topic Re: Connectwise SSO Integration in Managing Users

Connectwise SSO Integration

mattk1 — Thu, 25 Jul 2019 06:13:13 GMT

Does anyone know if it is possible to set up Duo as an external identity provider? I don’t see any documentation on either end and we would really like to set this up.

Here is a link to the general setup instructions:
https://docs.connectwise.com/ConnectWise_Documentation/ConnectWise_Unified_Product/010/25

Thanks!

Re: Connectwise SSO Integration

Amy2 — Fri, 26 Jul 2019 13:03:16 GMT

Hi there,

Edit: Oops, I misunderstood your question initially. I am rather new to my role and still learning. Yes, my expert colleague Kristina explains in this post that Duo Access Gateway is a SAML 2.0 capable identity provider (or IdP).

You can set up Duo to protect Connectwise Manage via SSO using the generic SAML service provider:

Deploy Duo Access Gateway
Point it to Active Directory as the primary authentication source
Set up SSO for ConnectWise Manage. When you do this you’ll be bouncing between the Duo Admin Panel (where you create the generic SAML application using whatever parameters/attributes ConnectWise recommends), your Duo Access Gateway server’s admin interface (where you add the application you created in the Duo Admin Panel), and the ConnectWise management console (where you tell it to use Duo for SSO).

This might be a good reference for you: https://docs.connectwise.com/ConnectWise_Documentation/090/020/070/140/SAML_and_SSO_Frequently_Asked_Questions

Thanks to @DuoKristina for this answer!

Re: Connectwise SSO Integration

MikeJoll — Wed, 18 Sep 2019 03:04:28 GMT

Hi, we are in the same boat. Needing information on how to setup DAG with SAML / CW Manage & such as per the original question above. I can’t find any documentation that outlines the connection between the two products (ConnectWise doesn’t technically support DUO SAML but says it will work) and the setup on both sides uses different terminology for the required fields / values. We have DAG setup pointing to our AD, MattK did you get it working?

Re: Connectwise SSO Integration

Brad_Cook — Fri, 01 Jul 2022 03:35:16 GMT

Checking in if anyone managed to get through this, we are assuming the Duo - NameID Format, NameID Attribute & Mapped Attributes being sent back to the ACS endpoint for ConnectWise Manage has something missing…

Re: Connectwise SSO Integration

timshores1 — Wed, 06 Jul 2022 18:13:41 GMT

Hello @Brad_Cook, thanks for replying. I suggest contacting Duo Support, they’ll be able to look directly at your configuration and provide specific feedback in a way that this community isn’t set up to do. Let us know what you find out!

Re: Connectwise SSO Integration

timshores1 — Wed, 06 Jul 2022 19:29:01 GMT

Another angle of approach would be consider migrating from Duo Access Gateway to Duo Single Sign-on, and then using Duo SSO with SAML to log into ConnectWise:

This will become necessary as we approach DAG end-of-life in October '23:
https://help.duo.com/s/article/7486?language=en_US

Re: Connectwise SSO Integration

Gigawatt — Wed, 06 Jul 2022 21:37:29 GMT

To bad there isn’t an On-premise solution to the DAG’s since they are eol soon.

Re: Connectwise SSO Integration

timshores1 — Fri, 08 Jul 2022 22:06:28 GMT

I hear you @Gigawatt, it will take some adjustment to shift to a cloud-hosted identity provider. Duo Single Sign-On will reduce administrative burden while supporting more feature development options for our Engineering teams. I’ll be curious to hear how it goes for you after you’ve migrated.

Re: Connectwise SSO Integration

Gigawatt — Mon, 11 Jul 2022 13:14:49 GMT

Unfortunately we aren’t going that route. Since we are all strictly on-premise, we are going to replace the DAG’s with AD FS.

Re: Connectwise SSO Integration

timshores1 — Mon, 11 Jul 2022 15:00:44 GMT

Ah I see, that makes sense. For good measure, I should make sure you know about our recently released compatibility with Duo Universal Prompt in the Duo AD FS integration.

Re: Connectwise SSO Integration

Gigawatt — Mon, 11 Jul 2022 19:31:26 GMT

We already run the Duo adapter but we don’t have the " Duo Universal Prompt" enabled, should we?

Re: Connectwise SSO Integration

timshores1 — Mon, 11 Jul 2022 20:22:57 GMT

Once you update to version 2.0.0 released in May, your Universal Prompt Progress Report will display App Update Ready under existing Duo Authentication for Microsoft AD FS apps. New AD FS apps will default to Universal Prompt.

Re: Connectwise SSO Integration

Gigawatt — Mon, 11 Jul 2022 20:25:13 GMT

Sorry about that we are on version 2.0.0. I just had an older screenshot

Re: Connectwise SSO Integration

ITEM93 — Thu, 06 Oct 2022 19:15:27 GMT

Just hoping to follow up on this.

The ConnectWise SAML_and_SSO_Frequently_Asked_Questions page states:
“SSO using SAML is only supported with a one-to-one connection with ADFS (Active Directory Federated Service). While it may be possible to integrate using products such as Azure AD, Okta, or DUO, we do not support them at this time.”

Was anyone able to get Managed working with Duo SSO?