Adding Google Login #88

hellojanam · 2024-06-25T10:42:48Z

hellojanam
Jun 25, 2024

For our requirement i have added the code for google login, so that other staffs in company can login with gmail and create or delete the Configurations. The google users won't have admin access. Is it something that should i Send PR?
If it helps anyone else i will send a PR

d3vilh · 2024-06-25T11:48:28Z

d3vilh
Jun 25, 2024
Maintainer

Hi @hellojanam it definitely may be useful for other people.
You could send PR and I'll try to include it into the main branch.

2 replies

opsnin Jun 27, 2024

I have send the changes as PR , you can review it.

d3vilh Jun 30, 2024
Maintainer

I have send the changes as PR , you can review it.

Neat. Let me test it with different arch and I'll merge it.

ericraskin · 2024-09-06T15:36:09Z

ericraskin
Sep 6, 2024

Do you have any information on how to configure this? I see this in the PR:

 GOOGLE_CLIENT_ID
 GOOGLE_CLIENT_SECRET
 GOOGLE_REDIRECT_URL
 ALLOWED_DOMAINS

What kind of Google OAuth credential should I create? Web Application? Desktop App? Something else? If a Web Application, it asks for a redirect URI. What should that be?

And, finally, does the Google Login button appear if we have these environment variables set or is there additional configuration required?

0 replies

NidinaKoirala · 2024-09-06T15:40:01Z

NidinaKoirala
Sep 6, 2024

Hello, You can create webapp in google console. and for redirect URI, please provide the url on which this vpn ui is going to be used. like vpn-ui.xyz.com in console. and in env, put vpn-ui.xyz.com/auth/google/callback.

0 replies

ericraskin · 2024-09-06T15:42:21Z

ericraskin
Sep 6, 2024

Thank you. I dug through the code and found it in the router.go file... ;-)

…

On Fri, Sep 6, 2024 at 11:40 AM NidinaKoirala ***@***.***> wrote: Hello, You can create webapp in google console. and for redirect URI, please provide the url on which this vpn ui is going to be used. like vpn-ui.xyz.com in console. and in env, put vpn-ui.xyz.com/auth/google/callback. — Reply to this email directly, view it on GitHub <#88 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABVKI2DBMEMIRFHIYQ264TLZVHEGPAVCNFSM6AAAAABJ3SFBNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANJXGA4DKNQ> . You are receiving this because you commented.Message ID: ***@***.***>

--

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Eric H. Raskin 914-765-0500 x120 or *315-338-4461 (direct)* Professional Advertising Systems Inc. fax: 914-765-0500 or *315-338-4461 (direct)* 3 Morgan Drive #310 ***@***.*** Mt Kisco, NY 10549 http://www.paslists.com

0 replies

ericraskin · 2024-09-06T15:45:16Z

ericraskin
Sep 6, 2024

And, I assume we add the required environment variables in docker-entrypoint.sh?

…

On Fri, Sep 6, 2024 at 11:41 AM Eric Raskin ***@***.***> wrote: Thank you. I dug through the code and found it in the router.go file... ;-) On Fri, Sep 6, 2024 at 11:40 AM NidinaKoirala ***@***.***> wrote: > Hello, You can create webapp in google console. and for redirect URI, > please provide the url on which this vpn ui is going to be used. like > vpn-ui.xyz.com in console. and in env, put > vpn-ui.xyz.com/auth/google/callback. > > — > Reply to this email directly, view it on GitHub > <#88 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ABVKI2DBMEMIRFHIYQ264TLZVHEGPAVCNFSM6AAAAABJ3SFBNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANJXGA4DKNQ> > . > You are receiving this because you commented.Message ID: > ***@***.***> > -- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Eric H. Raskin 914-765-0500 x120 or *315-338-4461 (direct)* Professional Advertising Systems Inc. fax: 914-765-0500 or *315-338-4461 (direct)* 3 Morgan Drive #310 ***@***.*** Mt Kisco, NY 10549 http://www.paslists.com

--

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Eric H. Raskin 914-765-0500 x120 or *315-338-4461 (direct)* Professional Advertising Systems Inc. fax: 914-765-0500 or *315-338-4461 (direct)* 3 Morgan Drive #310 ***@***.*** Mt Kisco, NY 10549 http://www.paslists.com

0 replies

NidinaKoirala · 2024-09-06T15:49:13Z

NidinaKoirala
Sep 6, 2024

Hey, this is sample docker-compose with env variables.

