Skip to main content

Configure SAML SSO with Cisco Duo

This guide configures Duo Single Sign-On as the SAML Identity Provider (IdP) and VeloDB Cloud as the Service Provider (SP) for one VeloDB Cloud organization.

Prerequisites​

Before you begin, make sure that:

  • Your VeloDB Cloud organization uses the Premium plan.
  • You are an Organization Admin in VeloDB Cloud.
  • Duo Single Sign-On is configured with an authentication source.
  • You can add and configure applications in the Duo Admin Panel.
  • You can create a DNS TXT record for your corporate email domain.
  • You have configured the required Duo authentication and access policies.

Keep an active Organization Admin session open while you configure and test SSO.

Start SAML setup in VeloDB Cloud​

  1. Sign in to VeloDB Cloud as an Organization Admin.

  2. Click your profile area in the bottom-left corner of the console to open the account menu, then select Authentication.

  3. Turn on SAML Single Sign-on.

  4. In Add Application, copy the following values:

    • Single Sign-On URL
    • Service Provider Entity ID

Keep this page open while you configure Duo.

Create the Duo application​

  1. Sign in to the Duo Admin Panel.

  2. Go to Applications → Protect an Application.

  3. Search for Generic SAML Service Provider with the SSO label, and add the application.

  4. In the Service Provider section, configure the following fields:

    Duo fieldValue
    Entity IDThe VeloDB Cloud Service Provider Entity ID
    Assertion Consumer Service (ACS) URLThe VeloDB Cloud Single Sign-On URL
    Service Provider Login URLLeave blank
    Default Relay StateLeave blank

  5. Configure the NameID settings:

    Duo fieldValue
    NameID formaturn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
    NameID attributeEmail Address

  6. Add an attribute mapping from the Duo email attribute to email in the SAML response.

  7. Configure application access and Duo policies for the appropriate users or groups.

  8. Save the application.

For more information, see Duo Single Sign-On for Generic SAML Service Providers in the Duo documentation.

Import Duo metadata​

  1. In the Duo application, locate the Metadata section.
  2. Copy the Metadata URL.
  3. Return to VeloDB Cloud and continue to Configure Identity Provider.
  4. Paste the Duo metadata URL into Metadata URL.
  5. Select Verify.
  6. Confirm that VeloDB Cloud displays the imported IdP SSO URL and certificate.

The metadata URL must be publicly accessible over HTTPS.

Verify a domain and configure provisioning​

  1. Continue to Verify Domain.
  2. Select Add Domain, and enter your corporate email domain without @.
  3. At your DNS provider, create a TXT record using the TXT Record Name and Record Value displayed by VeloDB Cloud.
  4. Wait for the DNS change to propagate, and then select Verify for the domain.
  5. Select the Default Role assigned to users created through JIT provisioning.
  6. Select a JIT Provisioning Policy.
  7. Select Continue.

For details about the provisioning policies, see JIT provisioning.

Test and enable SSO​

  1. In Test SSO Login, select Test SSO Login.
  2. Authenticate with a Duo user who has access to the application.
  3. Complete Duo authentication when prompted.
  4. Confirm that VeloDB Cloud reports SSO Test Successful.
  5. Continue to Enable SSO, select Enable SSO, and complete the setup.

Enforce SSO​

Before you enforce SSO, an active Organization Admin must complete a regular SAML sign-in:

  1. Sign out of VeloDB Cloud.
  2. Start a new sign-in at https://www.velodb.cloud using the Organization Admin's email address.
  3. Authenticate through Duo and confirm that the administrator can access the organization.
  4. Return to Authentication and open the SAML SSO configuration.
  5. Select Configure next to Enable SSO, choose Enforce SSO, and confirm the change.

Do not initiate sign-in from Duo Central or a Duo application tile. VeloDB Cloud supports Service Provider-initiated sign-in only.

When SSO is enabled but not enforced, the email sign-in page remains available for password or verification-code sign-in.

Removing a user's Duo application access does not remove an existing VeloDB Cloud organization membership. When you offboard a member, remove the member separately on the VeloDB Cloud Members page.