openconnect-saml
OpenConnect wrapper with Azure AD / SAML SSO support for Cisco AnyConnect VPNs.
Drives the SAML/SSO authentication flow against Cisco AnyConnect
gateways and hands the resulting cookie to openconnect. Supports
Azure AD, ADFS, and most enterprise IdPs out of the box; works with
Yubikey / Nitrokey hardware keys, Duo, Microsoft Authenticator, and
TOTP from your password manager.
Maintained fork of vlaci/openconnect-sso,
combining work from kowyo/openconnect-lite.
Install
pip install "openconnect-saml[gui]" # Qt browser
pip install "openconnect-saml[chrome]" # Chromium / Playwright
pip install openconnect-saml # Headless only
Arch: yay -S openconnect-saml. Requires Python ≥ 3.10 and
openconnect in $PATH. See
docs/installation.md for Docker, build
from source, and system-deps per distro.
Quick start
# Interactive setup — server, username, TOTP, browser, auto-reconnect
openconnect-saml setup
# Connect to a saved profile
openconnect-saml connect work
# Or one-shot, no profile
openconnect-saml --server vpn.example.com --user user@example.com
Headless (servers, containers, CI):
openconnect-saml --server vpn.example.com --headless --user user@example.com
Features
- Three browser backends — Qt6 WebEngine, Chromium via Playwright, or full headless. Hardware-key WebAuthn works in all three. See docs/browsers.md.
- Five TOTP providers — local keyring, 2FAuth,
Bitwarden, 1Password, pass — or
--no-totpto skip the prompt. See docs/authentication.md. - Multi-profile — save / list / rename / export / import named
VPN configs. Includes export to NetworkManager's
.nmconnectionformat for the Ubuntu / GNOME VPN UI. See docs/profiles.md. - Auto-reconnect with exponential back-off, optional cap.
operations.md - Kill-switch — iptables-based, session or persistent, with
DNS / LAN allow-listing.
networking.md - systemd integration — install a per-server unit;
service start/stop/status/logs.operations.md - Connection history & stats — JSONL audit log, aggregated
summaries (
history stats), JSON output for monitoring.operations.md - Diagnostics —
doctorchecks Python / openconnect / sudo / TUN / dependencies / keyring / DNS / TLS / SAML endpoint.diagnostics.md
Documentation
The docs/ directory has a topic-per-file reference. Start with docs/README.md for the index.
| Topic | Where |
|---|---|
| Installation, Docker, system deps | docs/installation.md |
| Browser backends + minimal GUI | docs/browsers.md |
| TOTP providers + FIDO2 + credentials | docs/authentication.md |
| Profiles + NetworkManager export | docs/profiles.md |
| Split-tunnel + kill-switch + proxy | docs/networking.md |
| Reconnect, systemd, status, history | docs/operations.md |
Config file + setup + config subcommand |
docs/configuration.md |
doctor, troubleshooting, exit codes |
docs/diagnostics.md |
| Full CLI reference (every flag) | docs/cli-reference.md |
| Contributor setup + release flow | docs/development.md |
Migrating from openconnect-sso |
docs/migration.md |
Links
| Resource | URL |
|---|---|
| PyPI | https://pypi.org/project/openconnect-saml/ |
| AUR | https://aur.archlinux.org/packages/openconnect-saml |
| Releases | https://github.com/mschabhuettl/openconnect-saml/releases |
| Issues | https://github.com/mschabhuettl/openconnect-saml/issues |
| Changelog | CHANGELOG.md |
| License | GPL-3.0 |
Credits
Upstream / origin
- László Vaskó (vlaci) — original
openconnect-sso - Kowyo —
openconnect-litemodernization
Recent contributors
- @derkarnold —
--auth-scriptpluggable authentication (#29, v0.23.0) - @salty-flower — root-cause diagnosis of the PyQt 6.11 WebAuthn slot-signature crash (#24, v0.21.0)
- @kobuki —
--no-cert-check/ self-signed gateway report driving the v0.22.0 + v0.22.2 cert fixes and the console-only Microsoft Entra path in v0.22.4 (#19) - @OmarHawk —
--allowed-hostswhitelist proposal (#11, v0.20.0),--useragent(#12, v0.7.0), openconnect passthrough (#13, v0.7.0), MFA discussion that shaped the chrome / qt / headless three-way split (#17) - @BBKmsZrd — Yubikey / Nitrokey hardware-token reports + iterative debug-log triage (#21, #24)
- @cnekmp —
sso-v2-loginparser regression report driving the namespaced-fields + form fallback (#20, v0.8.1) - @mdesantis — minimal GUI proposal
- NetworkManager
.nmconnectionexport request (#22, v0.8.x)
- NetworkManager
Everyone else who's filed an issue, tested a release candidate, or pasted a debug log — thank you. See the full contributors graph.
1 maintainer
Metadata
1 maintainer
Release files for openconnect-saml 0.24.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| openconnect_saml-0.24.5.tar.gz | 265.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| openconnect_saml-0.24.5-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 410.4 kB
Release files / openconnect_saml-0.24.5.tar.gz
| Download URL | openconnect_saml-0.24.5.tar.gz |
|---|---|
| Size | 265.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8817455f64f1836abd91a5ac7b1c8d94b0924685f02ff8a15a5cc3fbce4b9320
|
|
BLAKE2b-256 checksum How to use checksums |
eb9e97862904be6023bb74ea4afd686ab9c32c51b021b95aa527b4823753bf09
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 7, 2026.
Transparency logRelease files / openconnect_saml-0.24.5-py3-none-any.whl
| Download URL | openconnect_saml-0.24.5-py3-none-any.whl |
|---|---|
| Size | 144.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
a97363f78e918a30399f3757d17a83b3265c28ceb743e12338b0fff24898d21e
|
|
BLAKE2b-256 checksum How to use checksums |
c9a1cac645e27072d283bd9d0a3fbb53d92d408ae42e7874cc2896a25e8a8a27
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 7, 2026.
Transparency log
