Secure Mobile Access 12.4 Administration Guide

Download PDF
Technical Documentation > Secure Mobile Access 12.4 Administration Guide > Appendix > Configuring External SAML Identity Providers > Configuring SAML Authentication Servers > Integrating SMA with Duo SSO Server using SAML

Integrating SMA with Duo SSO Server using SAML

This section explains the procedure to configure Duo SSO Server (cloud) as Authentication server for SMA1000 using SAML Protocol.

  1. On Duo admin portal, select Applications > Protect an Application.

  2. On the search filter under Protect an Application, search for Generic Service Provider and select the application with protection type as 2FA with SSO hosted by Duo (Single Sign-On).

  3. Under Downloads, click the Download XML button to download Duo metadata file.

  4. On SMA AMC page, create a SAML Authentication server under Authentication servers > New > SAML 2.0 Identity Provider > Continue.

    1. In the Name field, type a friendly name. For example, Duo SSO Server.

    2. In the Appliance ID option provide an appliance URL. For example, https://sma.company.com/. (This can be of any value, but an URL is recommended).

    3. Clear the Sign AuthnRequest message using this certificate option.

    4. For Endpoint FQDN option, select a Workplace site FQDN from drop-down menu.

      This will act as the endpoint for all communications with Duo SSO server. (This is not necessarily be same as Appliance ID value).

      The value for Assertion Consumer Service (ACS) URL is formed automatically based on Endpoint FQDN value.

  5. Under Identity Provider Configuration section, under Metadata XML file option, click browse and select the Duo metadata file downloaded earlier.

    1. Click Import to upload the metadata.

    2. Options Server ID, Authentication service URL and Trust the following certificate should be automatically filled based on uploaded file.

    3. Clear Logout service URL textbox if needed.

    4. Click Save button and assign this authentication server to any realm.

  6. On Duo admin portal, under Service Provider section, for Entity ID option, use the Appliance ID value from SMA configuration. For example https://sma.company.com/.

  7. For Assertion Consumer Service (ACS) URL, use the Assertion Consumer Service (ACS) URL value from SMA configuration. Example: https://workplace.company.com/saml2ssoconsumer.

  8. Leave all the other options at their default values.

  9. Under SAML Response section, select the NameID format as emailAddress.

  10. Under SAML Response section, select the NameID format as emailAddress.

  11. Select the NameID attribute as Email Address.

  12. Select the Signature algorithm as SHA256.

  13. For Signing options, select both Sign response and Sign assertion checkboxes.

  14. Leave other options at their default values.

  15. Click Save Configuration button to save the configuration.

  16. On the same page, under Policy and Settings section, change the values as needed.

  17. Click Save.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden