Configure Duo as an SSO source for the Command Platform

This article covers how to configure a Command Platform single sign-on (SSO) source for use with Duo.

Create the Command Platform application in Duo

If you haven’t already, you will need to create an application in Duo that will be configured with the Command Platform.

To create a new application in Duo:

1. Navigate to the Duo Admin Portal.
2. Select Applications.
3. Select Protect an Application.
4. Search for Generic Service Provider and select Protect for the option with the Protection Type 2FA with SSO hosted by Duo.

Configure the Command Platform

You can now add the Entity ID and Single Sign-On URL provided by Duo to configure the Command Platform:

1. Under the Metadata section in Duo, click Copy beside the field labeled Entity ID.
2. In the Command Platform, go to Administration > Company Settings > SSO Settings.
3. In the Provide the Required Fields from your IdP section, paste the Entity ID into the Entity ID field.
4. Repeat this step for the Single Sign-On URL.

Now that you are finished with the Metadata section in Duo, move on to the certificate.

Download Duo certificate

In the Downloads section, click Download Certificate.

Add Duo certificate to the Command Platform

After downloading the Duo certificate, log in to the Command Platform.

1. From Command Home, go to Administration > Company Settings > SSO Settings.
2. In the Add your IdP Certificate section, drag and drop your IdP certificate or upload it.

Add Service Provider metadata to Duo

In the Service Provider section of your cloud application in Duo, you now need to enter the Entity ID, ACS URL, and Default Relay State provided by the Command Platform.

To add service provider metadata to Duo:

1. From Command Home, go to Administration > Company Settings > SSO Settings.
2. In the Copy the Following Data into your External IdP section, select Copy beside the Assertion Consumer Service (ACS) URL field.
3. Paste this into the corresponding field in Duo.
4. Repeat this for the Audience (Entity ID) field.
5. Finally, repeat this for the Relay State field.

Configure the SAML response in Duo

To configure the SAML response in Duo:

1. Set the NameID format to emailAddress.
2. Set the NameID attribute to <Email Address>.
3. Select both the Sign response and Sign assertion check boxes.
4. In the Map attributes section, add <Email Address> as an IdP Attribute. Under SAML Response Attribute, enter Email.
5. Add <First Name> as an IdP Attribute. Under SAML Response Attribute, enter FirstName.
6. Add <Last Name> as an IdP Attribute. Under SAML Response Attribute, enter LastName.

This completes the Duo configuration with settings from the Command Platform. Before clicking Save at the bottom of the screen, you can name your Duo Cloud Application.

Set up a default access profile

A default access profile allows you to define the products and roles that are automatically assigned to new users provisioned in Duo. See our default access profile documentation for instructions.

Group Synchronization

Group Synchronization allows you to control user group assignment from within your IdP.

This capability is made possible by including an attribute in your SAML response labelled rbacGroups that contains the name(s) of the Command Platform User Groups for each user. Your users will be automatically assigned to the corresponding groups in the Command Platform and will inherit the product, role, and resource access associated with those groups.

Configure user groups

As Group Synchronization requires the use of Command Platform User Groups, it is important that you have configured groups before activating. Read our Command Platform User Groups documentation for details on how to do this.