Duo Security

https://help.duo.com/s/
Admin
Duo Security is a cloud-based access security platform that provides multi-factor authentication,...
Tokens:149,947
Snippets:2,623
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### Install latest version

Source: https://help.duo.com/s/article/9546?language=en_US

Execute the setup script to finalize the installation of the updated files.

```bash
python3 setup.py install 
```

--------------------------------

### AMR and ACR in SAML Assertion

Source: https://help.duo.com/s/article/amr-acr-guide?language=en_US

Example of SAML AuthnContextClassRef and AttributeStatement containing AMR values after authentication.

```xml
<saml:AuthnStatement AuthnInstant="2024-07-01T12:00:00Z">
  <saml:AuthnContext>
   ** <saml:AuthnContextClassRef>
      urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    </saml:AuthnContextClassRef>**
  </saml:AuthnContext>
</saml:AuthnStatement>

<saml:AttributeStatement>
 ** <saml:Attribute Name="amr"
    NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml:AttributeValue>mfa</saml:AttributeValue>
    <saml:AttributeValue>pop</saml:AttributeValue>
    <saml:AttributeValue>user</saml:AttributeValue>
    <saml:AttributeValue>pwd</saml:AttributeValue>**
  </saml:Attribute>
</saml:AttributeStatement>
```

--------------------------------

### Navigate to Duo Log Sync directory

Source: https://help.duo.com/s/article/9546?language=en_US

Change the current working directory to the folder containing the Duo Log Sync installation.

```bash
cd duo_log_sync 
```

--------------------------------

### AMR and ACR in OIDC ID Token

Source: https://help.duo.com/s/article/amr-acr-guide?language=en_US

Example of an ID token containing AMR and ACR claims after authentication with password and Verified Duo Push.

```json
{
  "iss": "https://sso-XXXXXXXX.duosecurity.com",
  "sub": "jsmith@example.com",
  "aud": "DIXXXXXXXXXXXXXXXXXX",
  "iat": 1719874800,
  "exp": 1719878400,
  "auth_time": 1719874800,
  "preferred_username": "jsmith@example.com",
  **"amr": ["mfa", "pop", "user", "pwd"],
  "acr": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"**
}
```

--------------------------------

### AMR and ACR in OIDC ID Token

Source: https://help.duo.com/s/article/amr-acr-guide?nocache=https%3A%2F%2Fhelp.duo.com%2Fs%2Farticle%2Famr-acr-guide%3Flanguage%3Den_US

Example of an ID token structure containing AMR and ACR claims following authentication with password and Verified Duo Push.

```json
{
  "iss": "https://sso-XXXXXXXX.duosecurity.com",",
  "sub": "jsmith@example.com",
  "aud": "DIXXXXXXXXXXXXXXXXXX",
  "iat": 1719874800,
  "exp": 1719878400,
  "auth_time": 1719874800,
  "preferred_username": "jsmith@example.com",
  **"amr": ["mfa", "pop", "user", "pwd"],
  "acr": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"**
}
```

--------------------------------

### AMR in 2FA-Only OIDC ID Token

Source: https://help.duo.com/s/article/amr-acr-guide?language=en_US

Example of an ID token returned by the OIDC Auth API or WebSDK v4 containing the AMR claim for 2FA-only contexts.

```json
{
  "iss": "https://api-XXXXXXXX.duosecurity.com/oauth/v1/token",
  "sub": "jsmith",
  "aud": "DIXXXXXXXXXXXXXXXXXX",
  "iat": 1719874800,
  "exp": 1719878400,
  "auth_time": 1719874800,
  "auth_result": "allow",
  "preferred_username": "jsmith",
  **"amr": ["mfa", "pop", "user"]**,
  "auth_context": {
    "factor": "Duo Push",
    "result": "success",
    "reason": "user_approved",
    "device": "Android (+1 XXX-XXX-1234)"
  }
}
```

--------------------------------

### AMR in 2FA-Only OIDC ID Token

Source: https://help.duo.com/s/article/amr-acr-guide?nocache=https%3A%2F%2Fhelp.duo.com%2Fs%2Farticle%2Famr-acr-guide%3Flanguage%3Den_US

Example of an ID token returned by the OIDC Auth API or WebSDK v4 after successful 2FA, including the AMR claim.

```json
{
  "iss": "https://api-XXXXXXXX.duosecurity.com/oauth/v1/token",",
  "sub": "jsmith",
  "aud": "DIXXXXXXXXXXXXXXXXXX",
  "iat": 1719874800,
  "exp": 1719878400,
  "auth_time": 1719874800,
  "auth_result": "allow",
  "preferred_username": "jsmith",
  **"amr": ["mfa", "pop", "user"]**,
  "auth_context": {
    "factor": "Duo Push",
    "result": "success",
    "reason": "user_approved",
    "device": "Android (+1 XXX-XXX-1234)"
  }
}
```

