There is a somewhat commonly known issue where connecting to a VPN with NetworkManager fails instantly without prompting for credentials.
The error message is:
“Unable to connect, no valid VPN secrets available”
And inspecting journalctl shows:
“secrets: failed to request VPN secrets #3: User canceled the secrets request.”
In the past, the solution could be fixed by installing webkit2gtk-4.1 and libnma-gtk4. However, now I was tearing my hair out trying to help a friend setup his VPN, and none of the above fixed the issue. We eventually landed on
ldd -r /usr/lib/nm-openconnect-auth-dialog
to diagnose the issue. As it turned out, for my friend was missing the svt-av1 dependency, which is required by libavif. It’s likely that many users will already have this dependency installed because it is required by the common ffmpeg package.
Anyway, the purpose of this post is twofold:
A) To help anyone who might have similar issues and already desperately searched page 4 of the Google search results. (Including future me)
B) To possibly discuss and understand why a freaking VPN authentication plugin has a video encoder dependency !?
I found that openconnect is an open client for Cisco Anyconnect.
The package libavif is required by webkit2gtk-4.1 which in turn is required by openconnect.
The connect package is using functionality provided in webkit2gtk and it is a cascading dependency and not the vpn in itself. The system used to search is Manjaro on unstable branch - so my versions may be newer than the versions on stable branch.
$ pamac search -f libavif
/usr/lib/wine/i386-windows/libavifil32.a is owned by wine-staging
/usr/lib/wine/x86_64-unix/libavifil32.a is owned by wine-staging
/usr/lib/wine/x86_64-windows/libavifil32.a is owned by wine-staging
/usr/share/doc/qt6/qtwebengine/qtwebengine-3rdparty-libavif-library-for-encoding-and-decoding-avif-files.html is owned by qt6-doc
/usr/lib/darktable/plugins/imageio/format/libavif.so is owned by darktable
/usr/lib/cmake/libavif/libavif-config-noconfig.cmake is owned by libavif
/usr/lib/cmake/libavif/libavif-config-version.cmake is owned by libavif
/usr/lib/cmake/libavif/libavif-config.cmake is owned by libavif
/usr/lib/libavif.so is owned by libavif
/usr/lib/libavif.so.16 is owned by libavif
/usr/lib/libavif.so.16.3.0 is owned by libavif
/usr/lib/pkgconfig/libavif.pc is owned by libavif
/usr/share/licenses/libavif/LICENSE is owned by libavif
/usr/i686-w64-mingw32/lib/libavifil32.a is owned by mingw-w64-crt
/usr/x86_64-w64-mingw32/lib/libavifil32.a is owned by mingw-w64-crt
/usr/lib/wine/i386-windows/libavifil32.a is owned by wine
/usr/lib/wine/x86_64-unix/libavifil32.a is owned by wine
/usr/lib/wine/x86_64-windows/libavifil32.a is owned by wine
/usr/lib/odin/vendor/sdl3/image/libavif-16.dll is owned by odin
$ pacman -Qii libavif
Name : libavif
Version : 1.3.0-5
Description : Library for encoding and decoding .avif files
Architecture : x86_64
URL : https://github.com/AOMediaCodec/libavif
Licenses : LicenseRef-libavif
Groups : None
Provides : None
Depends On : aom dav1d gcc-libs glibc libjpeg-turbo libpng libwebp libyuv rav1e svt-av1
Optional Deps : None
Required By : darktable gd python-pillow sdl2_image webkit2gtk-4.1
Optional For : kimageformats
Conflicts With : None
Replaces : None
Installed Size : 758,83 KiB
Packager : Peter Jung <ptr1337@archlinux.org>
Build Date : søn 01 feb 2026 18:47:59 CET
Install Date : ons 04 feb 2026 07:04:00 CET
Install Reason : Installed as a dependency for another package
Install Script : No
Validated By : Signature
Backup Files : None
Extended Data : pkgtype=pkg
$ pamac info webkit2gtk
Name : webkit2gtk
Version : 2.50.5-1
Description : Web content engine for GTK
URL : https://webkitgtk.org
Licenses : AFL-2.0 OR GPL-2.0-or-later Apache-2.0 Apache-2.0 WITH LLVM-exception
BSD-2-Clause BSD-2-Clause-Views BSD-3-Clause BSD-Source-Code BSL-1.0
bzip2-1.0.6 GPL-2.0-only GPL-3.0-only WITH Autoconf-exception-3.0
GPL-3.0-or-later WITH Bison-exception-2.2 ICU ISC LGPL-2.1-only
LGPL-2.1-or-later MIT MPL-1.1 MPL-2.0 NCSA NCSA OR MIT OFL-1.1 SunPro
Unicode-TOU
Repository : extra
Installed Size : 134,0 MB
Groups : --
Depends On : at-spi2-core atk bubblewrap cairo enchant expat fontconfig freetype2 gcc-libs
gdk-pixbuf2 glib2 glibc gst-plugins-bad-libs gst-plugins-base-libs gstreamer
gtk3 harfbuzz harfbuzz-icu hyphen icu lcms2 libavif libdrm libegl libepoxy
libgcrypt libgl libgles libjpeg-turbo libjxl libmanette libpng libseccomp
libsecret libsoup libsystemd libtasn1 libwebp libx11 libxml2 libxslt mesa
openjpeg2 pango sqlite ttf-font wayland woff2 xdg-dbus-proxy zlib
Optional Dependencies : geoclue: Geolocation support
gst-libav: nonfree media decoding [Installed]
gst-plugins-bad: media decoding [Installed]
gst-plugins-good: media decoding [Installed]
Provides : libjavascriptcoregtk-4.0.so=18-64 libwebkit2gtk-4.0.so=37-64
Replaces : --
Conflicts With : --
Packager : Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Build Date : tir 10 feb 2026 01:46:41 CET
Validated By : MD5 Sum SHA-256 Sum Signature
$ pamac info libnma-gtk4
Name : libnma-gtk4
Version : 1.10.6-3
Description : NetworkManager GUI client library (GTK4)
URL : https://gitlab.gnome.org/GNOME/libnma
Licenses : GPL-2.0-or-later LGPL-2.1-or-later
Repository : extra
Installed Size : 480,8 kB
Groups : --
Depends On : libnma-common=1.10.6-3 gtk4
Optional Dependencies : --
Required By : networkmanager-openvpn
Optional For : networkmanager-l2tp networkmanager-openconnect networkmanager-pptp
networkmanager-vpnc
Provides : libnma-gtk4.so=0-64
Replaces : --
Conflicts With : --
Packager : T.J. Townsend <blakkheim@archlinux.org>
Build Date : fre 12 jul 2024 22:47:55 CEST
Install Date : man 22 sep 2025 06:47:00 CEST
Install Reason : Installed as a dependency for another package
Validated By : Signature
Backup files : --
I vaguely remember another topic where libnma and libnma-gtk4 conflicted or something and provided different functionality.