DUO SSO in ASP.net MVC

To integrate DUO SSO (Single Sign-On) with a passwordless authentication method into your existing application, you’ll need to follow a few key steps. Duo supports passwordless authentication by enabling users to log in using factors like Duo Push, security keys (e.g., Yubikeys), or biometrics.

Here’s an outline to help you with the integration and where to find relevant resources:

1. Set Up Duo Single Sign-On

Duo Single Sign-On (SSO) acts as an identity provider (IdP) using SAML 2.0 or OIDC (OpenID Connect) standards, which means your existing application should support these authentication protocols.

2. Enable Passwordless Login in Duo

Duo supports passwordless authentication methods by allowing users to log in without entering a password, using:

• Duo Push on mobile devices.
• Security keys, like FIDO2 WebAuthn-compatible devices.
• Biometrics (fingerprint, face ID, etc.).

Steps to enable passwordless login:

• In the Duo Admin Panel, go to Single Sign-On settings.
• Enable Passwordless authentication under the Policies section for your application.
• You can also enforce policies such as allowing only specific users or groups to log in without a password.

3. Integrating Duo SSO with Your Application

a. SAML Integration:

• If your application supports SAML 2.0, you can set up Duo as the Identity Provider (IdP). Duo will authenticate users via SSO, and you can configure the app to allow passwordless methods.
• Duo provides detailed steps for setting up SAML with many service providers in their official SAML documentation.

b. OIDC (OpenID Connect) Integration:

• If your application supports OIDC, Duo supports that protocol too, allowing passwordless logins through OIDC.
• Use Duo’s OIDC documentation for setup steps.

4. Implement Passwordless Authentication

• Once Duo is integrated as your IdP via SAML or OIDC, configure your Duo account to enable passwordless authentication. This involves enabling Duo Push or WebAuthn as the primary login method for users.

Steps:

• Go to the Duo Admin Panel.
• Under Authentication Methods, enable Passwordless authentication.
• Configure policies such as allowing biometric logins, Duo Push, or FIDO2 keys.

5. Duo Web SDK for Custom Integration

If you want to integrate Duo's authentication flow directly into your application UI, you can use the Duo Web SDK. This will allow you to embed Duo's login experience seamlessly.

Duo Web SDK allows:

• Customization of login workflows.
• Support for passwordless authentication methods.
• Handling Duo Push, security keys, etc.

You can find the SDK and integration guide here:

• Duo Web SDK Documentation

6. Testing the Integration

Once you’ve set up Duo for passwordless SSO:

• Test logging into the application using different authentication methods (Duo Push, security keys, biometrics).
• Ensure the workflow meets your requirements for a seamless passwordless experience.

Resources and References:

• Duo Passwordless Documentation
• Duo Single Sign-On (SSO) Documentation
• Duo Web SDK Documentation
• Duo Passwordless and SSO FAQ

Following these steps and references should help you integrate DUO SSO in a passwordless manner for your application. Let me know if you need help with any specific part of the integration!

Hi Ramya,

To integrate Duo SSO with passwordless authentication into your ASP.NET MVC application, follow these steps:
    1. Set Up Duo Single Sign-On (SSO)
        https://duo.com/docs/sso#saml
    2. Configure ASP.NET MVC Application for SAML Authentication
        https://medium.com/@darshana-edirisinghe/authentication-and-authorization-through-saml-net-mvc-987fb1fb4fbd
    3. Enable WebAuthn for Passwordless in Duo
        In the Duo Admin Panel, enable WebAuthn (passwordless) for your users. This allows them to use biometric factors (fingerprint, facial recognition) or hardware keys for passwordless login.

Thank you.