You could generate a certificate for each user, but without the duplicate-cn option a user is only allowed 1 connection to the same server. You can also use username/password authentication instead of certificates, also in this case you'll need to set the duplicate-cn option to allow multiple connections from the same user to the same server, because in this case you use the option username-as-common-name and the CN (common name) will then be the username.