--- title: VPN SAML Authentication with Access Server | OpenVPN canonical: https://openvpn.net/as-docs/saml/ product: Access Server Docs description: Authenticate your VPN clients with SAML, an open standard for exchanging authentication and authorization data between an identity provider and a service provider. --- # VPN SAML Authentication with Access Server | OpenVPN ## Introduction Access Server 2.11 and newer supports Security Assertion Markup Language (SAML), an XML-based standard for exchanging authentication and authorization data between Access Server as the Service Provider (SP) and a SAML Identity Provider (IdP). The advantage of SAML is that it can provide a single sign-on (SSO) experience. This means you can use the same SAML IdP credentials to access various applications and services that support SAML authentication, eliminating the need to add new credentials for each application or service. ## The Access Server SAML process When you enable SAML for authentication on your Access Server, users do not sign in with Access Server-specific credentials. Instead, they use their credentials for the IdP, giving them a single sign-on (SSO) experience. Here’s how the sign-in flows might look (two examples). ### SP-initiated flow 1. The user opens the Access Server [Client Web UI](https://openvpn.net/as-docs/client-web-ui-user-manual-78629.md). 2. They click on **Sign in via SAML** on the sign-on page. 3. They are automatically sent to the SAML IdP sign-on page. 4. They authenticate with their SAML IdP credentials. 5. The user is sent to the Client Web UI to download the required software and/or import a connection profile using a [Token URLs](https://openvpn.net/as-docs/token-url.md). ### IdP-initiated flow 1. The user opens the SAML IdP sign-on page. 2. They authenticate with their SAML IdP credentials. 3. They click on the Access Server SAML application. 4. The user is sent to the Client Web UI to download the required software and/or import a connection profile using a token URL. ### OpenVPN Connect process 1. The user opens OpenVPN Connect. 2. They click on their profile to connect to the VPN. 3. OpenVPN Connect directs them to the IdP sign-on in a browser. 4. After successful authentication, they connect to the VPN. ## Setting up Access Server SAML with your IdP Setting up SAML with Access Server requires several configuration steps: 1. Provide the Service Provider information to the Identity Provider. 2. Provide the Identity Provider information to the Service Provider. 3. Enable SAML with Access Server. 4. Assign users access through the IdP. 5. Users successfully sign in. We provide detailed tutorials to help you set up SAML with several IdPs: - [Tutorial: How to Configure SAML with Entra ID](https://openvpn.net/as-docs/tutorials/saml-entra-id.md) - [Tutorial: How to Configure SAML with Google Workspace](https://openvpn.net/as-docs/tutorials/saml-google-workspace.md) - [Tutorial: How to Configure SAML with OneLogin](https://openvpn.net/as-docs/tutorials/saml-onelogin.md) - [Tutorial: How to Configure SAML with Keycloak](https://openvpn.net/as-docs/tutorials/saml-keycloak.md) - [Tutorial: How to Configure SAML with Okta](https://openvpn.net/as-docs/tutorials/saml-okta.md) - [Tutorial: How to Configure SAML with JumpCloud](https://openvpn.net/as-docs/tutorials/saml-jumpcloud.md) - [Tutorial: How to Configure SAML with AWS](https://openvpn.net/as-docs/tutorials/saml-aws.md) - [Tutorial: How to Configure SAML with Auth0](https://openvpn.net/as-docs/tutorials/saml-auth0.md) - [Tutorial: How to Configure SAML with PingOne SSO](https://openvpn.net/as-docs/tutorials/saml-pingone.md) If you're looking for SAML with CloudConnexa, refer to the [SAML CloudConnexa documentation](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml.md). ## Additional SAML links Use these additional tutorials for specific SAML features: - [Tutorial: How to assign SAML as the default authentication](https://openvpn.net/as-docs/tutorials/saml-default-auth.md) - [Tutorial: How to use SAML only for specific users and groups](https://openvpn.net/as-docs/tutorials/saml-users-groups.md) - [Tutorial: Setting up forced authentication (forceAuthn) for SAML users](https://openvpn.net/as-docs/tutorials/forceauthn.md) - [Tutorial: How to require certain authentication context for the SAML authentication process](https://openvpn.net/as-docs/tutorials/authncontext.md) Use these links to watch SAML videos: - [Video: Enable SAML for Access Server with Onelogin](https://openvpn.net/as-docs/videos/video--enable-saml-onelogin.md) - [Video: How to Configure SAML on Access Server with Okta](https://openvpn.net/as-docs/videos/video--saml-with-okta.md) - [Video: How to automate SAML user group mapping with Okta on Access Server](https://openvpn.net/as-docs/videos/video--post-auth-saml-user-group-mapping.md) - [Video: How to Configure SAML with Microsoft Entra ID on Access Server](https://openvpn.net/as-docs/videos/video--saml-with-microsoft-entrada-id.md) We also provide SAML support articles in our knowledge base: - [Access Server SAML support articles](https://support.openvpn.com/hc/en-us/search?category=360006075631&filter_by=knowledge_base&query=SAML&utf8=%E2%9C%93) ## SAML and TOTP MFA > **Important** > > By design, SAML authentication on Access Server doesn't work with the TOTP MFA toggle in the Admin Web UI. > > When you use SAML as your authentication method and set up multi-factor authentication (MFA), ensure that the MFA occurs with the IdP. With Access Server, you can enable TOTP MFA by simply clicking a toggle or enabling it on a user or group. If some users are configured with TOTP MFA through Access Server, ensure you differentiate them from SAML users with groups or by setting the TOTP MFA at the user level. Another use case for configuring SAML and TOTP MFA outside of your IdP involves adding DUO MFA. We walk you through these steps in this tutorial: - [Tutorial: Configure Access Server SAML authentication with DUO MFA and your IdP](https://openvpn.net/as-docs/tutorials/saml-with-duo-mfa.md) --- Prev: [RADIUS](https://openvpn.net/as-docs/radius.md) Next: [PAM](https://openvpn.net/as-docs/pam.md) Index: https://openvpn.net/as-docs/llms.txt