--------------------------------

### Authentication Proxy log error example

Source: https://help.duo.com/s/article/6999

Example log output showing the 'invalidCredentials' and 'Cannot find username' errors during an LDAP bind request.

```text
LDAPMessage(id=10, value=LDAPBindRequest(version=3, dn='', auth='****', sasl=True), controls=None)
2021-06-01T15:44:54.380415+0800 [_ADServiceClientProtocol,client] C<-S LDAPMessage(id=10, value=LDAPBindResponse(resultCode=49, errorMessage='8009030C: LdapErr: DSID-0C090516, comment: AcceptSecurityContext error, data 52e, v3839\x00'), controls=None)
**2021-06-01T15:44:54.381181+0800 [duoauthproxy.lib.log#info] Username lookup failed: 'invalidCredentials: 8009030C: LdapErr: DSID-0C090516, comment: AcceptSecurityContext error, data 52e, v3839\x00'**
**2021-06-01T15:44:54.381452+0800 [duoauthproxy.lib.log#info] [Request from xx.x.xx.xxx:19565] Cannot find username**
2021-06-01T15:44:54.381659+0800 [_ADServiceClientProtocol,client] S->C LDAPMessage(id=1, value=LDAPBindResponse(resultCode=49, errorMessage='Cannot find username'), controls=None)
```

--------------------------------

### Duo Authentication Proxy Multi-Application Configuration

Source: https://help.duo.com/s/article/1124

Example configuration file demonstrating how to define multiple server sections for different applications using shared or distinct client configurations.

```ini
[ad_client]
host=_1.2.3.4_  ; IP address of the Active Directory domain controller
host_2=_1.2.3.5_ ; IP address of the backup Active Directory domain controller
service_account_username=_duoservice_
service_account_password=_password1_
search_dn=DC=_example_,DC=_com_
security_group_dn=CN=_DuoVPNUsers_,OU=_Groups_,DC=_example_,DC=_com_
transport=starttls
ssl_ca_certs_file=_conf\example_com_ca.pem_

[radius_client]
host=_5.6.7.8_  ; IP address of the RADIUS server
secret=_thisisaradiussecret_

; Application X
[radius_server_auto]
ikey=_DIXXXXXXXXXXXXXXXXXX_
skey=_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX_
api_host=api-_hostname_.duosecurity.com
failmode=safe
radius_ip_1=_2.3.4.5_  ; IP address of the appliance 1 for Application X
radius_ip_2=_2.3.4.6  _; IP address of the appliance 2 for Application X
radius_secret_1=_thisisalsoaradiussecret  _; RADIUS secret of the appliance 1 for Application X
radius_secret_2=_thisisalsoaradiussecret2  _; RADIUS secret of the appliance 2 for Application X
client=ad_client

; Application Y
[radius_server_auto2]
ikey=_DIYYYYYYYYYYYYYYYY_
skey=_YYYYYYYYYYYYYYYYYYYYYYYYYYYYYY_
api_host=api-_hostname_.duosecurity.com
failmode=safe
radius_ip_1=_4.5.6.7_  ; IP address of the appliance
radius_secret_1=_thisisalsoanotherradiussecret_
port=18120
client=radius_client

; Application Z
[ldap_server_auto]
ikey=_DIZZZZZZZZZZZZZZZZZZZ_
skey=_ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ_
api_host=api-_hostname_.duosecurity.com
factors=auto
client=ad_client
failmode=secure
port=636
ssl_key_path=_server_.key  
ssl_cert_path=_server_.crt
exempt_primary_bind=false
exempt_ou_1=CN=_ldapuser_,OU=_Service Accounts_,DC=_domain_,DC=_local

_; Application A 
[ldap_server_auto2]
ikey=_DIZZZZZZZZZZZZZZZZZZZ_
skey=_ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ_
api_host=api-_hostname_.duosecurity.com
factors=auto
client=ad_client
failmode=secure
exempt_primary_bind=false
exempt_ou_1=CN=_ldapuser_,OU=_Service Accounts_,DC=_domain_,DC=_local_
```

--------------------------------

### Configure Fedora/RHEL/CentOS GUI Login

Source: https://help.duo.com/s/article/4263

Modifications for /etc/pam.d/password-auth to integrate pam_duo for GUI authentication.

```text
#%PAM-1.0
auth        required      pam_env.so
auth        required      pam_faildelay.so delay=2000000
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        required      pam_deny.so
```

```text
%PAM-1.0
auth  required pam_env.so
auth  requisite pam_unix.so nullok try_first_pass
auth  sufficient pam_duo.so
auth  requisite pam_succeed_if.so uid >= 1000 quiet_success
auth  required pam_deny.so
```

--------------------------------

### Check Duo Authentication for macOS version via Terminal

Source: https://help.duo.com/s/article/8251?language=en_US

Run this command in the Terminal to list installation history entries for the MacLogon component. The most recent entry represents the currently installed version.

```bash
System_profiler SPInstallHistoryDataType | grep MacLogon -A3
```

--------------------------------

### Retrieve Subaccounts Response

Source: https://help.duo.com/s/article/8521?language=en_US

Example response from the /accounts/v1/account/list endpoint showing the required api_hostname for subaccount requests.

```json
{
  "stat": "OK",
  "response": [
    {
      "account_id": "DA9VZOC5X63I2W72NRP9",
      "api_hostname": "api-abcd1234.duosecurity.com",
      "name": "Acme Corp"
    }
  ]
}
```
Tokens:
Raw