VPN SAML Authentication with Access Server | OpenVPN
Introduction
Access Server supports Security Assertion Markup Language (SAML), an XML-based standard for exchanging authentication and authorization data between Access Server as the Service Provider (SP) and a SAML Identity Provider (IdP).
The advantage of SAML is that it can provide a single sign-on (SSO) experience. This means you can use the same SAML IdP credentials to access various applications and services that support SAML authentication, eliminating the need to add new credentials for each application or service.
The Access Server SAML process
When you enable SAML for authentication on your Access Server, users do not sign in with Access Server-specific credentials. Instead, they use their credentials for the IdP, giving them a single sign-on (SSO) experience. Here’s how the sign-in flows might look (two examples).
Setting up Access Server SAML with your IdP
Setting up SAML with Access Server requires several configuration steps:
Provide the Service Provider information to the Identity Provider.
Provide the Identity Provider information to the Service Provider.
Enable SAML with Access Server.
Assign users access through the IdP.
Users successfully sign in.
We provide detailed tutorials to help you set up SAML with several IdPs:
If you're looking for SAML with CloudConnexa, refer to the SAML CloudConnexa documentation.
Additional SAML links
Use these additional tutorials for specific SAML features:
Tutorial: Setting up forced authentication (forceAuthn) for SAML users
Tutorial: How to Enforce Specific Authentication Context for SAML Logins
Use these links to watch SAML videos:
Video: How to automate SAML user group mapping with Okta on Access Server
Video: How to Configure SAML with Microsoft Entra ID on Access Server
We also provide SAML support articles in our knowledge base:
SAML and TOTP MFA
Another use case for configuring SAML and TOTP MFA outside of your IdP involves adding DUO MFA. We walk you through these steps in this tutorial: