The latest release of OpenVPN Access Server supports identity federation with SAML (Security Assertion Markup Language). You can now use a third-party SAML IdP to 1) establish SSO access to the client portal, and 2) authenticate prior to VPN connection.
The industry standard SAML 2.0 is used to securely exchange SAML assertions passing information about a user between a SAML authority (aka identity provider or IdP), and a SAML consumer (aka service provider or SP). Access Server authentication service uses this information to provide federated single sign-on (SSO) for users authorized to use the VPN.
SAML ensures that users are real and who they say they are for all external services and apps.
In other words, SAML ensures that users are real and who they say they are for all external services and apps.
Johan Draaisma, Access Server Product Manager, explains that with this update, “OpenVPN Access Server makes it easy for administrators to set users up to authenticate against an IdP they’re using for SSO, be it Azure AD, Google Workspace, OneLogin, Okta, or Keycloak. Doing this allows users to log in to their Access Server web portal using SSO. Plus, the same credential can be used to authenticate VPN sessions as other corporate web applications providing SSO.”
Additional high-value benefits of this capability:
Using Access Server to delegate user authentication to a SAML identity provider is a straightforward four-step process:
Step 1: Sign in to the Admin Web UI.
Step 2: Click Authentication > SAML and save the SP Identity and SP ACS information for the Access Server.
Step 3: Sign in with the IdP to provide the Access Server information and create a SAML app.
Step 4: Provide the IdP SAML app data to Access Server (with metadata or via manual entry).
Please note that accessing this enhanced SAML functionality requires an up-to-date client, either OpenVPN Connect (v3.3) or a recent open source client.
We encourage you to take advantage of these additional resources on OpenVPN.net:
A comprehensive guide to new features, bug fixes, and improvements included in this update is available in the OpenVPN Access Server 2.11.0 Release Notes.