DUO Authentication

Ensure that the time is synchronized on the Bravura Security Fabric server with a time server.

The time must be accurate for proper integration between Bravura Security Fabric and DUO Authentication server.

The agtduo connector uses the Authentication API for challenge response authentication and the Administrative API to update and retrieve information from the DUO Authentication web service.

The Web SDK is used for communication with the Duo Mobile app.

The DUO MFA, DUO Access, and DUO Beyond editions all support the Administrative API.

These two sites outline how to set up the DUO Authentication web service for the Authentication API and the Administrative API:

The API hostname will later be used for the Server target address configuration parameter.

Bravura Security Fabric uses DUO API tokens configured in the DUO Authentication administrative console to perform Bravura Security Fabric operations.

Different functionality is available through two different types of API tokens, and for full target functionality, both have to be collected from the DUO administrative console and used in the Bravura Security Fabric target system’s Credentials tab:

Each of these API tokens contains:

Grant the required access privileges for the operations required by the integration.

If you are using the DUO Authentication target system only for challenge-response (as a module in an authentication chain to log into the product or allow a help desk user access to an end user’s profile), only the "Authentication API" is required. This will also mean:

If you use the DUO Authentication as a challenge-response back end, you must have a SQLite database list file to associate users during auto discovery so that users can authenticate against the target system.

You can create the file by copying it from another target such as from an Active Directory or another target system.

Refer to Creating a list file and copying data from other targets for how to use the Copy data from these targets, separated by commas, during auto-discovery target system option to be able to copy the listing data from one or more other targets to use for the list file for the target. This also makes use of the Connector execution order auto-discovery list as well as a post psupdate script for the target that you are copying data to.

Alternatively, you can use the List Override target address option to create the list file as noted below.

The List Override target address option along with the listoverride.py sample script is used in this case to automatically copy the list file during auto-discovery from the other target to a new list file for the DUO target.

You can configure this using the following steps:

If copying the list file from another source such as from Active Directory, a postHook specification must be added in order to ensure that the values from the longid fields are replaced with those from shortid. The short IDs match those of users on the DUO Authentication target system.

In this case and where ADDN is the target id from the target that you are copying from, set the List Override target address option to the following:

{action=copy;srcTargetId=ADDN;script=listoverride.py;postHook=replaceLongIdWithShortId;}

The source target must list first during auto-discovery. Configure by clicking Maintenance > Auto discovery > Connector execution order and ensuring that the source target is added and is at a higher priority than the target that you are copying to.

The list file must contain accounts for all users who have accounts on DUO, and only those users.

To verify that list association worked, run a report (Manage reports > Reports > Users > Accounts) for the DUO target after running auto discovery. If account association fails (the target’s account report shows accounts as "Unclaimed" instead of "Auto-associated"), verify that the longid listed for DUO accounts matches the ProfileID, or follow the section on account association.

Bravura Security Fabric uses template accounts as models or "blueprints" for creating new accounts in DUO Authentication. The following example illustrates how you can create a template account in DUO Authentication:

As described in Configuring administrative credentials if both the Authentication API as well as the Administrative API have been configured, then the DUO Authentication target requires a set of administrative credentials for each one.

For the first administrator, set the Administrator ID to the integration key and the Password to the secret key as configured for the DUO Authentication web service for the Authentication API.

For the second administrator, set the Administrator ID to the integration key and the Password to the secret key as configured for the DUO Authentication web service for the Administrative API. Also ensure that the System password checkbox is checked for this administrator.

The Authentication methods order option may be used to specify the order for the list of the multifactor authentication methods that are presented to a DUO user for challenge response authentication.

The order may be specified by either a list on the target address configuration page or from a file.

When choosing the list option and specifying the multifactor authentication methods, these fields allow multiple values. To fill in multiple values, select List from the drop-down list box displaying in front of these fields, and use the More button to add additional input boxes when more than one value is given. The value in each input box is treated as a single value, for example:

These values represent the following multifactor authentication methods:

There is also an option to specify the authentication order in a file. To use the file, select File option from the drop-down list and specify the file name in the field.

The file must be located in the <Program Files path>\Bravura Security\Bravura Security Fabric\<instance>\ script\ directory and contain a list of the authentication order for the DUO multifactor authentication methods.

To specify the authentication order:

# KVGROUP-V2.0
   authorder = {
      "push";
      "passcode";
      "sms";
      "phone";
   };

The list of the multifactor authentication methods may be modified to re-order how they are presented to a user for challenge response authentication.

If the user has more multifactor authentication methods than what is provided for the authentication methods order, the methods provided in the list will be the first ones that are shown to the user and the remaining methods will be directly underneath in the provided list to the user.

The authentication methods are also listed first in the order of the user’s phone numbers or devices and secondly in the order as defined by Authentication methods order.

So for example, if a user has both mobile phone(s) as well as landline phone(s), all of the phone numbers across all devices and numbers will not necessarily be listed together across all phones. They will instead be grouped together first according to each phone number or set of devices.