# ClientVpnUserBasedAuthentication

User-based authentication for a client VPN endpoint.

- Source: [`aws-ec2/lib/client-vpn-endpoint.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-ec2/lib/client-vpn-endpoint.ts#L240)
- Type last changed: v2.224.0 · 13 Nov 2025

## Example

```ts
const endpoint = vpc.addClientVpnEndpoint('Endpoint', {
  cidr: '10.100.0.0/16',
  serverCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id',
  userBasedAuthentication: ec2.ClientVpnUserBasedAuthentication.federated(samlProvider),
  authorizeAllUsersToVpcCidr: false,
});

endpoint.addAuthorizationRule('Rule', {
  cidr: '10.0.10.0/32',
  groupId: 'group-id',
});
```

## Initializer

```ts
new ClientVpnUserBasedAuthentication()
```

## Methods

- `activeDirectory(directoryId: string): ClientVpnUserBasedAuthentication // chainable` (static) — Active Directory authentication.

- `federated(samlProvider: ISAMLProviderRef, selfServiceSamlProvider?: ISAMLProviderRef): ClientVpnUserBasedAuthentication // chainable` (static) — Federated authentication.

- `render(): any` — Renders the user based authentication.