could the user just have read permission so he could just download his vpn profil