Cbox ID
Duo
Duo
Single sign-on (SAML 2.0)
In the portal, choose Duo under Enterprise SSO and Start with Duo. Then, in Duo:
- In the Duo Admin Panel, go to Applications → Application Catalog, find Generic SAML Service Provider (SSO), and click Add.
- Under User access, choose the groups who may sign in.
- In Service Provider, enter the Entity ID and Assertion Consumer Service (ACS) URL below — or choose Metadata XML URL under Metadata Discovery, enter ours and click Populate.
- In SAML Response, set NameID attribute to <Email Address>.
- Save, then copy the Metadata URL from the Metadata section.
The values the portal shows
| Duo field | Value |
|---|---|
| Metadata XML URL (Service Provider → Metadata Discovery), optional | The portal's SP metadata URL (https://…/sso/saml/…/metadata) |
| Entity ID (Service Provider) | The portal's entity ID (https://…/sso/saml/…) |
| Assertion Consumer Service (ACS) URL (Service Provider) | The portal's ACS URL (https://…/sso/saml/…/acs) |
| Single Logout URL (Service Provider), optional | The portal's Single Logout URL (https://…/sso/saml/…/slo) |
| Service Provider Login URL (Service Provider), optional | The portal's sign-in URL (https://…/sso/saml/…/login) |
| NameID attribute (SAML Response) | <Email Address> |
What to bring back
Copy Metadata URL — the URL, or the XML — and paste it into the portal's Metadata URL or XML. Prefer the URL.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
Duo's own guide: https://duo.com/docs/sso-generic.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Directory Sync (SCIM)
In the portal, choose Duo under Directory sync and Create directory; copy the bearer token now, it is shown once. Then, in Duo:
- Open the application under Applications → Applications and select the Provisioning tab.
- Under Authentication, choose Bearer Token and enter the Base URL and Token below.
- Click Connect to application and wait for it to succeed.
- Review the attribute mappings and choose the groups to provision.
- Click Save and enable.
The values the portal shows
| Duo field | Value |
|---|---|
| Authentication (Provisioning) | Bearer Token |
| Base URL (Provisioning) | The portal's SCIM base URL (https://…/scim/v2) |
| Token (Provisioning) | The bearer token the portal shows once |
Duo's own guide: https://duo.com/docs/automated-provisioning.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.
- Directory Sync — the portal's SCIM setup.