Setting Up SSO with DUO

Topics included in this article:

• Overview
• Single Sign-On with DUO
  • Recovery Users
• Setup
  • DUO Setup
  • Rhombus Console Setup
  • Final Product
• Helpful Links
• Contact Support or Sales

Overview

Single Sign-On is a way to sync sign-on across multiple applications, allowing you to log in to all applications with one user account and password.

Rhombus supports any SAML SSO (single sign-on) identity providers. This article covers how to configure SSO with DUO.

Single Sign-On with DUO

Note: If you get stuck at any point, contact Duo Support. 

Recovery Users

A Recovery User is a user account in your organization that bypasses SAML once enabled.

Note: We recommend having at least two Super User Accounts as Recovery Users when enabling SSO to ensure you have a method of logging in and disabling SSO in the event SAML encounters errors.

Enabling a user account as a Recovery User is performed during the SSO configuration process in the Rhombus Console.

1. Log into the Rhombus Console, navigate to "Settings," and click "Single Sign-On."

2. Click the dropdown for "Single Sign-On" and select any of the options you wish to include.

• Select specific users as "Recovery Users." We recommend selecting at least two.
• Choose to enable Single Sign-On for the Rhombus Console and/or the Rhombus Key app.
• Enable Just-In-Time User Creation if desired. Just-In-Time User Creation can be enabled to dynamically create a Rhombus user account matching the SSO login email the first time that user logs into the console.

3. Click the dropdown menu that reads "Select SSO Recovery Users." Click the checkbox beside the users you wish to set as Recovery Users, and click "Save."

Setup

DUO Setup

1. Log in to DUO and navigate to the "Single Sign-On" tab. Set up an Identity Provider (IdP) and complete the instructions outlined in the DUO SSO article.

Note: DUO offers documentation for various configurations. 

• DUO SAML IdP 
• Active Directory

2. Next, create a Generic SAML application on DUO. Navigate to the "Applications" tab on the left side of the DUO admin panel.

3. Click the "Protect an Application" button in the upper right. 

4. In the search bar, type "Generic Service Provider," and click "Protect," with the "Protection Type" labeled as "2FA with SSO hosted by DUO."

5. Scroll down to "Settings," and in the "Name" field, enter "Rhombus Systems."

6. In the "Service Provider" heading, enter the "Entity ID" and "ACS URL" credentials (from Rhombus SSO). 

In the "SAML Response" heading, select the correct "NameID Format" noted below with the "NameID attribute" specified as "<Email Address>," and then check the box labeled "Sign assertion" in the "Signing options" field. 

Note: To enter the "ACS URL" entry within DUO, you need to click under the "URL" column header as the entry field is hidden.

7. Within the "SAML Response" heading, ensure the "Signature algorithm" is set to "SHA256."

8. Within the "SAML Response" heading, fill out the "Map attributes" section as shown below.

9. Scroll to the bottom of the page, and click "Save."

10. Scroll to the top of the page, and click "Download XML" in the "Downloads" section.

11. Open the downloaded file, which should be named "Rhombus Systems - IDP Metadata.xml" in a text editor of your choosing.

Suggested text editors based on different operating systems:

• Mac: TextEdit
• Windows: Notepad
• Linux: Vim

Mac example:

Rhombus Console Setup

1. Log in to the Rhombus Console, navigate to "Settings," and click "Single Sign-On."

2. Under the Single Sign-On dropdown menu, enter your team name and click the toggle beside "Use Single Sign-On for Rhombus Console." Enable "Just-In-Time User Creation."

3. Copy the contents of the xml file and paste it inside the "IDP MetaData XML" text box on the Rhombus SSO page within the Rhombus Console.

4. Click "Save" in the upper-right. 

Final Product

Note: DUO does not have an optional setup to omit Microsoft login as of now, but are currently working on this feature.

Helpful Links

• Role Creation and Management
• Manage Users
• Generic SAML application
• Duo SAML IdP 
• Active Directory

Contact Support or Sales

Have more questions? Contact Rhombus Support at +1 (877) 746-6797 option 2 or support@rhombus.com.

Interested in learning more? Contact Rhombus Sales at +1 (877) 746-6797 option 1 or sales@rhombus.com.