cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1118
Views
1
Helpful
6
Replies

How to use Duo MFA as main aunthentication method

rsacramento
Level 1
Level 1

Hello.

Is it possible to use Duo MFA as main authentication method ? Where the user does not need to type logon password, only use the Duo mobile app.

Thanks
All

6 Replies 6

Amy2
Level 5
Level 5

Hi @rsacramento, no it’s currently not possible to Duo for primary authentication. However, you might be interested in our Duo Passwordless solution which is now available in a public preview. At the end of that blog post are a number of videos which explain more. I hope that helps!

Thanks for your help.

I gonna take a look on this new solution.

BusterDoney
Level 1
Level 1

Actually it is possible to use Duo MFA as the primary authentication method. Some conditions apply:

  • You need to use ADFS 2019 as your Identity provider.
  • The application in question needs to be integrated with ADFS for SAML or OpenID.
  • You can require Duo as your primary auth but users are still required to enter their password as their secondary auth; however, there are many options available for Keep Me Signed In, Certificate-based auth in lieu of passwords, tokens, Windows Hello for Business, etc.

Take a look at Protect the Password feature for ADFS to learn more about using MFA as your primary auth method. This isn’t a feature of Duo but rather a feature of the IdP.

Hi all,

I have encountered an issue while using DUO as Primary Authentication Method for ADFS.

Meanwhile, I've found this post.

When I use DUO as Primary Authentication in ADFS (i.e. accessing SAML2 integrated Shibboleth SP App with SP-initialized). The below error happen when an invalid user (i.e. User not exist in AD) information is used.

patrickhkfung_0-1711613326326.png

patrickhkfung_1-1711613340872.png

See if anyone encounter this problem also?

Thanks,
Patrick

Of course AD FS looking up a non-existent user fails when the user doesn't exist in the directory?

Duo, not DUO.

Hi Kristina,

Many thanks for your reply. I found it the error is better if using OpenID Correct integrated application

They will not throw the error to the application side and the error message is more meaningful.

patrickhkfung_1-1712135410215.png

 

 

Quick Links