How to use "openconnect" (via the openconnect-sso
wrapper) with SAML and Duo two-factor authentication via Okta Single-Sign-on (SSO)
Tested and works on at least Ubuntu 18.04 and 22.04.
I have blacked out appropriate parts of the screenshots for my security.
This answer is also in my eRCaGuy_dotfiles repo here: https://github.com/ElectricRCAircraftGuy/eRCaGuy_dotfiles/blob/master/vpn/openconnect-sso.md.
Cisco AnyConnect is an incredibly restrictive VPN client. It routes all traffic though the VPN and blocks all local connections once connected to the VPN.
My preferred way to solve this is to simply use OpenConnect instead. It is compatible with Cisco AnyConnect servers and its client allows local connections even when the VPN is connected, routing only necessary traffic through the VPN (via split tunneling) to reach endpoints which are otherwise unavailable without the VPN. Therefore, openconnect
solves this problem and allows LAN access while connected to a Cisco VPN.
Example 1: Simple openconnect
example with Duo Two-factor authentication
Here is an example of how to connect to the Rice University VPN using openconnect
: kb.rice.edu: VPN: openconnect VPN for Linux using Duo Authentication:
# install
sudo apt update
sudo apt install vpnc-scripts openconnect
# connect
# NB: for the **second password** field when running the commands below, type
# `pin`, `push`, `phone`, or `sms` to specify how you'd like to receive your
# two-factor authentication request. Add a number to the end of the command if
# you have multiple registered devices. Ex: `push2`, `phone2`, `sms2`, etc.
# Option 1: runs in the background
openconnect -b --quiet --user=netID --authgroup=RiceNet connect.rice.edu
# Option 2: runs in the background
openconnect -b --quiet --no-dtls --user=netID --authgroup=RiceNet connect.rice.edu
# Option 3: runs in the foreground
openconnect --no-dtls connect.rice.edu
To disconnect, use Ctrl + C in the terminal if running the process in the foreground. Or, if running the process in the background, open any terminal and run one of the following commands to send the running process the Ctrl + C SIGINT
interrupt signal safely like this:
# to cleanly kill openconnect or openconnect-sso
sudo pkill --signal SIGINT openconnect
# or (same thing)
sudo pkill -SIGINT openconnect
See more details in my answer here: How to shut down openconnect
cleanly?
Example 2 [What I use]: using the openconnect-sso
wrapper for SAML authentication via Okta Single-Sign-on (SSO) and Duo two-factor authentication
My case is more complex, so I can't use openconnect
by itself. Instead, I must use the openconnect-sso
"OpenConnect Single Sign-On (SSO)" wrapper which allows SAML 2-factor authentication via Okta, in place of the Cisco AnyConnect client.
I found installing openconnect-sso
to be incredibly difficult due to some simple dependency problems, but these instructions should make it easy for you:
sudo apt update
sudo apt install vpnc-scripts openconnect # install openconnect
sudo apt install python3 pip
python3 -m pip install --upgrade pip
python3 -m pip install openconnect-sso # install openconnect-sso
# install openconnect-sso dependencies, including forcing a reinstall of PyQt5
# uninstall
python3 -m pip uninstall PyQt5
python3 -m pip uninstall PyQt5-sip
python3 -m pip uninstall PyQtWebEngine
python3 -m pip uninstall keyring
# reinstall
python3 -m pip install PyQt5
python3 -m pip install PyQt5-sip
python3 -m pip install PyQtWebEngine
python3 -m pip install keyring
python3 -m pip install cffi
# Check the version
# My output is: `openconnect-sso 0.7.3`
openconnect-sso --version
Usage (note: for how to find your server address and SAML group, see below):
Big thanks to @smoser here and @lucashtc here for their help in fixing some issues I saw when running this in Ubuntu 22.04. See also my comment here.
Create a ~/.my_ssl.conf
file:
gedit ~/.my_ssl.conf
Then paste the following into it:
# Custom configuration to solve some problems while using `openconnect-sso` in Ubuntu 22.04.
# See: https://github.com/vlaci/openconnect-sso/issues/81#issuecomment-1363355533
openssl_conf = openssl_init
[openssl_init]
ssl_conf = ssl_sect
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
Options = UnsafeLegacyRenegotiation
Save it and close it.
Then run this:
VPN_SERVER_ADDRESS="myvpn.whatever.com" # example server address to connect to
VPN_SAML_GROUP="whatever-saml-whatever" # example SAML group name
VPN_USER="[email protected]" # example username
# or perhaps just this for the username:
# VPN_USER="my.username"
# Custom configuration to solve some problems while using `openconnect-sso` in Ubuntu 22.04.
# See: https://github.com/vlaci/openconnect-sso/issues/81#issuecomment-1363355533
export QTWEBENGINE_DISABLE_SANDBOX=1
export OPENSSL_CONF=~/.my_ssl.conf
# connect via `openconnect-sso`
# The first time ever, you must specify everything
openconnect-sso --server "${VPN_SERVER_ADDRESS}/${VPN_SAML_GROUP}" --user "${VPN_USER}"
# Subsequent connection attempts can be done with just this, since apparently
# the server address, SAML group, and username are cached after the first usage
openconnect-sso
Note that you can also place the above-used variables into your ~/.bashrc
file. export
is required for two of them, but not for the VPN*
variables I set above.
Add to the bottom of your ~/.bashrc
file:
# Custom configuration to solve some problems while using `openconnect-sso` in Ubuntu 22.04.
# See: https://github.com/vlaci/openconnect-sso/issues/81#issuecomment-1363355533
export QTWEBENGINE_DISABLE_SANDBOX=1
export OPENSSL_CONF=~/.my_ssl.conf
VPN_SERVER_ADDRESS="myvpn.whatever.com" # example server address to connect to
VPN_SAML_GROUP="whatever-saml-whatever" # example SAML group name
VPN_USER="[email protected]" # example username
# or perhaps just this for the username:
# VPN_USER="my.username"
Now log out of Ubuntu and log back in, or re-source your ~/.bashrc
file:
. ~/.bashrc
Then you can just run openconnect-sso
without those leading variables:
# the first time
openconnect-sso --server "${VPN_SERVER_ADDRESS}/${VPN_SAML_GROUP}" --user "${VPN_USER}"
# Subsequent connection attempts
openconnect-sso
.my_ssl.conf is part of my eRCaGuy_dotfiles repo now too.
Screenshots and sequence of events during connecting:
Once I run the openconnect-sso
command above, this is what happens:
openconnect-sso
opens up a web-page which is "Powered by Okta" (as stated at the bottom of it--see screenshot below) and which is requesting my Username and Password for Duo SSO (single sign-on) two-factor authentication. My username and password are already filled in--probably since I've done this before. It says, "We found some errors. Please review the form and make corrections." Ignore that error. I think this is just because the username and password were automatically typed in, and it doesn't detect them yet. To make it detect them, I just have to click in the username box on my already-typed-in username and press Tab twice. That interaction with the input boxes causes the form to detect that my username and password are present. It then automatically validates my username and password since they are already typed in, and then it loads a new web page.

