MFA Provider

Duo Security can now be used for external multi-factor authentication. This enables you to configure external MFA using Duo Security without the need to configure it as an external IdP.

Page Overview

You can access this feature by navigating to Settings > ZTNA > Configurations > MFA Provider.

1. New MFA Provider: Create a new integration with a third-party MFA Provider
2. Status: A toggle to enable/disable an existing integration
3. Name: Name of an existing integration
4. Vendor Name: Name of the third-party MFA provider. Only Duo is able to be integrated for now
5. +: Expand/shrink button to show/hide the details of an existing integration. The details of an existing integration can be seen as follows:

Configuring Duo as MFA Provider

Setup WebSDK App in Duo

1. Navigate to the Duo Admin Console

2. Navigate to Applications -> Protect an Application -> WebSDK -> Protect

3. You'll need this information moving forward, keep this page open

Setup Duo Integration in Admin Portal

1. Create vaulted generic secret for Duo Client secret (Duo SKEY)

2. The value for secret on vault is the SKEY

3. Navigate to Settings > ZTNA > Configurations > MFA Provider. Click New MFA Provider

4. Provide the integration a name, and copy/paste the values from the Duo Admin Console to the fields in admin portal

   • Integration Key = Client ID
   • Private Key = Client Secret
   • API Hostname = API Hostname

5. Click Save

6. Test integration to verify connectivity to Duo

Using Duo as External MFA on Integrated IdP

1. Navigate to Settings > ZTNA > Configurations > Identity Providers
2. Edit an integrated IdP
3. Choose your Duo integration for MFA Mode
4. Click Save