Duo Authentication

This documentation is a detailed guide for setting up Duo authentication on the Delinea Platform.

The following procedures require copying and pasting information between Cisco Duo and the Delinea Platform. We recommend opening both applications before you begin, and keeping both open until you are finished.

For details on enabling MFA on the Delinea Platform, see Creating Identity Policies.

Prerequisites

  • On the Delinea Platform, you will need to be a Platform Admin or have a role with the following permission: delinea.platform/identity/admin/manage

  • In Duo, you must be an Administrator and have access to the Duo Admin Console where you can protect applications and create users.

Build a Universal Authenticator Duo Application

  1. In the Duo Admin Console, navigate to Applications.

  2. Select Add Application.

  3. Filter the list of applications by entering Web SDK.

  4. In the Web SDK row, click Add.

  5. Copy and save the Client ID, Client secret, and API hostname. You will need these to configure Duo authentication on the Delinea Platform.

  6. Under Universal Prompt, ensure that Show new Universal Prompt is selected.

  7. (Optional) Configure policies per your requirements. Also see Duo Policies below.

  8. (Optional) Configure settings per your requirements. To enable self-service, see Duo’s Self-Service Portal documentation.

  9. Navigate to the Settings section and update the Name field to something your users would recognize, like Delinea Platform.

  10. Click Save.

Build an Auth API Duo Application

This feature is currently available only to customers participating in a Private Preview. If you'd like to participate and be among the first to try this feature, ask our support or account team for details.

  1. In the Duo Admin Console, navigate to Applications.

  2. Select Add Application.

  3. Filter the list of applications by entering Partner Auth API.

  4. In the Partner Auth API row, click Add.

  5. Copy and save the Integration Key, Secret Key, and API hostname. You will need these to configure Duo authentication on the Delinea Platform.

  6. (Optional) Configure policies per your requirements. Also see Duo Policies below.

  7. (Optional) Configure settings per your requirements. To enable self-service, see Duo’s Self-Service Portal documentation.

  8. Navigate to the Basic Configuration section and update the Name field to something your users would recognize, like Delinea Platform.

  9. Click Save.

Add Duo to the Platform

Adding Duo as an MFA Provider

  1. Log in to the Delinea Platform.

  2. Navigate to the MFA Providers page.

  3. From the Add Provider button, select Duo.

  4. On the Add Duo page:

    1. Enter a name.

    2. Set the state to Enabled to activate the integration.

    3. Ensure that the Duo Auth API configuration type is selected.

    4. Enter the Integration Key copied from Duo.

    5. Enter the Secret Key copied from Duo.

    6. Enter the Client secret copied from Duo.

    7. Click Add Provider.

Adding an Authentication Profile with Duo as an Authentication Challenge

For more information, see Creating Authentication Profiles.

  1. Navigate to the Authentication profiles page.

  2. Click Add Authentication Profile.

  3. Add a Profile name.

  4. Under Authentication challenges, select Duo Auth API or Duo Universal Prompt and other authentication challenges such as Password, as required.

Enabling the Authentication Profile in an Identity Policy

For more information on identity policies and how to set up, edit, and assign them, see Identity Policies.

  1. Navigate to the Identity policies page.

  2. Select the identity policy that should use Duo.

  3. In the Overview section, if the policy is not Enabled, select Edit, set the state to Enabled, and Save.

  4. Select Authentication.

  5. Next to Services, click Edit.

  6. Select Enable authentication policy controls.

  7. Click Default authentication profile.

  8. From the drop-down menu, select the authentication profile that has Duo configured as an authentication challenge.

  9. Click Save.

For more information see Authentication Profiles.

When using authentication rules in identity policies, these rules may override the default authentication profile. For more information, see the Authentication Rules documentation.

Enrolling Duo Users

You are now ready to invite users to use Duo as an authentication method.

  1. In the Duo Admin Console, navigate to Users.

  2. Select the desired user.

  3. Click Send Enrollment Email. This action will send an email to the user with the necessary enrollment links. Users must complete enrollment with Duo to receive authentication challenges.

When adding a user to Duo, make sure to use the same username and email address they use on the Delinea Platform.

For details on enrolling users, see the Duo documentation, Duo Administration – Enroll Users.

For details on managing users, see the Duo documentation, Duo Administrators – Manage Users.

Duo Policies

To prevent users who have not yet enrolled in Duo from accessing the Delinea Platform, set the New User Policy to Deny Access.

For details, see Duo’s documentation on Users Policy Settings.