#!/usr/bin/python3
"""Accept an OpenVPN login only when the user name is the common name of the client certificate.

Run by the OpenVPN server as auth-user-pass-verify with via-env, next to the LDAP plugin that
checks the password, so a user's certificate cannot be used with another user's password.
"""

import os
import sys

username = os.environ.get('username', '')
sys.exit(0 if username and username == os.environ.get('common_name') else 1)