---
version: "3.5"

services:
    openvpn:
       container_name: openvpn
       # If you want to build your own image with docker-compose, uncomment the next line, comment the "image:" line and run "docker-compose build" following by "docker-compose up -d"
       # build: .
       image: ecr.aws.com(use your repo here), or the main image in code docker-compose
       privileged: true
       ports: 
          - "1194:1194/udp"   # openvpn UDP port
         # - "1194:1194/tcp"   # openvpn TCP port
         # - "2080:2080/tcp"  # management port. uncomment if you would like to share it with the host
       environment:
           TRUST_SUB: "10.0.70.0/24"
           GUEST_SUB: "10.0.71.0/24"  
           HOME_SUB: "192.168.88.0/24"
       volumes:
           - ./pki:/etc/openvpn/pki
           - ./clients:/etc/openvpn/clients
           - ./config:/etc/openvpn/config
           - ./staticclients:/etc/openvpn/staticclients
           - ./log:/var/log/openvpn
           - ./fw-rules.sh:/opt/app/fw-rules.sh
           - ./checkpsw.sh:/opt/app/checkpsw.sh
           - ./server.conf:/etc/openvpn/server.conf
       cap_add:
           - NET_ADMIN
       restart: always
       depends_on:
           - "openvpn-ui"

    openvpn-ui:
       container_name: openvpn-ui
       image: (use your ecr)
       environment:
           - OPENVPN_ADMIN_USERNAME=superadmin 
           - OPENVPN_ADMIN_PASSWORD=passwordispassword
           - GOOGLE_CLIENT_ID=343443232342423.apps.googleusercontent.com(use yours)
           - GOOGLE_CLIENT_SECRET=V261Mc(use yours)
           - GOOGLE_REDIRECT_URL=http://vpn.xyz.com/auth/google/callback(use yours)
           - ALLOWED_DOMAINS=amazon.com,lauda.com  
           - [email protected],[email protected]       
       privileged: true
       ports:
           - "8080:8080/tcp"
       volumes:
           - ./:/etc/openvpn
           - ./db:/opt/openvpn-ui/db
           - ./pki:/usr/share/easy-rsa/pki
           - /var/run/docker.sock:/var/run/docker.sock:ro
       restart: always

0 replies

ericraskin · 2024-09-06T15:54:02Z

ericraskin
Sep 6, 2024

Perfect! Thank you. Maybe this could all be added to the readme.md file?

…

On Fri, Sep 6, 2024 at 11:49 AM NidinaKoirala ***@***.***> wrote: Hey, this is sample docker-compose with env variables. --- version: "3.5" services: openvpn: container_name: openvpn # If you want to build your own image with docker-compose, uncomment the next line, comment the "image:" line and run "docker-compose build" following by "docker-compose up -d" # build: . image: ecr.aws.com(use your repo here), or the main image in code docker-compose privileged: true ports: - "1194:1194/udp" # openvpn UDP port # - "1194:1194/tcp" # openvpn TCP port # - "2080:2080/tcp" # management port. uncomment if you would like to share it with the host environment: TRUST_SUB: "10.0.70.0/24" GUEST_SUB: "10.0.71.0/24" HOME_SUB: "192.168.88.0/24" volumes: - ./pki:/etc/openvpn/pki - ./clients:/etc/openvpn/clients - ./config:/etc/openvpn/config - ./staticclients:/etc/openvpn/staticclients - ./log:/var/log/openvpn - ./fw-rules.sh:/opt/app/fw-rules.sh - ./checkpsw.sh:/opt/app/checkpsw.sh - ./server.conf:/etc/openvpn/server.conf cap_add: - NET_ADMIN restart: always depends_on: - "openvpn-ui" openvpn-ui: container_name: openvpn-ui image: (use your ecr) environment: - OPENVPN_ADMIN_USERNAME=superadmin - OPENVPN_ADMIN_PASSWORD=passwordispassword - GOOGLE_CLIENT_ID=343443232342423.apps.googleusercontent.com(use yours) - GOOGLE_CLIENT_SECRET=V261Mc(use yours) - GOOGLE_REDIRECT_URL=http://vpn.xyz.com/auth/google/callback(use yours) - ALLOWED_DOMAINS=amazon.com,lauda.com - ***@***.******@***.*** privileged: true ports: - "8080:8080/tcp" volumes: - ./:/etc/openvpn - ./db:/opt/openvpn-ui/db - ./pki:/usr/share/easy-rsa/pki - /var/run/docker.sock:/var/run/docker.sock:ro restart: always — Reply to this email directly, view it on GitHub <#88 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABVKI2H6AEBBPME3PC3RX6DZVHFI7AVCNFSM6AAAAABJ3SFBNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANJXGA4TMNI> . You are receiving this because you commented.Message ID: ***@***.***>

--

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Eric H. Raskin 914-765-0500 x120 or *315-338-4461 (direct)* Professional Advertising Systems Inc. fax: 914-765-0500 or *315-338-4461 (direct)* 3 Morgan Drive #310 ***@***.*** Mt Kisco, NY 10549 http://www.paslists.com

0 replies

ericraskin · 2024-09-06T16:01:13Z

ericraskin
Sep 6, 2024

I'm not quite clear on the allowed-emails setting. The Google Client ID for Web Application credentials asks for an input URI and a callback URI, but no email information. What do I use it for?

