SSL VPN with AD Authentication SSO

Hi Marcus Michaels 

Please read the below-given community thread.

https://community.sophos.com/products/xg-firewall/f/authentication/92306/using-active-directory-groups-to-authenticate-vpn-users

Hi Keyur,

thanks for your reply.

Maybe my post was not clear. I got this to work easily. I use the Sophos SSL client and get authenticated.

Before I got the XG I had a pfSense and used Radius to authenticate the client. As soon as I was connected via OpenVPN, clients could also access Exchange or the NAS without another password prompt.

Now I can not access ressources which are secured via AD.

For example I can not use SQL Management Studio with my Windows Login, only works when using SQL users. Or I cant access the NAS which also authenticates via AD.

Therefore I metioned SSO. How does the XG handles this issue?

Best

Marcus

Hi Keyur,

thanks for your reply.

Maybe my post was not clear. I got this to work easily. I use the Sophos SSL client and get authenticated.

Before I got the XG I had a pfSense and used Radius to authenticate the client. As soon as I was connected via OpenVPN, clients could also access Exchange or the NAS without another password prompt.

Now I can not access ressources which are secured via AD.

For example I can not use SQL Management Studio with my Windows Login, only works when using SQL users. Or I cant access the NAS which also authenticates via AD.

Therefore I metioned SSO. How does the XG handles this issue?

Best

Marcus

How could Pfsense handle such authentication methods? 

Hi LuCar Toni,

I used Radius and it worked.

Login to the Client Laptop, started OpenVPN with Radius authentication and I was never asked to a password prompt from AD secured ressources.

Marcus

You could work with Radius for SSL VPN. 

https://community.sophos.com/kb/en-us/132919

Hi Lucar Toni,

RADIUS seems to be a way to go, however I only get the test connection working. Real connections fail.

To whom it may concern,

for me, the following solution solved the issue. This also works with the XG AD Authentication

nslookup gave me the DNS of the ISP only, so obviously there was no way for the client notebook to contact the AD server.

I manually added my AD Server as option in the ovpn file on the client, as I havn't found a way to add it to the provisioning file in the user portal. I had that same option on my pfSense.

dhcp-option DNS x.x.x.x

nslookup then used my AD server

I could then access file ressources and even the SSPI context for SQL Management Studio was created and I could login using my windows credentials.

Best regards

MArcus