Tutorial: Configure Access Server SAML Authentication with DUO MFA and your IdP
Overview
Access Server supports authentication using SAML as an authentication method. This document explains how to set up DUO as a proxy between your Access Server, serving as your service provider (SP), and your identity provider (IdP) — we use JumpCloud as our example IdP here. This gives you the added security of DUO's multi-factor authentication (MFA).
You configure the following pieces:
An IdP of your preference.
An IdP SAML app.
A DUO SAML IdP.
A DUO SAML app.
Access Server as the SP.
The following steps walk you through how to enable SAML authentication for users and groups using DUO as a proxy and some steps from your preferred IdP.
You need the following to get started:
An identity provider with your user directory. (We use JumpCloud for our example here.)
A Duo Admin account with the Owner role to enable the feature.
A deployed Access Server.
Start by creating a custom SAML application with your IdP:
Sign in to your JumpCloud admin portal.
Under User Authentication, click SSO.
Click + Add New Application to add a new SSO app.
Click Custom SAML App.
Provide a Display Label and optional application information and click the SSO tab.
Pause at this point in your SAML application creation in JumpCloud. Now we configure the DUO single sign-on (SSO) setup.
Configure DUO SSO with JumpCloud:
Sign in to your DUO admin portal.
Click Single Sign-On.
Check the box to agree to the terms, and then click Activate and Start Setup.
Under Customize your SSO subdomain page, create a subdomain your users see when signing in with Duo Single Sign-On. For our example, we use as-openvpn-duo, and our users see as-openvpn-duo.login.duosecurity.com.
Under Add Authentication Source page, click Add SAML Identity Provider.
On the Single Sign-On Configuration page, copy the "Entity ID" and "Assertion Consumer Service URL."
Now, let's go back to our SSO tab of the new JumpCloud SAML App and enter the following into the JumpCloud app:
IdP Entity ID: Enter the JumpCloud URL, https://console.jumpcloud.com.
SP Entity ID: Enter the Entity ID from the DUO Single Sign-On Configuration page.
ACS URL: Enter the Assertion Consumer Service URL from the DUO Single Sign-On Configuration page.
SAMLSubject NameID: Select email.
SAMLSubject NameID Format: Select urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified.
Signature Algorithm: Select RSA-SHA256.
Default RelayState: Enter ‘cws’ for the Client Web UI or ‘profile’ to provide users with a downloadable profile. (For more details, refer to “How to set up IdP-initiated flow” below.)
Check the box for Declare Redirect Endpoint.
Enter an IDP URL. (We use https://sso.jumpcloud.com/saml2/saml2, but you may need to change it if you have another SAML integration using that URL.)
Under Attributes, click Add attribute.
Under Service Provider Attribute Name, type "Email".
Under Jumpcloud Attribute Name, select email from the dropdown.
Before clicking activate, click the User Groups tab and assign user groups to the SSO app.
Click activate.
Still in the JumpCloud dashboard, download the IDP certificate:
From the notification, "Public Certificate has been created," click Download Certificate.
If you no longer have the notification:
Click SSO and click on your new app.
Under Single sign-on on the side, click IDP Certificate Valid.
Click Download certificate.
Now, return to the DUO Single Sign-On Configuration page, scroll down to Configure Duo Single Sign-On, and enter the following information:
Display Name: Enter the name you want for your Single Sign-On Configuration.
Entity ID: Enter the JumpCloud URL, https://console.jumpcloud.com.
Single Sign-On URL: Enter https://sso.jumpcloud.com/saml2/saml2.
Certificate: Upload the IDP Certificate you downloaded from the JumpCloud SAML App.
Click Save.
Now that you've configured JumpCloud's SAML app and JumpCloud as the SAML IdP on DUO, you can create DUO's custom SAML application.
First, gather information about your Access Server as the service provider (SP).
Sign in to your Access Server Admin Web UI.
Select Authentication → SAML.
You'll need the following information:
SP Identity.
SP ACS.
Now that you have your SP information, you can create a new DUO SAML app and enter that information during app creation:
Sign in to your DUO admin portal.
Click Applications.
Click Protect an Application.
In the search bar, type "generic," find "Generic SAML Service Provider," and click Protect.
Under the Service Provider section, enter your Access Server information:
Entity ID: Enter the Access Server SP Identity.
Assertion Consumer Service (ACS) URL: Enter the Access Server SP ACS.
Scroll down to the very bottom and click Save.
Option 1: Download the DUO metadata file for automatic configuration
With your new app, click the Applications tab.
Under All applications, select your DUO SAML App.
Under Downloads, click Download XML.
Option 2: Copy the DUO SAML data for manual configuration:
With your new app, click the Applications tab.
Under All applications, select your DUO SAML App.
Copy the content in Entity ID, Single Sign-On URL, and under Downloads, click Download certificate to download the certificate in PEM format.
The simplest way to set up DUO SAML for Access Server is by providing the metadata XML file (option 1), but you can also manually configure it (option 2).
Option 1: Upload the DUO metadata file in the Admin Web UI
Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:
Sign in to the Admin Web UI.
Select Authentication.
Select the SAML tab.
Set Enable SAML authentication to Enabled.
Under Configure Identity Provider (IdP), Select Configure using metadata URL/file.
The Configure using metadata modal displays.
Click Click to upload to select your XML file or drag and drop it into the modal window.
The Identity Provider data populates the corresponding fields.
Select Save and Restart.
Option 2: Manually configure DUO SAML
Sign in to the Admin Web UI.
Select Authentication.
Select the SAML tab.
Set Enable SAML authentication to Enabled.
Under Configure Identity Provider (IdP), manually enter the DUO configuration data into the appropriate fields:
Paste the DUO Entity ID into Access Server’s IdP Entity ID.
Paste the DUO Single Sign-On URL into Access Server’s SSO (Single Sign-On) Endpoint.
Paste the DUO XXXXX.crt into Access Server’s Certificate (PEM format).
Select Save and Restart.
You can now enable SAML as the global default authentication or for specific groups and users.
Now that you're all set up, here's the process when a user signs in:
The user enters the URL for Access Server's Client Web UI.
On the sign-in page, they click Sign In with SAML.
They enter their JumpCloud credentials.
DUO verifies the user with a push notification.
The user completes the MFA with the DUO mobile app.
The user successfully signs in and can download profiles or bundled Connect apps.