…

On Fri, Sep 6, 2024 at 11:53 AM Eric Raskin ***@***.***> wrote: Perfect! Thank you. Maybe this could all be added to the readme.md file? On Fri, Sep 6, 2024 at 11:49 AM NidinaKoirala ***@***.***> wrote: > Hey, this is sample docker-compose with env variables. > > --- > version: "3.5" > > services: > openvpn: > container_name: openvpn > # If you want to build your own image with docker-compose, uncomment the next line, comment the "image:" line and run "docker-compose build" following by "docker-compose up -d" > # build: . > image: ecr.aws.com(use your repo here), or the main image in code docker-compose > privileged: true > ports: > - "1194:1194/udp" # openvpn UDP port > # - "1194:1194/tcp" # openvpn TCP port > # - "2080:2080/tcp" # management port. uncomment if you would like to share it with the host > environment: > TRUST_SUB: "10.0.70.0/24" > GUEST_SUB: "10.0.71.0/24" > HOME_SUB: "192.168.88.0/24" > volumes: > - ./pki:/etc/openvpn/pki > - ./clients:/etc/openvpn/clients > - ./config:/etc/openvpn/config > - ./staticclients:/etc/openvpn/staticclients > - ./log:/var/log/openvpn > - ./fw-rules.sh:/opt/app/fw-rules.sh > - ./checkpsw.sh:/opt/app/checkpsw.sh > - ./server.conf:/etc/openvpn/server.conf > cap_add: > - NET_ADMIN > restart: always > depends_on: > - "openvpn-ui" > > openvpn-ui: > container_name: openvpn-ui > image: (use your ecr) > environment: > - OPENVPN_ADMIN_USERNAME=superadmin > - OPENVPN_ADMIN_PASSWORD=passwordispassword > - GOOGLE_CLIENT_ID=343443232342423.apps.googleusercontent.com(use yours) > - GOOGLE_CLIENT_SECRET=V261Mc(use yours) > - GOOGLE_REDIRECT_URL=http://vpn.xyz.com/auth/google/callback(use yours) > - ALLOWED_DOMAINS=amazon.com,lauda.com > - ***@***.******@***.*** > privileged: true > ports: > - "8080:8080/tcp" > volumes: > - ./:/etc/openvpn > - ./db:/opt/openvpn-ui/db > - ./pki:/usr/share/easy-rsa/pki > - /var/run/docker.sock:/var/run/docker.sock:ro > restart: always > > — > Reply to this email directly, view it on GitHub > <#88 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ABVKI2H6AEBBPME3PC3RX6DZVHFI7AVCNFSM6AAAAABJ3SFBNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANJXGA4TMNI> > . > You are receiving this because you commented.Message ID: > ***@***.***> > -- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Eric H. Raskin 914-765-0500 x120 or *315-338-4461 (direct)* Professional Advertising Systems Inc. fax: 914-765-0500 or *315-338-4461 (direct)* 3 Morgan Drive #310 ***@***.*** Mt Kisco, NY 10549 http://www.paslists.com

--

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Eric H. Raskin 914-765-0500 x120 or *315-338-4461 (direct)* Professional Advertising Systems Inc. fax: 914-765-0500 or *315-338-4461 (direct)* 3 Morgan Drive #310 ***@***.*** Mt Kisco, NY 10549 http://www.paslists.com

0 replies

ericraskin · 2024-09-06T16:58:24Z

ericraskin
Sep 6, 2024

Sorry, another silly question. I may have misunderstood the whole purpose. I was looking for Google Auth for the client VPN connection. I believe that this give us authentication to your UI. Have you implemented SAML or something similar to give us Google Authentication to the client?

