# Docs on SSO/SAML using a self-hosted identity provider **URL:** \ **Category:** Pritunl VPN\ **Tags:** pritunl\ **Created:** [June 23, 2022, 10:47am UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206 "2022-06-23T10:47:37Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![sbock](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/s/51bf81/32.png) [@sbock](https://forum.pritunl.com/u/sbock)\ **Post date:** [June 23, 2022, 10:47am UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/1 "2022-06-23T10:47:37Z")
Hi pritunl community and devs 🙂 The Enterprise Version of pritunl lists “Single sign-on with SAML” as a feature. However, the documentation only covers single sign-on with cloud providers (Google, OneLogin, Azure, …). We tried to setup single sign-on over SAML with our own self-hosted identity provider ([keycloak](https://www.keycloak.org/)) and couldn’t get it to work. The logs weren’t helpful either. We briefly skimmed through the code and didn’t know how the api endpoint `https://auth.pritunl.com` played into this setup? Are there any guides/docs we are missing? Thanks 🙂 sbock ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [June 23, 2022, 5:08pm UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/2 "2022-06-23T17:08:54Z")
Currently only Okta, OneLogin and JumpCloud are supported as SAML providers. ---
**Author:** ![sbock](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/s/51bf81/32.png) [@sbock](https://forum.pritunl.com/u/sbock)\ **Post date:** [June 24, 2022, 8:02am UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/3 "2022-06-24T08:02:57Z")
That is unfortunate. Thanks for the quick response! ---
**Author:** ![kkirk](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/k/4bbf92/32.png) [@kkirk](https://forum.pritunl.com/u/kkirk)\ **Post date:** [June 28, 2022, 3:56pm UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/5 "2022-06-28T15:56:25Z")
Will Google become a SAML provider? The news from Google that password vaulted apps total shut down. We use pritunl Zero and noticed that Pritunl is part of the 200 Google deemed “pre-integrated”. Do those instructions still apply to Pritunl Zero? Seems I’m stuck on step two, ![Screen Shot 2022-06-28 at 11.54.34 AM](https://forum-static.pritunl.com/original/1X/8ad88101431cc695b8ade9588a824642b6d8a7fc.jpeg) ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [June 28, 2022, 9:10pm UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/6 "2022-06-28T21:10:38Z")
Google has put up instructions for configuring Pritunl with SAML. The documentation was not provided by Pritunl and isn’t accurate. The OAuth Google single sign-on used in Pritunl is not a password vaulted app and it isn’t getting shut down. OAuth is preferred over SAML and there is no plans to support SAML for providers that have OAuth available. OAuth supports the ability to refresh tokens and verify user status unattended. After the user authenticates with the Pritunl web console using single sign-on the profile is imported into the client with a private key. That private key is then used to authenticate the user connection. To maintain support with all OpenVPN clients additional single sign-on authentication that would require a web browser is not done when connecting to the VPN. Instead OAuth and provider APIs are used by the Pritunl server to verify that the user account exists and is active and not disabled. For Google both an OAuth refresh and update with the Google Workspace API is done to verify the status of the user. Attempting to configure SAML alone will not provide any connection checks on the status of the user. This mode will need to either be paired with Duo or the users will need to be manually deleted from the Pritunl web console. None of this applies to Pritunl Zero or Pritunl Cloud which always has a web browser available and will send the user to the single sign-on provider for authentication updates. ---
**Author:** ![kkirk](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/k/4bbf92/32.png) [@kkirk](https://forum.pritunl.com/u/kkirk)\ **Post date:** [June 30, 2022, 3:14pm UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/7 "2022-06-30T15:14:04Z")
Thank you zach. ---
**Author:** ![sample](https://forum.pritunl.com/user_avatar/forum.pritunl.com/sample/32/806_2.png) [@sample](https://forum.pritunl.com/u/sample)\ **Post date:** [April 16, 2024, 12:05pm UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/8 "2024-04-16T12:05:33Z")
Hi. I wrote python script that acts as a middleware between Pritunl and Keycloak, performing real-time user status checks during VPN connection attempts. It ensures that: - Only users who exist in Keycloak and are not blocked are allowed to access the Pritunl VPN. - Users blocked with unverified email (optional check) are denied VPN access. [Github repo](https://github.com/sample/pritunl-keycloak-user-check) Also, I made simple instruction for keycloak and pritunl integration [here](https://github.com/sample/pritunl-keycloak-user-check/blob/main/PRITUNL-SAML-KEYCLOAK-INTEGRATION.md) ---
**Author:** ![jaredc](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/j/dec6dc/32.png) [@jaredc](https://forum.pritunl.com/u/jaredc)\ **Post date:** [December 13, 2024, 12:16pm UTC](https://forum.pritunl.com/t/docs-on-sso-saml-using-a-self-hosted-identity-provider/206/9 "2024-12-13T12:16:58Z")
So glad I found your post , we are evaluating pritunl and currently use radius auth which handles ldap and 2fa etc But I have a general feeling we should take the opportunity to move to SSO not just for vpn and I have been testing another vpn solution with Authentik , but keycloak was another option I was looking at.