Duo Single Sign-On

Overview

Duo Single Sign-On is a cloud-hosted identity provider from Cisco. It can authenticate Pomerium users through OpenID Connect. This provider role is different from the Duo OIDC Auth API that applications use for an MFA transaction.

Using Duo Single Sign-On as the identity provider gives protected applications one sign-in path. Each application does not need to implement the same external authentication flow. Pomerium can apply route policy from the authenticated identity and request context.

Duo Single Sign-On sends authenticated identity data toward Pomerium. Pomerium uses that data with route policy. Pomerium then sends only approved application traffic toward the protected service.

How it works

Create an OAuth 2.0 or OpenID Connect application in Duo Single Sign-On. Configure the Duo issuer and discovery endpoint, client credentials, scopes, and the exact Pomerium callback URL.

Configure Pomerium with the exact issuer or provider URL, client ID, and client secret. Use the Pomerium callback URL as an exact redirect URI. Request only the scopes and claims that access policy needs.

Test discovery, signing-key rotation, the authorization code flow, logout, and required claim mappings before production use. Keep provider credentials outside source control.

Example

A team registers Pomerium as an OpenID Connect client in Duo Single Sign-On. Users sign in through Duo Single Sign-On. Pomerium validates the identity response and applies route policy before it sends an approved request to a private application.

Considerations

• Duo Single Sign-On needs Duo Directory, Active Directory through an Authentication Proxy, or an upstream SAML identity provider.
• Do not use Duo MFA API documentation as the OpenID Connect provider configuration for Pomerium.
• Duo Single Sign-On remains responsible for authentication, user lifecycle, and the identity data that it issues.
• A standards-based OpenID Connect pattern is not evidence of a vendor-specific connector or partnership.