Introduction
LogonBox supports user authentication using the service from Duo Security. This method of authentication works along with an app on a mobile phone to provide multi-factor authentication.
This article explains how to configure your LogonBox to use this method.
IMPORTANT: This article is valid for any LogonBox product versioned 2.3.8 or greater.
1. Configuring the Authentication Scheme
It is important to note that you can apply different authentication flows for different types of logon: User Logon, Password Reset, Client, Account Unlock, SSO, Windows Login, Password Vault and Admin Logon.
Each of these can have their own default authentication flow configured, but for this article we shall alter Password Reset.
Navigate to Authentication Flows->Schemes->Password Reset and click the Edit button. Note that by default this is configured with a blue Username module and a green User Selective 2FA one.
Duo is a green module, so it must exist along with either a blue or orange module, which we already have here.
Let’s keep the existing Username module and replace the Security Questions module. Click the delete icon on User Selective 2FA and add the Duo module by clicking the plus icon next to Duo to add it into the authentication flow.
Click Save at the bottom.
2. Creating a Duo Security account
You must now configure LogonBox to allow it to connect to Duo Security to check the authentication. Navigate to Authentication Flows->Authentication Options and select the Duo Tab.
You will need a Client ID, a Client Secret and an API Hostname, which you can get from Duo.
On this screen, click on the provided link to visit the Duo Security signup page.
Enter all of the information you are prompted for and click Create My Account.
Create a password and click Continue.
At this point, go to the App Store for your phone, find and install the Duo Mobile app, then launch it.
Click the Add Account button and accept any permissions the app may ask for.
The app should have now activated the camera, point the camera at the Duo account creation web page, which should have a QR code visible.
The account should be configured and you can click Continue on the web page to proceed.
Finally, set a backup number and click Finish.
Now, as you have the app open, click Duo Push which will cause your app to prompt for authorisation.
Click on Approve to log in.
3. Setting up the Duo application and completing configuration
After authorising in the last step above, you should now be logged on to the Duo Security web site. We now need to configure LogonBox as an application in Duo.
If you are not at this page already, navigate to Applications->Protect an Application and search for Web SDK.
Click Protect.
You can choose to use the default new Universal Prompt here, although we can work with Duo's old traditional prompt too.
You are shown the 3 items of information you need to configure your LogonBox at the top of this screen, the Client ID, a Client Secret and an API Hostname.
Make a note of these and click Save.
4. Disable Enrolment
The default configuration of Duo is to allow inline enrolment in the Duo service. However, for Password Reset this is a security risk and therefore you may wish to disable this.
We recommend that you set up the Global Policy to deny enrolment. To do this on the Duo web site, navigate to Policies and edit the Global Policy and change the New User policy from Require Enrollment to Deny Access.
Now go back to your LogonBox and edit the Duo settings in Authentication Flow->Authentication Options->Duo. Enter these above values in the relevant places and click Apply.
5. Supporting Enrolment (optional)
If you want to support enrolment of users whilst users are using LogonBox then you can do so. To do this, repeat the process to setup a new application to obtain a second set of Duo API keys. With this configuration you can add an application policy to allow enrolment.
Once you have setup the second Duo application integration. Goto Authentication Flows->Authentication Options and the Duo tab.
Toggle the Enable Enrolment switch to ON and you will see another set of API key fields made available where you can configure the second application integration. When enabled, LogonBox will use these keys on user login authentication schemes to support enrolment. For self-service schemes the first set of configuration items are used.