be my new OU with users in it. I want to allow users in that OU as well as the original one.

Would this be as easy as adding another <Group> object in the config?

Answer 1

This worked:

<Group>
   BaseDN  "DC=test,DC=company"
   SearchFilter "(cn=VPN Users)"
   MemberAttribute "member"
</Group>

Answer 2

You can change the base DN to Domain root, like dc=domian,dc-com this will cover all the OU's in Domain and may take some more time to search the user/group

Best to use the respective OU or the parent OU to do a effective search

Answer 3

To add more groups in the config just put:

SearchFilter "(|(cn=VPN Users)(cn=other group))"