We use a specific identity provider for SSO. Which VPNs support SAML authentication with this provider?

To give you a precise list of which Virtual Private Networks (VPNs) support SAML authentication, I need to know a little bit about your setup.

Could you tell me which specific identity provider you are using for SSO (e.g., Okta, Azure AD/Entra ID, Ping Identity, OneLogin)?

Which identity provider are you using (for example, Okta, Microsoft Entra ID, Google Workspace, or OneLogin)?

Once you tell me the provider, I can identify VPNs that support SAML SSO with it, including relevant licensing/plan requirements.

Yes—but I need the name of your identity provider to give you an accurate compatibility list.

Several major VPN platforms support generic SAML 2.0 IdPs, including:

• Cisco Secure Client / AnyConnect — supports SAML 2.0 for VPN authentication.
• Palo Alto GlobalProtect — supports SAML authentication for Remote Access VPN.
• OpenVPN Access Server — supports SAML 2.0 and documents integrations with providers including Entra ID, Google Workspace, OneLogin, Keycloak, Okta, JumpCloud, and AWS.
• AWS Client VPN — supports SAML 2.0 federation with compatible identity providers.
• Cloudflare Access — accepts any SAML- or OIDC-compliant identity provider, although it's more of a Zero Trust/private-application access solution than a traditional full-network VPN.
• Proton VPN Business — supports SAML 2.0 SSO for business plans.

Tell me the IdP name (for example, Okta, Microsoft Entra ID, Ping Identity, JumpCloud, OneLogin, Keycloak, etc.), and I can narrow this down to the VPNs that officially support it, including any important version/licensing/client limitations.

Which identity provider (IdP) are you using (e.g., Azure AD/Entra ID, Okta, Ping Identity, OneLogin), and do you prefer clientless/browser-based SAML or direct integration?

I can narrow this down once you tell me the identity provider (IdP) you use (for example: Okta, Microsoft Entra ID, Ping Identity, Google Workspace, JumpCloud, Keycloak, Auth0, etc.). Most enterprise VPNs do not integrate with a specific IdP directly; they support the SAML 2.0 standard, so compatibility depends on the IdP’s SAML implementation and the VPN’s configuration options.

Common VPN solutions with SAML 2.0 support include:

A few things to verify before choosing:

• MFA/conditional access: Whether your IdP can enforce MFA, device posture, risk policies, etc., through the VPN SAML flow.
• Group mapping: Whether SAML attributes/groups map cleanly to VPN access policies.
• Client behavior: Many VPNs require a browser-based authentication step inside or alongside the VPN client.
• SAML version and bindings: Confirm SAML 2.0 support, ACS URL requirements, and attribute mappings.

If you share the exact identity provider (and optionally your VPN platform/firewall), I can give you a compatibility list and the relevant configuration requirements.

If you tell me which identity provider you are using (such as Okta, Azure AD/Entra ID, PingFederate, or OneLogin) and which VPN solutions you currently have in mind or deployed, I can check compatibility and list the supported integration steps for your specific setup.

Yes—several major VPN platforms support SAML 2.0, including:

• Palo Alto Networks GlobalProtect — supports SAML IdPs, including Okta and OneLogin.
• Cisco Secure Client / AnyConnect — supports SAML 2.0 for VPN authentication.
• FortiGate / FortiClient — supports SAML for SSL VPN and IPsec VPN, and explicitly documents integration with common IdPs such as Okta, Microsoft Entra ID, Google Workspace, and OneLogin.

But I need the name of your specific identity provider (e.g., Okta, Microsoft Entra ID, Google Workspace, Ping Identity, OneLogin, JumpCloud, etc.) to tell you exactly which VPNs support it and note any important limitations.

If you give me the IdP name, I can compare the current VPN options and their SAML support.

Most modern enterprise VPN solutions and secure-access gateways support SAML 2.0 authentication , allowing them to act as a Service Provider (SP) that integrates with major and custom Identity Providers (IdPs) like Microsoft Entra ID (Azure AD), Okta, Google Workspace, Ping Identity, and JumpCloud.

The primary enterprise VPNs and zero-trust network access (ZTNA) solutions with native SAML SSO support include:

• Palo Alto Networks GlobalProtect — Fully supports SAML authentication profiles for remote access VPN workflows, enabling pre-logon and browser-based SSO via your IdP.
• Fortinet FortiClient / FortiGate — Supports SAML authentication, letting the FortiGate appliance act as the service provider to redirect login requests to your corporate IdP.
• Cisco Secure Firewall / ASA (AnyConnect) — Supports SAML 2.0 external browser-based authentication for remote access VPNs, integrating cleanly with enterprise IdPs.
• OpenVPN Access Server & CloudConnexa — Built with native SAML 2.0 federation support for user authentication and single sign-on across client interfaces.
• Check Point Remote Access VPN — Supports SAML-based authentication flows for IPsec remote access scenarios.
• WatchGuard Firebox (Mobile VPN with SSL) — Supports SAML authentication server configurations on newer firmware versions for integrated client logins.
• AWS Client VPN — Provides native support for federated authentication using any SAML 2.0 compliant identity provider.
• Proton VPN for Business — Offers enterprise-grade SAML SSO configurations on higher-tier plans.
• Pritunl — Open-source/enterprise VPN server that natively handles SAML SSO integrations.

Could you let me know which specific identity provider you are using and whether you prefer a self-hosted or cloud-managed VPN , so I can narrow down the exact compatibility and configuration steps?

To tell you which VPNs support SAML authentication with your specific identity provider, I need a little more context about your setup.

Could you let me know:

• What identity provider (IdP) you are using (e.g., Okta, Azure AD/Entra ID, Ping Identity, JumpCloud, OneLogin)?
• Are you looking for hardware-based enterprise gateways (like Palo Alto, Fortinet, Cisco) or software-centric/cloud VPNs (like NordLayer, Tailscale, Twingate)?

If you share the name of your identity provider , I can give you a precise list of compatible VPN solutions and implementation overviews.

Yes—but I need the name of your identity provider to give you an accurate list.

For example, if you use Microsoft Entra ID, Okta, Google Workspace, OneLogin, or another SAML 2.0 IdP, several enterprise VPN platforms support it. Current examples include:

• Palo Alto GlobalProtect — supports SAML authentication for GlobalProtect gateways.
• Fortinet FortiGate/FortiClient — supports SAML for SSL VPN and, with newer FortiClient versions, IKEv2 IPsec VPN. Fortinet explicitly documents integration with Entra ID, Okta, Google Workspace, OneLogin, and other common IdPs.
• Cisco Secure Client/AnyConnect — also has SAML-based authentication options, but the exact capabilities depend on the VPN headend and deployment.

If you tell me which IdP you use (e.g. Okta, Entra ID, PingFederate, JumpCloud, Keycloak, etc.), I can give you a current comparison of VPNs that support it, including client OS support, MFA, group/role mapping, and any important limitations.