A NetworkManager VPN plugin that adds OAuth 2.0 / OIDC Single Sign-On (SSO) support for OpenVPN connections.

• Browser-based SSO authentication - Opens your default browser for OAuth/OIDC login
• Automatic OAuth discovery - Discovers authentication URLs from the OpenVPN server
• Session token caching - Caches session tokens for connection maintenance
• Desktop notifications - Shows connection status via system notifications
• Full NetworkManager integration - Works seamlessly with NetworkManager and network applets

# From AUR or download from releases
sudo pacman -U networkmanager-openvpn-sso-*.pkg.tar.zst

sudo dpkg -i networkmanager-openvpn-sso_*_amd64.deb
sudo apt-get install -f  # Install any missing dependencies

sudo dnf install networkmanager-openvpn-sso-*.x86_64.rpm

# Download and extract the tarball
tar -xzf nm-openvpn-sso-service-linux-x86_64.tar.gz

# Run the install script
sudo ./install.sh

1. Import your .ovpn file using NetworkManager:

nmcli connection import type openvpn file your-vpn-config.ovpn

2. Modify the connection to use the SSO plugin:

# Get the connection name
nmcli connection show | grep vpn

# Update to use SSO plugin
nmcli connection modify "your-vpn-name" vpn.service-type org.freedesktop.NetworkManager.openvpn-sso

3. Connect to the VPN:

nmcli connection up "your-vpn-name"

Your default browser will open for SSO authentication. After successful login, the VPN connection will be established automatically.

The VPN connection will appear in your system's network settings and can be activated from there. When connecting, your browser will open for authentication.

This project includes a native plasma-nm UI plugin that integrates directly with KDE Plasma's network applet. When installed, you can:

• Create, configure, and manage OpenVPN SSO connections from Plasma's network settings
• Import .ovpn files directly through the Plasma UI
• Connect and disconnect from the system tray network applet

The plugin is built automatically during installation if KDE dependencies are available.

If the plugin is not installed, you can still use:

1. Command line: nmcli connection up "your-vpn-name"
2. nm-connection-editor: GTK-based GUI that works on KDE
3. vpn-sso-connect: Helper script with KDialog integration (installed with this package)

• NetworkManager
• OpenVPN
• D-Bus
• A graphical session (for browser-based authentication)

# Arch Linux
sudo pacman -S rust cargo dbus openssl pkgconf

# For KDE Plasma integration (optional)
sudo pacman -S extra-cmake-modules qt6-base networkmanager-qt kio ki18n kcoreaddons plasma-nm

# Debian/Ubuntu
sudo apt-get install rustc cargo libdbus-1-dev libssl-dev pkg-config

# Fedora
sudo dnf install rust cargo dbus-devel openssl-devel pkg-config

git clone https://github.com/pegasusheavy/network-manager-openvpn-sso.git
cd network-manager-openvpn-sso
cargo build --release

sudo ./install.sh

sudo ./uninstall.sh

The plugin stores session tokens in /var/lib/nm-openvpn-sso/ with restricted permissions. These tokens are used for session maintenance but do not persist across new connection attempts (SSO is required for each new connection).

Ensure you have a default browser set and that xdg-open or your browser is accessible. The plugin will try multiple methods to open the browser:

1. xdg-open (skipped on KDE due to KIO limitations)
2. Direct browser launch (vivaldi, firefox, chromium, google-chrome)

Check the NetworkManager logs for details:

journalctl -u NetworkManager -f

Verify that the VPN routes are correctly applied:

ip route | grep tun

This means the plasma-nm UI plugin is not installed. Rebuild with KDE dependencies available:

# Arch Linux
sudo pacman -S extra-cmake-modules qt6-base networkmanager-qt kio ki18n kcoreaddons plasma-nm
sudo ./install.sh

The VPN still works without the plugin—use nmcli or nm-connection-editor to connect.

1. NetworkManager activates the VPN connection
2. The plugin starts OpenVPN with management interface enabled
3. OpenVPN connects to the server and receives an SSO authentication URL
4. The plugin opens your browser to the authentication URL
5. After successful authentication, the server provides credentials
6. The plugin completes the VPN connection and configures networking

MIT License - see LICENSE for details.

Contributions are welcome! Please feel free to submit a Pull Request.

• GitHub Issues
• Patreon

Made with ❤️ by Pegasus Heavy Industries LLC