…

On Fri, Sep 6, 2024, 12:00 PM Eric Raskin ***@***.***> wrote: I'm not quite clear on the allowed-emails setting. The Google Client ID for Web Application credentials asks for an input URI and a callback URI, but no email information. What do I use it for? On Fri, Sep 6, 2024 at 11:53 AM Eric Raskin ***@***.***> wrote: > Perfect! Thank you. Maybe this could all be added to the readme.md file? > > On Fri, Sep 6, 2024 at 11:49 AM NidinaKoirala ***@***.***> > wrote: > >> Hey, this is sample docker-compose with env variables. >> >> --- >> version: "3.5" >> >> services: >> openvpn: >> container_name: openvpn >> # If you want to build your own image with docker-compose, uncomment the next line, comment the "image:" line and run "docker-compose build" following by "docker-compose up -d" >> # build: . >> image: ecr.aws.com(use your repo here), or the main image in code docker-compose >> privileged: true >> ports: >> - "1194:1194/udp" # openvpn UDP port >> # - "1194:1194/tcp" # openvpn TCP port >> # - "2080:2080/tcp" # management port. uncomment if you would like to share it with the host >> environment: >> TRUST_SUB: "10.0.70.0/24" >> GUEST_SUB: "10.0.71.0/24" >> HOME_SUB: "192.168.88.0/24" >> volumes: >> - ./pki:/etc/openvpn/pki >> - ./clients:/etc/openvpn/clients >> - ./config:/etc/openvpn/config >> - ./staticclients:/etc/openvpn/staticclients >> - ./log:/var/log/openvpn >> - ./fw-rules.sh:/opt/app/fw-rules.sh >> - ./checkpsw.sh:/opt/app/checkpsw.sh >> - ./server.conf:/etc/openvpn/server.conf >> cap_add: >> - NET_ADMIN >> restart: always >> depends_on: >> - "openvpn-ui" >> >> openvpn-ui: >> container_name: openvpn-ui >> image: (use your ecr) >> environment: >> - OPENVPN_ADMIN_USERNAME=superadmin >> - OPENVPN_ADMIN_PASSWORD=passwordispassword >> - GOOGLE_CLIENT_ID=343443232342423.apps.googleusercontent.com(use yours) >> - GOOGLE_CLIENT_SECRET=V261Mc(use yours) >> - GOOGLE_REDIRECT_URL=http://vpn.xyz.com/auth/google/callback(use yours) >> - ALLOWED_DOMAINS=amazon.com,lauda.com >> - ***@***.******@***.*** >> privileged: true >> ports: >> - "8080:8080/tcp" >> volumes: >> - ./:/etc/openvpn >> - ./db:/opt/openvpn-ui/db >> - ./pki:/usr/share/easy-rsa/pki >> - /var/run/docker.sock:/var/run/docker.sock:ro >> restart: always >> >> — >> Reply to this email directly, view it on GitHub >> <#88 (comment)>, >> or unsubscribe >> <https://github.com/notifications/unsubscribe-auth/ABVKI2H6AEBBPME3PC3RX6DZVHFI7AVCNFSM6AAAAABJ3SFBNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANJXGA4TMNI> >> . >> You are receiving this because you commented.Message ID: >> ***@***.***> >> > > > -- > > > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > > Eric H. Raskin > 914-765-0500 x120 or *315-338-4461 > (direct)* > > Professional Advertising Systems Inc. > fax: 914-765-0500 or *315-338-4461 > (direct)* > > 3 Morgan Drive #310 > ***@***.*** > > Mt Kisco, NY 10549 > http://www.paslists.com > > > -- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Eric H. Raskin 914-765-0500 x120 or *315-338-4461 (direct)* Professional Advertising Systems Inc. fax: 914-765-0500 or *315-338-4461 (direct)* 3 Morgan Drive #310 ***@***.*** Mt Kisco, NY 10549 http://www.paslists.com

1 reply

NidinaKoirala Sep 6, 2024

no , its auth for UI login, not for clients. For clients you can use 2fa , like google authenticator, or microsoft authenticator, 1 password. Enable 2fa and users are prompt to add it.

ericraskin · 2024-09-06T17:03:04Z

ericraskin
Sep 6, 2024

I did set that up, but we use Google Cloud so I was thinking that I might use SAML to authenticate the clients. Open Access Server has it as an option but Community does not (yet). We will stick with 2FA. Thanks for your help.

…

On Fri, Sep 6, 2024, 1:00 PM NidinaKoirala ***@***.***> wrote: no , its auth for UI login, not for clients. For clients you can use 2fa , like google authenticator, or microsoft authenticator, 1 password. Enable 2fa and users are prompt to add it. — Reply to this email directly, view it on GitHub <#88 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABVKI2GLWVSSZILJSZS2A7LZVHNTDAVCNFSM6AAAAABJ3SFBNWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANJXGE3TAMI> . You are receiving this because you commented.Message ID: ***@***.***>

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding Google Login #88

{{title}}

Replies: 10 comments 3 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Adding Google Login #88

Replies: 10 comments · 3 replies

d3vilh Jun 25, 2024 Maintainer

d3vilh Jun 30, 2024 Maintainer

Replies: 10 comments 3 replies

d3vilh
Jun 25, 2024
Maintainer

d3vilh Jun 30, 2024
Maintainer