Show authenticated user in new MVC OpenVPN status view

[pmhausen]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

I am in the process of migrating a legacy pfSense VPN gateway to OPNsense 24.7.

• We use a single server and a single client certificate for all connections.
• Users are additionally authenticated by username and password against Active Directory over LDAPS.
• Users are not imported into OPNsense.

Therefore all users share the same CN because they share the same certificate. This leads to the OpenVPN connection status view to show the same Common Name for all logged in users.

pfSense on the other hand shows the authenticated user names instead of the certificate CN.

I initially opened the topic for general discussion on the forum because I am not sure what is the best solution for this. More below. My post (unfortunately without answers) with screen shots can be found here:

https://forum.opnsense.org/index.php?topic=42255.msg208481#msg208481

Describe the solution you like

I'd like to have the username field shown in the status line for each connection in addition to or instead of the common_name field.

The reason I cannot hand you a merge request right away is that I am not familiar enough with OpenVPN to know how all of this works together. When I brute force search and replace common_name with username in status.volt the username is displayed in the overview. But that will certainly break at least the kill_session function so it's not a complete solution - therefore no merge request, sorry.

Also I am not sure kill_session will enable me to terminate a single connection because according to the comments and the code it goes by CN and all CNs are the same. It would also be great if I could "X" a single authenticated connection even when the CN is the same for all of them but the username is different.

Kind regards,
Patrick

[pmhausen]

Thanks a lot for that quick reaction. As I found out it is sufficient to enable the advanced option "Username as CN" to get the behaviour of the old gateway back. Of course "Strict User/CN Matching" must be disabled in our case.