On the new page, I make sure my correct phone number or device is selected in the "Device" box, then I click the "Send me a Push" button, and it sends a Duo two-factor authentication push request to my phone. I authenticate on my phone in the Duo app, then the webpage window automatically closes.

Note that in the screenshot above, it says my "computer software is out of date" simply because it wants me to update my version of the Chrome browser to the latest. If I don't do that at least every 10 days or so, the VPN server won't let me log in.
Next, in the terminal, openconnect-sso
prints some statements that it has exited the browser (shown just below), then it requests my sudo
password (also shown just below) for my Linux Ubuntu username so it can run as root to do the final VPN connection as root. I type that in and press Enter. It then finishes connecting to the VPN. The last several lines it prints out, starting with where it closed the browser window and then asked for my Linux sudo
password, look as follows (note that I have changed my IP addresses in the output for my security):
[info ] Terminate requested. [webengine]
[info ] Exiting browser [webengine]
[info ] Browser exited [openconnect_sso.browser.browser]
[info ] Response received [openconnect_sso.authenticator] id=success message=
[sudo] password for gabriel:
Connected to xxx.xxx.xxx.x:443
SSL negotiation with myvpn.whatever.com
Server certificate verify failed: signer not found
Connected to HTTPS on myvpn.whatever.com
Got CONNECT response: HTTP/1.1 200 OK
CSTP connected. DPD 30, Keepalive 20
Connected as xx.xxx.x.xxx + aaaa:bbbb:cccc::ddd/64, using SSL
Established DTLS connection (using GnuTLS). Ciphersuite (DTLS0.9)-(DHE-RSA-4294967237)-(AES-256-CBC)-(SHA1).
Success! I am now fully connected to the VPN, yet I still have full access to my local LAN and can ssh into my local embedded-Linux boards!
Again, to disconnect, use Ctrl + C in the terminal running the process in the foreground. Or, open any terminal and run one of the following commands to send the running process the Ctrl + C SIGINT
interrupt signal safely like this:
# to cleanly kill openconnect or openconnect-sso
sudo pkill --signal SIGINT openconnect
# or (same thing)
sudo pkill -SIGINT openconnect
See more details in my answer here: How to shut down openconnect
cleanly?:
If you use sudo pkill openconnect
instead, it sends the default SIGTERM
termination signal instead, which force-kills it and does not kill it cleanly. If you make this simple mistake, simply turn your WiFi card OFF then back ON again by toggling it with Fn + F8 or equivalent (look for the wifi beacon icon) on your laptop keyboard. This resets your internet connection so your internet will work again.
How to find your VPN server address and SAML group
Tested with Cisco AnyConnect Secure Mobility Client version 4.10.05085 on Linux Ubuntu 18.04:

