OpenVPN SAML Integration

This document explains how to implement MonoSign with OpenVPN. It covers Single Sign-On. Before you continue, it is better to start with OpenVPN’s Single Sign-On implementation page.

View OpenVPN SAML Metadata

In order to configure the SAML key on MonoSign for OpenVPN SSO, you need to have various information provided by OpenVPN. First, navigate to Settings > User Authentication from the sidebar and click Edit.

SAML option will be disabled by default since it is not configured. Click Configure button under the option. On the opening page, you will view OpenVPN SAML metadata.

For now, we will stop here on the OpenVPN side and create a MonoSign application and related SAML key by using the information provided by OpenVPN.

Creating an Application and Access Key on MonoSign

Create your application on MonoSign and configure your access policy. Once you create, click Keys and Add New Key to create a SAML access key.

In the opened modal, choose SAML as Key Type and switch to SAML2 Settings. Fill in the necessary fields according to the information provided by OpenVPN. Correspondings of the fields are as below.

Field	Value
Assertion Consumer Url	SSO URL from SAML Configuration
Entity Id	Issuer Name from SAML Configuration
NameId Format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Name Id	Email

Click Save and you are gonna see your configuration for your access key as follows;

Configuration Single Sign-On for OpenVPN

We are gonna move on to where we left off on the SAML Configuration page which is mentioned in the first chapter. Click Next and Choose Manual Configuration. Fill in the necessary fields according to the access key created on MonoSign. Correspondings of the fields are as below.

Field	Value
IdP Authentication Endpoint	Sign On Service from the application SAML key
IdP Name	MonoSign
IdP X.509 Public Certificate	X509 format of the certificate issued to access key - can be downloadable from the key detail.

You need to view your certificate in x509 format. in that case, we prefer using OpenSSL - “a robust, commercial-grade, full-featured toolkit for general-purpose cryptography and secure communication.”

Use the command below to view the certificate.

CODE

openssl x509 -in {path of your certificate} -text

The output contains various information about the certificate. However, you should check the text starts with “-----BEGIN CERTIFICATE-----”. At the end your form should look as follows;

Click Next and review your configurations. By clicking Finish you will be redirected to the User Authentication page. Click Edit and the SAML option will be enabled. Choose it and click Update. You can check if SAML is enabled on the page.