OpenVPN & Ldap

port 1194
proto tcp
dev tun1
ca keys-vpn/ca.crt
cert keys-vpn/server.crt
key keys-vpn/server.key
dh keys-vpn/dh1024.pem
server 172.16.3.0 255.255.255.0
route 172.16.3.0 255.255.255.252
push "route 172.16.2.0 255.255.255.0"
push "route 172.16.1.0 255.255.255.0"
push "route 172.16.10.0 255.255.255.252"
ifconfig-pool-persist ipp.txt
client-cert-not-required 
username-as-common-name 
tun-mtu 1400
# tun-mtu-extra 32
# mssfix 1372
# Push DNS WINS
push "redirect-gateway def1"
script-security 2
client-to-client
auth MD5
cipher BF-CBC
keepalive 10 120
comp-lzo
max-clients 100
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn-vpn.log
verb 3
plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn/openvpn-auth-ldap"

 
<LDAP>
# Адрес OpenLDAP сервера
    URL             ldap://x.x.x.x:389
# Пользователь в LDAP с правом поиска
    BindDN          cn=admin,dc=oc,dc=local
# Его пароль
    Password        pass
    Timeout         15
    TLSEnable       no
    FollowReferrals yes
</LDAP>

<Authorization>
        BaseDN          "ou=People,dc=oc,dc=local"
        SearchFilter    "(&(uid=%u))"
        RequireGroup    false
</Authorization>

 
<LDAP>
# Адрес OpenLDAP сервера
    URL             ldap://x.x.x.x:389
# Пользователь в LDAP с правом поиска
    BindDN          cn=admin,dc=oc,dc=local
# Его пароль
    Password        pass
    Timeout         15
    TLSEnable       no
    FollowReferrals yes
</LDAP>

<Authorization>
        BaseDN          "ou=People,dc=oc,dc=local"
        SearchFilter    "(&(uid=%u))"
        RequireGroup true
        #PFTable        ips_vpn_users

        <Group>
                BaseDN          "ou=Group,dc=oc,dc=local"
                SearchFilter    "(|(cn=vpn))"
                MemberAttribute memberUid
                # Add group members to a PF table (disabled)
                #PFTable        ips_vpn_eng
        </Group>

</Authorization>

LDAP user "marat" was not found.
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 TLS Auth Error: Auth Username/Password verification failed for peer
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 [] Peer Connection Initiated with [AF_INET]89.184.25.141:39682
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 PUSH: Received control message: 'PUSH_REQUEST'
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 Delayed exit in 5 seconds
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 Delayed exit in 5 seconds
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
Fri Jun 29 12:03:30 2012 89.184.25.141:39682 Connection reset, restarting [0]
Fri Jun 29 12:03:30 2012 89.184.25.141:39682 SIGUSR1[soft,connection-reset] received, client-instance restarting
Fri Jun 29 12:03:30 2012 89.184.25.141:39682 SIGUSR1[soft,connection-reset] received, client-instance restarting
Fri Jun 29 12:03:30 2012 TCP/UDP: Closing socket

ldapsearch -W -x -D cn=admin,dc=oc,dc=local -b "ou=Group,dc=oc,dc=local" "(&(cn=vpn))"
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <ou=Group,dc=oc,dc=local> with scope subtree
# filter: (&(cn=vpn))
# requesting: ALL
#

# vpn, Group, oc.local
dn: cn=vpn,ou=Group,dc=oc,dc=local
objectClass: posixGroup
objectClass: top
gidNumber: 10010
cn: vpn
description: vpn
memberUid: a
memberUid: b
memberUid: c
memberUid: d
memberUid: marat
memberUid: x
memberUid: y

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1