Got it, thanks. I don't think Google's MFA/2FA applies to LDAP authentication requests. If you have 2FA enforced already, and still can log on through LDAP, that would confirm this.
The reason being, most likely, that many LDAP clients wouldn't know how to pass through the MFA portion and initiate the bind immediately - or simply time out while waiting for users to confirm their second factor. Plain vanilla LDAP has no concept of 2FA.
You will probably have to plug a third-party MFA solution into your OpenVPN server. Another option could be using an external IdP such as Okta, which has some options when using MFA with LDAP (see here: https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-MFA.htm).
LinkedIn
Twitter
