The SHA-256 fingerprint of the SAML certificate. Sometimes service providers will request a fingerprint instead of uploading a SAML certificate. The SHA-1 fingerprint of the SAML certificate. This URL can be used by service providers to download the XML metadata from Duo Single Sign-On. This is sometimes referred to as 'SLO URL' or 'Logout Endpoint'. This URL can also be used to start IdP-initiated authentications. This is sometimes referred to as 'SSO URL' or 'Login URL'.

The authentication URL for Duo Single Sign-On. This is sometimes referred to as 'Issuer'. The global, unique name for Duo Single Sign-On. The Metadata section is where you can get SAML identity provider information about Duo Single Sign-On to provide to your service provider. You'll need the information on the Generic SAML Service Provider page under Metadata later. See Protecting Applications for more information about protecting applications in Duo and additional application options. Click Protect to the far-right to start configuring Generic SAML Service Provider. Log on to the Duo Admin Panel and navigate to Applications.Ĭlick Protect an Application and locate the entry for Generic SAML Service Provider with a protection type of '2FA with SSO hosted by Duo (Single Sign-On)' in the applications list. You can also create custom bridge attributes. These bridge attributes are required and cannot be edited. Active Directory will work with no additional setup, but if you used a SAML idenity provider as your authentication source please verify that you configured it to send the correct SAML attributes.īelow you can see the five (5) default bridge attributes that automatically map certain attributes from your authentication source. When configuring an application to be protected with Duo Single Sign-On you'll need to send attributes from Duo Single Sign-On to the application.

If you want to protect a cloud service that we don't have listed by name, you can use our Generic SAML Service Provider application. These applications have 'Single Sign-On (hosted by Duo)' next to their name.

We've already added a number of popular SaaS applications to Duo pre-configured for use with Duo Single Sign-On. Once you have your SSO authentication source working, continue to the next step of creating the SP application in Duo. Configure Single Sign-Onīefore configuring your service provider application you'll first need to enable Duo Single Sign-On for your Duo account and configure a working authentication source. Duo checks the user, device, and network against an application's policy before allowing access to the application. For example, you can require that users of one application complete two-factor authentication at every login, but only once every seven days when accessing a different application. Duo Single Sign-On acts as an identity provider (IdP), authenticating your users using existing on-premises Active Directory (AD) or any SAML 2.0 IdP and prompting for two-factor authentication before permitting access to your service provider application.ĭuo Single Sign-On is available in Duo Premier, Duo Advantage, and Duo Essentials plans, which also include the ability to define policies that enforce unique controls for each individual SSO application. About Duo Single Sign-Onĭuo Single Sign-On is our cloud-hosted SSO product which layers Duo's strong authentication and flexible policy engine on top of an application's login using the Security Assertion Markup Language (SAML) 2.0 or OpenID Connect (OIDC) authentication standards. Our cloud-hosted SSO identity provider offers inline user enrollment, self-service device management, and support for a variety of authentication methods - such as passkeys and security keys, Duo Push, or Verified Duo Push - in the Universal Prompt.

Add two-factor authentication and flexible security policies to any SAML application with Duo Single-Sign On.

Duo mobile admin portal