I have used Mikrotik RouterOS whose OpenVPN server flawlessly utilizes Radius AAA. Would it be possible to add Radius (in addition to already available LDAP) authentication? VyOS already supports Radius auth in i.e. OpenConnect (ocserv), but this is probably ocserv’s internal implementation.
Maybe something like GitHub - peppelinux/pyRadtest: A pure Python implementation of Radius auth client can be used in a form similar to what @dutty mentions in OpenVPN + Radius Plugin - #2 by Forestarean, but officially supported and documented.