Устанавливаем пакет openvpn-auth-ldap:apt-get install openvpn-auth-ldap
Редактируем конфигурационный файл openvpn (добавляем две строки):username-as-common-name
plugin /usr/lib64/openvpn/plugins/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf
В AD создаём учётку openvpnsvc для авторизации сервера openvpn в AD
В AD создаём security group VPN_users
Редактируем файл /etc/openvpn/auth/ldap.conf
<LDAP>
# LDAP server URL
URL ldap://dc01.domainname.local
# Bind DN (If your LDAP server doesn't support anonymous binds)
BindDN CN=openvpnsvc,CN=Users,DC=domainname,DC=local
# Bind Password
Password _пароль_учётки_openvpnsvc_
# Network timeout (in seconds)
Timeout 15
# Enable Start TLS
TLSEnable no
</LDAP>
<Authorization>
# Base DN
BaseDN "DC=domainname,DC=local"
# User Search Filter
SearchFilter "(&(sAMAccountName=%u)(memberOf=CN=VPN_users,CN=Users,DC=domainname,DC=local))"
# SearchFilter "(&(sAMAccountName=%u)(memberOf=CN=VPN_users,CN=Users,DC=domainname,DC=local)(accountStatus=active))"
# Require Group Membership
# RequireGroup false
# Add non-group members to a PF table (disabled)
#PFTable ips_vpn_users
# Uncomment and set to true to support OpenVPN Challenge/Response
#PasswordIsCR false
<Group>
# Default is true. Match full user DN if true, uid only if false.
# RFC2307bis true
# Default is true. Uncomment and set to false if you want to use a Search operation to determine group
# membership instead of Compare. Lower performance, so Compare should generally be used, but Search is
# required in certain LDAP environments.
# UseCompareOperation true
BaseDN "ou=Users,dc=domainname,dc=local"
SearchFilter "(&(sAMAccountName=%u)(memberOf=CN=Users,DC=domainname,DC=local))"
MemberAttribute uniqueMember
# Add group members to a PF table (disabled)
#PFTable ips_vpn_eng
</Group>
</Authorization>
Рестартуем сервер openVPN:systemctl restart openvpn@server
Добавляем в конфиг клиента строчку:auth-user-pass
Добавляем клиента в группу VPN_users в AD.
Можно подключаться с исправленным конфигом
Помогли ссылки:
https://vmblog.ru/openvpn-active-directory-ldap-auth/
https://www.dmosk.ru/instruktions.php?object=kak-nastroit-openvpn-server-i-vklyuchit-autentifikatsiyu-cherez-ldap-active-directory