NetworkManager SAML VPN Web Authenticaton

Brainstorm
,
1

So for VPN’s there is pretty good support for most every vendor these days, except for one thing - SAML-based VPN’s everyone does. It’s getting more and more common to deploy Enterprise VPN systems to use SAML for secure logins and MFA, but the problem for Linux is the web interaction that hast to occur with the IDP SAML provider like Okta, Ping, even Microsoft or RedHat isn’t there for either GTK or QT-based NetworkManager.

It’s about the same problem as a captive portal login someone else mentioned where using something like webkit2gtk to perform webpage rendering and token issue to the application or agent. SAML auth is super common these days, but always requires a native vendor VPN client as no one has a standard way of handing SAML across any desktop OS, but the plugins for each VPN generally do. Linux is about the closest to having ubiquitous VPN capabilities across vendors, just NOT for SAML.

Talking to the NetworkManager list folks, it sounds like SAML is fully supported in their code and plugins where available, only the desktop implementations for UI are missing for the web login sessions in the DE UI’s. It sounded like for KDE that’s in NetworkManager-QT, but then it has to play well with all the VPN plugins as well, that some do or don’t support SAML today.

Where is the best place to inquire if/why/when this sort of integration can be accomplished for SAML VPN for every open and commercial VPN offering, including OpenVPN, Cisco, Palo Alto, Fortigate, and a long list of others. Vendor Linux VPN clients always suck due to being poorly supported at best, and it seems all that is needed is the NetworkManager UI and DE integrations to include SAML as a modern VPN authentication method for anyone/everyone.

Thanks in advance!

2

Hi - I’m no networking expert at all, but selfishly for my own understanding… is what you’re talking about here basically like taking the merged code here - Add support for SAML based authentication when using OpenConnect VPN (6ef64be8) · Commits · Plasma / Plasma applet for NetworkManager · GitLab - and repeating that process that produced that code for each of the different VPN platforms you mentioned?

3

Ah yes, correct, probably much and the same, and every vendor does SAML these days and it’s an on or off option usually on the endpoint.

Each vendor plugin for NM probably has (or should) support for SAML, I know openconnect plugin was said to work for cli (manual token provision from web), which does Cisco, PAN, Fortinet, and other major vendors, OpenVPN and others have their own. I hadn’t seen OpenVPN had requested it too, but good for them, it can probably open up the avenue for everyone else too as long as the plugins know it’s available now.

The mega security vendors should give the team a kiss and donation for making their Linux-using customers hate them less if it did work, me included that works with customers commonly with them.

Thanks for pointing that out, I hadn’t found anything in searching threads here for any requests, I figured not since not existing as a feature yet.

1 Like