...
common-name-as-username
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn

...
ca ca.crt
cert client.crt
key client.key
...
auth-user-pass

Environmental Variables
Once set, a variable is persisted indefinitely until it is reset by a new value or a restart,

As of OpenVPN 2.0-beta12, in server mode, environmental variables set by OpenVPN are scoped according to the client objects they are associated with, so there should not be any issues with scripts having access to stale, previously set variables which refer to different client instances.

bytes_received
    Total number of bytes received from client during VPN session. Set prior to execution of the --client-disconnect script.
bytes_sent
    Total number of bytes sent to client during VPN session. Set prior to execution of the --client-disconnect script.
common_name
    The X509 common name of an authenticated client. Set prior to execution of --client-connect, --client-disconnect, and --auth-user-pass-verify scripts.
config
    Name of first --config file. Set on program initiation and reset on SIGHUP.
..
username
    The username provided by a connecting client. Set prior to --auth-user-pass-verify script execution only when the via-env modifier is specified.

...
common-name-as-username
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn
auth-user-pass-verify mon-script-bash-de-verif.sh via-env

--script-security level [method]
              This  directive offers policy-level control over OpenVPN’s usage
              of external programs and scripts.  Lower level values  are  more
              restrictive,  higher  values  are more permissive.  Settings for
              level:

             0 -- Strictly no calling of external programs.
              1 -- (Default) Only call built-in executables such as  ifconfig,
              ip, route, or netsh.
              2  --  Allow  calling  of  built-in executables and user-defined
              scripts.
              3 -- Allow passwords to be passed to scripts  via  environmental
              variables (potentially unsafe).

--plugin module-pathname [init-string]
    Load plug-in module from the file module-pathname, passing init-string as an argument to the module initialization function. Multiple plugin modules may be loaded into one OpenVPN process.
 
    For more information and examples on how to build OpenVPN plug-in modules, see the README file in the plugin folder of the OpenVPN source distribution.
 
    If you are using an RPM install of OpenVPN, see /usr/share/openvpn/plugin. The documentation is in doc and the actual plugin modules are in lib.
 
    Multiple plugin modules can be cascaded, and modules can be used in tandem with scripts. The modules will be called by OpenVPN in the order that they are declared in the config file. If both a plugin and script are configured for the same callback, the script will be called last. If the return code of the module/script controls an authentication function (such as tls-verify, auth-user-pass-verify, or client-connect), then every module and script must return success (0) in order for the connection to be authenticated.

..
username-as-common-name
plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn
script-security 2
auth-user-pass-verify /etc/openvpn/verif-cn-username.sh via-env

#!/bin/sh
if [ "$username" -ne "$common_name" ]
    then
        exit 0
fi