I had to update the git tag and rehash the patches in 1bae36b

Thanks for doing that. It looks like the build must have been broken all along, which is weird - I wonder how I managed to have it build successfully on my end and overlook the bogus git rev.

@orivej @benley have either of you integrated this into the NixOS module for OpenVPN? Curious if there are example configs using it.

No, I'm not running an OpenVPN server with LDAP authentication. I imagine you could use

services.openvpn.servers.my-server.config =
  builtins.replaceStrings [ "{openvpn-auth-ldap}" ] [ pkgs.openvpn-auth-ldap ]
    builtins.readFile ./my-server.ovpn;

and everything else is not specific to NixOS.

I'm using this plugin in a docker image built by nix and deployed on kuberneted, but not with the nixos openvpn module.

Short summary:

In your openvpn config,

plugin ${pkgs.openvpn-auth-ldap}/lib/openvpn-auth-ldap.so /path/to/openvpn-ldap.conf

and in openvpn-ldap.conf, for a setup with recursive group membership expansion (this works with Active Directory, among others)

<LDAP>
  URL ldap://ldap.server.hostname.whatever.domain
  BindDN service-account@whatever.domain
  Password asldkfjalksjdfa
  FollowReferrals yes
  TLSEnable yes
  Timeout 15
</LDAP>
<Authorization>
  BaseDN OU=Users,DC=whatever,DC=domain
 SearchFilter (&(sAMAccountName=%u)(memberOf:1.2.840.113556.1.4.1941:=CN=some-group,OU=Groups,DC=whatever,DC=domain))
  RequireGroup false
</Authorization>

Yeah, thank you both! I think I have it working nicely now with a NixOS module config. Now wishing https://github.com/guywyers/openvpn-auth-ldap had been merged 😄annoying because none of the debian patches apply cleanly to it