Skip to main content

Introduction

Duo (https://duo.com) is a popular identity verification platform. You can use it in MSP Process to achieve two goals:
  1. To secure the login process of anyone looking to access your MSP Process account at https://app.mspprocess.com. This capability requires the Duo Web SDK to be configured. Click here for the KB article that outlines how to set this up.
  2. During the end-user verification process; Duo can be used instead of sending the user a verification code via e-mail or SMS. This capability requires the Duo Admin API to be configured.
This KB article will take you through all of the steps required to do the second scenario - to use Duo to verify your end-users, including setting up entities in Duo (their Admin API and Auth API entities) and configuring the appropriate settings within MSP Process.

Step 1: Protecting the ‘Admin API’ Application in Duo

What is the Admin API? The Admin API provides administrative access to your Duo environment. MSP Process uses it to retrieve information about your parent account and sub-accounts in Duo, and to retrieve information about the users in that account/sub-accounts. NOTE: You’ll only need to do this part once, at the ‘parent’ account level in Duo.

Steps to Take in the Duo Admin Portal:

  1. Login to the Duo Admin portal (https://admin.duosecurity.com/) - you must be an Owner-level user in Duo
  2. From the left-hand menu, navigate to Application -> Applications
  3. Click the Add Application button
  4. Search for “Admin API” in the Search field
  5. Click on the Add button beside Admin API
  6. In the Basic Configuration section, change Name field to say “Admin API for MSP Process”
  7. In the Settings section, in the Permissions area, enable the Grant resource -> Read permission
  1. In the Subaccount permissions area, enable the Grant accounts -> Read and Grant resource -> Read permission
  1. In the Details section, copy the Integration Key, Secret Key and API Hostname; you’ll need them later
  2. Click Save

Steps to Take in MSP Process:

  1. Login to the MSP Process portal (https://app.mspprocess.com)
  2. Navigate to Settings -> Integrations -> Security Integrations
  3. Click the Duo Admin button
  1. Specify a name for the integration, and then enter the Integration Key, Secret Key and API Hostname from what you setup earlier in the Duo Admin Portal.
  1. Click Submit when you’re done.

Step 2: Protecting the ‘Auth API’ Application in Duo

What is the DUO Auth API? Duo Auth API is a low-level, RESTful API for adding strong two-factor authentication to your website or application. MSP Process uses the Auth API to send your end-users a push notification that verifies their identity. NOTE: You’ll need to repeat the steps in this section for each sub-account that you want MSP Process to be able to access.

Steps to Take in the Duo Admin Portal:

  1. Login to the DUO Admin portal (https://admin.duosecurity.com/)
  2. From the left-hand menu, navigate to Application -> Applications
  3. Click the Add Application button
  4. Search for “Auth API” in the Search field
  5. Click on the Protect button beside DUO Auth API
  6. In the Basic Configuration section, change Application Name field to say “Auth API for MSP Process”
  7. Also in the Basic Configuration section, choose the Enable for all users option for User access:
  1. In the Details section, copy the Integration Key, Secret Key and API Hostname; you’ll need them later
  2. In the Settings section, enable “Simple” username normalization:
  1. Click Save

Steps to Take in MSP Process:

  1. In MSP Process, navigate to Settings -> Integrations -> Security Integrations
  2. Click the Add new integration button
  1. Click the Duo Auth API button
  1. Specify a name for the integration, and then enter the Integration Key, Secret Key and API Hostname from what you setup earlier in the Duo Admin Portal.
  1. Click Submit when you’re done.

Step 3: Synching Contacts from Duo into MSP Process

The final step in this workflow is to sync contacts (users) from Duo into MSP Process. This is an optional step, but a very useful one - by synching those contacts into MSP Process, we’ll be able to enable/disable the Duo button in our Pod/Insight. This’ll make it so that your technicians will quickly understand if they can send a caller a Duo push notification to verify their identity, or not.
  1. Login to the MSP Process UI (https://app.mspprocess.com) as an Admin-level user
  2. Navigate to the Settings -> Integrations -> Security Integrations page
  3. Click on the Duo Authenticator “card”
  1. At the top of the page, enable the Store Contacts from Duo in MSP Process option, and then click the Re-sync button

Congratulations! You’ve Done It!

You’ve now setup the required entities in Duo, and configured MSP Process with the information it needs to start using Duo to verify the identity of your end-users.