Configuring Duo Single Sign-On as an identity provider
You can use Duo Single Sign-On as an identity provider to access SC//Nexus™. To do this, you create a Cloud Application on the Duo platform.
SC//Nexus service provider details
SC//Nexus publishes the following service provider details for your identity provider. The steps on this page show which of them Duo uses and where to enter them.
| Detail | Value |
|---|---|
| SC//Nexus™ portal service provider metadata (XML) | https://nexus.scalecomputing.com/api/v1/saml/metadata |
| Assertion Consumer Service (ACS) URL | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| Entity ID / Audience URI | https://saml.stargate.local |
| Signing Certificate | https://nexus.scalecomputing.com/sso/.well-known/saml.cer |
Step 1: Create the Duo Cloud Application
The Duo documentation provides the steps for creating a Cloud Application on their platform. For more information, see Single Sign-On for Generic SAML Service Providers in the Duo documentation.
- Access and log in to your Duo Admin Dashboard.
- From the left navigation, choose Applications, Application Catalog.
-
Search for
Generic SAML Service Providerand choose Add. On the older Duo Applications page, choose Protect an Application, locate Generic SAML Service Provider, and choose Protect instead. -
On the application creation screen, do the following.
-
For Application name, specify
SC//Nexus. - For User access, decide whether to turn on access to this application for some or all of your Duo user accounts.
- In the Service Provider section, use the following settings. For any setting not listed, leave the default or consult the Duo documentation.
-
For Application name, specify
| Setting | Value |
|---|---|
| Entity ID | https://saml.stargate.local |
| Assertion Consumer Service (ACS) URL | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| Single Logout URL | leave blank |
| Service Provider Login URL | leave blank |
| Default RelayState | leave blank |
| NameID Format | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress |
| NameID attribute | <Email Address> |
| Signature algorithm | SHA256 |
| Signing options | Select Sign assertion. Sign response is not required. |
SC//Nexus publishes no single logout endpoint and requires only the assertion to be signed. Both differ from the SC//Reliant™ Platform Manager integration, which uses a logout URL and signs both the response and the assertion.
Step 2: Retrieve the Duo Single Sign-On identity provider metadata
Once your Duo Cloud Application exists, retrieve the SAML metadata file and provide it to your Scale Computing account manager or Support to complete the setup.
- In the Duo Admin console, access the settings for the SC//Nexus application you created.
- In the Downloads section, download the SAML Metadata file and provide it to your Scale Computing account manager or Support, who adds it to your SC//Nexus organization.
Step 3: Create and assign user accounts to the SAML application
To complete the authentication workflow, create user accounts in the Duo Admin Dashboard for each SC//Nexus user and assign them to your Duo SC//Nexus application. For more information, see Duo Administration - Manage Users in the Duo documentation.
IMPORTANT: Ensure that the Email Address field in Duo matches the user's SC//Nexus account email address, in all lowercase.
Troubleshooting login issues when using Duo Single Sign-On as an identity provider
Issue: Receiving an "Invalid Email or password" error when logging in to SC//Nexus
Possible causes: Ensure the Duo email address is the same as the email address on the SC//Nexus account, including case, so make sure the email address is all lowercase in the Duo application. To transform the Duo username to lowercase, use the toLowerCase(user.email) syntax to override the format. For more information, see Attribute Transformations in the Duo documentation.