Add option to skip token auth and rely on cert auth for specific users?

[tomekwojcik]

Hello!

First of all, thanks for the plugin and all the work you're putting into it. It's much appreciated.

With that being said, I'd like to ask if it would be possible for you to add an option (e.g. in the otp_secrets file) that would allow me to tell the plugin that this particular user doesn't require token auth. The thing is, I have a bunch of different devices connecting to my server. Some of them are other servers and there's no way for me to enter OTPs when they connect to the VPN. OTOH, I have devices like my phone that would greatly benefit from OTPs.

In any case, thanks again for the plugin and have a nice day :).

[evgeny-gridasov]

Hi Tomek,

How about we have a static password option in configuration and use that? I think that should be easy to implement. Alternatively, you may generate OTP using oathtool --totp -b YOURBASE32KEY and put it in OpenVPN password file before connection.

[guywyers]

Hi Tomek,

I have been having this same issue, but in the opposite direction: I have iOS users connecting with iOS "VPN On Demand" profiles. While this is a very cool feature, it doesn't allow any user interaction, so no passwords and no OTPs either.
What I settled on after some head scratching, is to run different VPN instances on the server side. One listens on port A and imposes LDAP plus OTP authentication. The other listens on port B and does not require any user authentication. It allows me to beef up security as much as possible in that second config, knowing that there is no user authentication happening.

Just thought to let you know.