Access Server: TOTP hardware tokens for MFA (RFC 6238)

Description: You can use standalone hardware tokens such as YubiKey 5 NFC, Protectimus Slim NFC token, and Token2 for multi-factor authentication (MFA) with Access Server using time-based one-time passwords (TOTP).

This guide covers configuring TOTP MFA on our Access Server and setting up a hardware token to serve as a TOTP authenticator.

Prerequisites

1. A hardware token with TOTP/OTP support.
   • We use YubiKey 5 NFC in this guide.
2. Yubico Authenticator installed on your Windows, macOS, iOS, or Android device.
   • Refer to the Yubico site: Yubico Authenticator.

Note: We will use Yubikey as the hardware token. If you're using another one, such as Protectimus or Token2, refer to vendor documentation for instructions on using their software authenticator.

Step 1: Enable TOTP MFA on Access Server

TOTP multi-factor authentication isn’t enabled by default for OpenVPN Access Server. You can enable it globally (all users), by specific groups, or by individual users.

1. To turn on TOTP MFA from the Admin Web UI, follow the steps in this tutorial: Tutorial: Turn on TOTP Multi-Factor Authentication.
   • You can also use the command line: Tutorial: How to Manage TOTP MFA from the Command Line.

Note: You can use TOTP MFA with the following authentication methods: local, RADIUS, LDAP, or PAM. You can't use it for SAML or PAS-only.

Step 2: Enroll from the Client Web UI

1. Sign in to the Client Web UI.
   
2. The next screen displays the QR code and enrollment code. The enrollment code is below the QR code.
   
3. Open the Yubico Authenticator.
   
4. Plug your hardware token (YubiKey) into your PC so the Yubico Authenticator detects it.
   
5. Click Add account.
6. Scan the QR code as explained below, or add the enrollment code manually.
   
7. After entering the code, account information populates.
   
8. Click Save.
9. The VPN user is enrolled with the Yubikey.
10. Enter the six-digit one-time password provided by the Yubico Authenticator.
    
    
11. Click Confirm Code.

Step 3: Test your setup

1. Download a connection profile for the enrolled user and import it into OpenVPN Connect.
   • You can also use an already imported profile if you have one.

2. Click or tap the profile toggle to connect.

   
3. The TOTP MFA prompt appears.
   
4. Enter the six-digit one-time password provided by the Yubico Authenticator.
   
5. After a successful connection, OpenVPN Connect displays connection statistics.
   

If you have additional questions, please submit a ticket.