# Duo Single Sign-On

Steps not yet verified in the identity provider's current admin console.

Recommended protocol: SAML 2.0.

## SAML 2.0

### Connect Duo Single Sign-On with SAML 2.0

1. In the Duo Admin Panel go to Applications \> Application Catalog, search for Generic SAML Service Provider (labels SSO and Provisioning) and click Add; Duo creates the application and opens its settings.
2. In the Service Provider section either set Metadata Discovery to Metadata XML URL and enter **SP metadata URL**, or keep None (manual input) and enter Entity ID **SP entity ID** and Assertion Consumer Service (ACS) URL **ACS URL**.
3. In the SAML Response section keep NameID format (default emailAddress) or choose another, set the NameID attribute, keep Signature algorithm SHA256 with Sign response and Sign assertion selected, and use Map attributes for first name, last name and e-mail.
4. In the Metadata section copy the Metadata URL, or under Downloads use Download XML next to SAML Metadata, and upload it in KeenAuth.
5. Under User access, which defaults to Disable for all users, choose Enable only for permitted groups (and select the Duo groups) or Enable for all users, then click Save and run the KeenAuth connection test.

Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.