Could you try changing the following line:

auth_message=xml.auth.get("message"),

and see if the connection succeeds that way.

This change made a change to the output, but it still doesn't connect:

[debug    ] Auth finish response received  [openconnect_sso.authenticator] content=b'<?xml version="1.0" encoding="UTF-8"?>\n<config-auth client="vpn" type="complete">\n<version who="sg">0.1(1)</version>\n<auth id="success">\n<title>SSL VPN Service</title></auth>\n<config client="vpn" type="private"><vpn-profile-manifest><vpn rev="1.0"><file type="profile" service-type="user"><uri>/profiles//config/profile.xml</uri><hash type="sha1">919A911F43566682DB27559388BB836CC8203DAF</hash></file></vpn></vpn-profile-manifest>\n</config></config-auth>'
Traceback (most recent call last):
  File "/usr/bin/openconnect-sso", line 33, in <module>
    sys.exit(load_entry_point('openconnect-sso==0.7.3', 'console_scripts', 'openconnect-sso')())
  File "/usr/lib/python3.9/site-packages/openconnect_sso/cli.py", line 169, in main
    return app.run(args)
  File "/usr/lib/python3.9/site-packages/openconnect_sso/app.py", line 34, in run
    auth_response, selected_profile = asyncio.get_event_loop().run_until_complete(
  File "/usr/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
    return future.result()
  File "/usr/lib/python3.9/site-packages/openconnect_sso/app.py", line 139, in _run
    auth_response = await authenticate_to(
  File "/usr/lib/python3.9/site-packages/openconnect_sso/authenticator.py", line 44, in authenticate
    response = self._complete_authentication(auth_request_response, sso_token)
  File "/usr/lib/python3.9/site-packages/openconnect_sso/authenticator.py", line 81, in _complete_authentication
    return parse_response(response)
  File "/usr/lib/python3.9/site-packages/openconnect_sso/authenticator.py", line 142, in parse_response
    return parse_auth_complete_response(xml)
  File "/usr/lib/python3.9/site-packages/openconnect_sso/authenticator.py", line 188, in parse_auth_complete_response
    session_token=xml["session-token"],
  File "src/lxml/objectify.pyx", line 289, in lxml.objectify.ObjectifiedElement.__getitem__
  File "src/lxml/objectify.pyx", line 450, in lxml.objectify._lookupChildOrRaise
AttributeError: no such child: session-token

Hm, the response structure is different then the one I am familiar with.
My VPN responds with the structure like this:

<?xml version="1.0" encoding="UTF-8"?>
<config-auth client="vpn" type="complete" aggregate-auth-version="2">
<session-id>11111111</session-id>
<session-token>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</session-token>
<auth id="success">
<message id="0" param1="" param2=""></message>
</auth>
<!-- [...] -->
</config-auth>

The session-token is a long alphanumerical string which is used to authenticate the actual VPN connection. Do you see something in the response that could contain that value?

This is the closest I get from the debug messages. The server is running ocserv, should that matter?

[debug ] Sending auth finish request [openconnect_sso.authenticator] content=b'<?xml version=\'1.0\' encoding=\'UTF-8\'?>\n<config-auth client="vpn" type="auth-reply" aggregate-auth-version="2">\n <version who="vpn">4.7.00136</version>\n <device-id>linux-64</device-id>\n <session-token/>\n <session-id/>\n <opaque is-for="sg">\n <auth-method>single-sign-on-v2</auth-method>\n </opaque>\n <auth>\n <sso-token>xxXXxxXxxXxxXxXXXxXxXXxxxxxxxXxXxXxXXXxXXXX=</sso-token>\n </auth>\n</config-auth>\n' https://some.host.tld:443 "POST / HTTP/1.1" 200 454 [debug ] Auth finish response received [openconnect_sso.authenticator] content=b'<?xml version="1.0" encoding="UTF-8"?>\n<config-auth client="vpn" type="complete">\n<version who="sg">0.1(1)</version>\n<auth id="success">\n<title>SSL VPN Service</title></auth>\n<config client="vpn" type="private"><vpn-profile-manifest><vpn rev="1.0"><file type="profile" service-type="user"><uri>/profiles//config/profile.xml</uri><hash type="sha1">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</hash></file></vpn></vpn-profile-manifest>\n</config></config-auth>'

I see you have an sso-token element in the xml. You could try adjusting this line:

session_token=xml["sso-token"],

If this would work, I'll update the code to handle this case.

strangely, that results in python claiming not having seen that child node:

Ohm, I have misread the logs: The sso-token was the one we have posted to the VPN endpoint, not the response to that.

My next idea is that you need to specify the tunnel-group for the connection. In my case the VPN server uses a default one but it may not be for you. I think about what could be done there.

@vlaci I am seeing the same issue, and I can see from the debug output that I do require a different tunnel group, so I suspect you are correct.