> For the complete documentation index, see [llms.txt](https://support.goodaccess.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.goodaccess.com/configuration-guides/features/sso-scim/cisco-duo.md).

# Cisco Duo

{% hint style="info" %}
This feature is available in the **Premium plan and higher**.
{% endhint %}

{% hint style="danger" %}
**Remember to grant your users access permissions to GoodAccess. Users without them won't be able to log in.**
{% endhint %}

## Prerequisites

* Enabled [**Duo Single Sign-On**](https://duo.com/docs/sso#enable-duo-single-sign-on)
* Configured [**Authentication Source**](https://duo.com/docs/sso#configure-your-authentication-source)

## Step 1 - Adding a new identity provider

[Log in to the GoodAccess **Control Panel**, and go to **Settings** > **SSO & Identity**.](https://app.goodaccess.com/sso-and-identity/)

Click **+ Add provider**, enter the **Provider name**, choose your **Identity Provider**, and click **Continue**.

## Step 2 - Setting up Single Sign-On with SAML

Log in to the [Duo Admin Panel](https://admin.duosecurity.com/), and go to **Applications** > **Protect an Application**.

Search for **Generic SAML Service Provider**, and click **Protect**.

<figure><img src="/files/uhQa8qJb8HEThsjjAqIO" alt="Duo Admin Panel with key steps to protecting a new application."><figcaption><p>Protecting a new application</p></figcaption></figure>

### 1. Metadata

Click **Download certificate**, and open the file in a text editor (e.g. Notepad).

Copy the details to GoodAccess - **(3) Identity Provider links**.

* **Sign in URL** - Single Sign-On URL
* **Entity ID** - Entity ID
* **X509** **signing certificate** - Copy the certificate from the text editor

<figure><img src="/files/yXnsg3PochRQacjd0Jrh" alt="Duo Admin Panel with key steps to setting up the Identity Provider details."><figcaption><p>Setting up the Identity Provider details</p></figcaption></figure>

### 2. Service Provider

Copy the details from GoodAccess - **(2) GoodAccess links**.

* **Metadata Discovery** - None (manual input)
* **Entity ID** - Entity ID
* **ACS URL** - Assertion Consumer Service URL
* **Service Provider Login URL** - Login URL
* **Default Relay State** - Relay State

<figure><img src="/files/Fpyr7FuqFmslypZFIvA7" alt="Duo Admin Panel with key steps to setting up the Service Provider details."><figcaption><p>Setting up the Service Provider details</p></figcaption></figure>

### 3. SAML Response

* **NameID format** - urn:oasis:names:tc:**SAML:2.0**:nameid-format:**persistent**
* **NameID attribute** - \<Email Address>
* **Signature algorithm** - SHA256
* **Signing options** - Sign response

#### Map atttibutes

| IdP Attribute    | SAML Response Attribute |
| ---------------- | ----------------------- |
| \<Email Address> | email                   |
| \<Username>      | name                    |

Scroll down to the bottom of the page and click **Save**.

Return to GoodAccess, skip the next step, and click **Submit**.

<figure><img src="/files/ar5u8MuLUGRtLak3TkNi" alt="Duo Admin Panel with key steps to setting up the SAML Response details."><figcaption><p>Setting up the SAML Response details</p></figcaption></figure>

You have now successfully set up your Cisco Duo SSO with GoodAccess.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://support.goodaccess.com/configuration-guides/features/sso-scim/cisco-duo.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.