- Open the Cisco AnyConnect client and click the "VPN" tab. It will look like this. Your VPN server address is what is shown in the "Connect to" box.

- Click the "Connect" button and it will open up a "Powered by Okta" "Duo SSO" window in a new browser window.
- That browser window looks like this:

- The Cisco AnyConnect window now shows a "Group" box which shows your SAML Group:

- Use that VPN server address and SAML Group name in the
openconnect-sso
command above.
Example 2 troubleshooting
If you can't get the PyQt5 or other dependencies to work with plain Python3, then it may be because your Python3 version is too old. Try forcefully installing and using a later version of Python3 like this. For example, if I wanted to use Python3.8 it would look like this:
sudo apt update
sudo apt install vpnc-scripts openconnect # install openconnect
sudo apt install python3.8
python3.8 -m pip install --upgrade pip
python3.8 -m pip install openconnect-sso # install openconnect-sso
# install openconnect-sso dependencies, including forcing a reinstall of PyQt5
# uninstall
python3.8 -m pip uninstall PyQt5
python3.8 -m pip uninstall PyQt5-sip
python3.8 -m pip uninstall PyQtWebEngine
python3.8 -m pip uninstall keyring
# reinstall
python3.8 -m pip install PyQt5
python3.8 -m pip install PyQt5-sip
python3.8 -m pip install PyQtWebEngine
python3.8 -m pip install keyring
python3.8 -m pip install cffi
# Check the version
# My output is: `openconnect-sso 0.7.3`
openconnect-sso --version
Other tips
You can view various info. about your VPN server like this (source: https://gitlab.com/openconnect/openconnect/-/issues/84):
openconnect --dump -vvvv myvpn.whatever.com
References
Here are most of the additional references I had to look at to figure out some of the dependency and related info. above.
- https://kb.rice.edu/page.php?id=113148
- https://github.com/dlenski/openconnect/issues/116
- *****Python 3.7.0 No module named 'PyQt5.QtWebEngineWidgets'
- No module named _cffi_backend
- https://github.com/Nike-Inc/gimme-aws-creds/issues/158
- https://bobbyhadz.com/blog/python-no-module-named-pyqt5
- [my answer] How to install PyQt5 in Python3 and here
- ***** The openconnect-sso link at the very top of this thread is how I first learned of openconnect-sso!: https://gitlab.com/openconnect/openconnect/-/issues/84
- [my Q&A] Disable VPN for certain local devices, such as an embedded Linux board I need to ssh into (Allow local (LAN) access when using VPN)
- [my answer] How to shut down openconnect cleanly?
- https://github.com/vlaci/openconnect-sso
- All issues I opened: https://github.com/vlaci/openconnect-sso/issues?q=is%3Aissue+author%3AElectricRCAircraftGuy+
- [my issue] ModuleNotFoundError: No module named 'PyQt5' [solved; please update installation instructions with this info]
- https://github.com/dlenski/openconnect/issues/143
- https://gitlab.com/openconnect/openconnect/-/issues/84
- Google search for "open connect with duo two factor authentication"
- ***** Google search for
"openconnect" with duo two factor authentication and "okta"
- https://www.reddit.com/r/archlinux/comments/8wclaz/openconnect_and_two_factor_auth/
- https://duo.com/docs/okta
- [my answer] Cisco Anyconnect not working on Ubuntu 18.04 with two-factor authentication
- official
openconnect
repo--I think!: https://gitlab.com/openconnect/openconnect
- https://docs.python-guide.org/starting/install3/linux/
- Dealing with multiple Python versions and PIP?
- ***** https://github.com/vlaci/openconnect-sso/issues/81 - helped fix some bugs/issues when running
openconnect-sso
in Ubuntu 22.04
See also
- [my answer] Ask Ubuntu: How to install openconnect-sso on Ubuntu 21.04
- [my answer] Server Fault: Setting up access to a WatchGuard Firebox SSL VPN on Linux Ubuntu
openconnect
andopenconnect-sso
here.