Skip to main content

Migrating to the Duo Universal Prompt (fedidp_oidcauth)

If you use Cisco Duo for multi-factor authentication (MFA) today, you set it up with an agent.pss step and the agtduo connector on a Duo target system, using challenge-response authentication. That path still works after you upgrade Bravura Security Fabric and Connector Pack. Your upgrade does not break it.

We recommend moving to the fedidp_oidcauth authentication-chain module and the Duo Universal Prompt. The module uses OpenID Connect to hand users to Duo's hosted prompt, which gives you newer factors and keeps pace with Duo without further changes to Bravura Security Fabric.

This guide explains what changes, what you gain, and how to move over at your own pace. For full configuration details, see Authentication chains: OIDC MFA (fedidp_oidcauth).

Note

This migration affects only how users complete Duo MFA at login. The Admin-API side of the agtduo connector, which provisions Duo users, groups, and attributes, is unaffected and stays in place. See DUO Authentication.

What changes

The main change is where users choose and complete their second factor.

  • Before — users pick a method and complete the challenge in the Bravura Security Fabric method-picker UI, driven by the agtduo challenge-response flow.

  • After — Bravura Security Fabric redirects users to Duo's hosted Universal Prompt. They choose and complete their factor there, then return to the login chain.

Because Duo hosts the prompt, the factor list and its look and feel are managed in Duo, not in Bravura Security Fabric.

What you gain

Moving to the Universal Prompt gives users access to Duo's current authentication methods, including:

  • Verified Push, where the user enters a displayed code to approve the push

  • WebAuthn security keys

  • Passkeys

As Duo adds methods to the Universal Prompt, they become available to your users without a change to Bravura Security Fabric.

Before you begin

Confirm the following before you migrate:

  • Bravura Security Fabric and Connector Pack are upgraded to a release that includes the fedidp_oidcauth module.

  • The Scenario.hid_authchain_oidcauth component is installed. This component adds the OIDC MFA chain module and its sample configuration. Install it as part of the component install or upgrade.

  • You have a Duo application registered for the Universal Prompt, and you have captured its client ID, client secret, and API hostname. See What to register in the Duo Admin Panel.

Migrate an existing Duo MFA configuration

Move over one chain at a time so you can test before you switch users.

  1. Identify the authentication chains that use an agent.pss step with a Duo target system for MFA (challenge-response). These are the chains you will replace.

  2. Register the Bravura Security Fabric redirect URI with your Duo application. If you leave fedidp_oidcauth_redirect_uri empty, copy the value that the chain editor computes. See Fabric chain parameters.

  3. Add the fedidp_oidcauth module to an authentication chain and set its parameters, including the Duo API hostname, client ID, and client secret. Use Test connection to confirm the credentials.

  4. Choose the chain placement mode. Use MFA-only when another step identifies the user, or combined identification and authentication after a user_ident step. See Overview.

  5. Test the new chain with a small pilot group. Confirm that users reach the Duo Universal Prompt and return to Bravura Security Fabric after they authenticate.

  6. Switch users to the new chain by updating your login policy or chain assignment.

  7. Once the new chain is verified, remove the legacy agent.pss Duo MFA step from the old chain.

Run both methods during the transition

You do not have to switch everyone at once. The legacy agent.pss path and the new fedidp_oidcauth module can run side by side while you migrate. Keep the legacy chain in place for users who have not moved yet, and assign the new chain to the groups you have tested.

If you need to roll back a group during the transition, reassign it to the legacy chain. Because you do not remove the legacy step until the end, rollback stays simple.

Deprecation and support timeline

The legacy Duo Auth-API path is deprecated in two phases:

  • Deprecation warning — Bravura Security Fabric shows an admin-visible warning when a chain still contains an agent.pss step that points at a Duo target system. The warning links to this guide.

  • Removal — in a later release, the Duo challenge-response authentication code is removed from the agtduo connector. After removal, the legacy MFA path no longer functions and you must use the Universal Prompt.

The Admin-API side of agtduo, which manages Duo users, groups, phones, and tokens, is not part of this deprecation and continues to work. Watch the release notes for the target releases of each phase, and plan your migration to complete before the removal release.

In this section: