Contents
Duo Security's two-factor authentication secures Central Authentication Server (CAS) identity provider logins, offering inline user enrollment, self-service device management, and support for a variety of authentication methods — such as passkeys and security keys, Duo Push, or Verified Duo Push — in the Duo Universal Prompt.
Apereo's CAS project version 5.0 and later include Duo as a multifactor provider, and has updated the Duo integration for the Duo Universal Prompt starting with version 6.3.4. See the CAS Documentation for more information about Duo authentication in CAS.
The URL for accessing CAS must be a valid HTTPS URL and port, using an RFC-1034-compliant hostname (not an IP address), with a maximum length of 1024 characters.
This application communicates with Duo's service on SSL TCP port 443.
Firewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability. If your organization requires IP-based rules, please review Duo Knowledge Base article 1337.
Effective June 30, 2023, Duo no longer supports TLS 1.0 or 1.1 connections or insecure TLS/SSL cipher suites. See Duo Knowledge Base article 7546 for additional guidance.
First Steps
-
Log in to the Duo Admin Panel and navigate to Applications → Application Catalog.
-
Locate the entry for CAS (Central Authentication Service) with the "2FA" label in the catalog. Click the + Add button to create the application, and get your Client ID, Client secret, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications with Duo and additional application options.
Previously, the Client ID was called the "Integration key" and the Client secret was called the "Secret key".
Treat your secret key like a passwordThe security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!
-
No users can log in to new applications until you grant access. Update the User access setting to grant access to this application to users in selected Duo groups, or to all users. Learn more about user access to applications. If you do not change this setting now, be sure to update it so that your test user has access before you test your setup.
Duo Universal Prompt
The Duo Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.
| Universal Prompt | Traditional Prompt |
 |
 |
For CAS (Central Authentication Service) applications created before March 2024, migration to Universal Prompt is a three-step process:
- Install an update for the CAS (Central Authentication Service) application, which implements a redirect to Duo during authentication to support the Universal Prompt.
- Authenticate with Duo 2FA using the updated application so that Duo makes the Universal Prompt activation setting available in the Admin Panel. This first authentication after updating shows the traditional Duo prompt in a redirect instead of an iframe.
- From the Duo Admin Panel, activate the Universal Prompt experience for users of that Duo CAS (Central Authentication Service) application if the traditional prompt is still selected. Once activated, all users of the application see the Duo Universal Prompt in a redirect.
If you created your CAS (Central Authentication Service) application before March 2024, it's a good idea to read the Universal Prompt Update Guide for more information, about the update process and the new login experience for users, before you activate the Universal Prompt for your application.
New CAS (Central Authentication Service) Applications
When you install the latest version of CAS you're ready to use the Universal Prompt. CAS (Central Authentication Service) applications created after March 2024 have the Universal Prompt activated by default. If you're configuring CAS (Central Authentication Service) now, proceed with the installation instructions in this document.
The "Universal Prompt" area of the application details page shows this application as "Activation complete", with these activation control options:
- Show traditional prompt: Your users experience Duo's traditional prompt via redirect when logging in to this application.
- Show new Universal Prompt: (Default) Your users experience the Universal Prompt via redirect when logging in to this application.
Existing CAS (Central Authentication Service) Applications
CAS needs a software update from Apereo installed to support the Universal Prompt. The "Universal Prompt" section reflects this status as "Update required" today. To update the CAS (Central Authentication Service) Duo application to a newer version, follow the update directions below.
Once a user authenticates to CAS via the updated Duo application, the "Universal Prompt" section of the CAS (Central Authentication Service) application page reflects this status as "Ready to activate", with these activation control options:
- Show traditional prompt: (Default) Your users experience Duo's traditional prompt via redirect when logging in to this application.
- Show new Universal Prompt: Your users experience the Universal Prompt via redirect when logging in to this application.
In addition, the "Integration key" and "Secret key" property labels for the application update to "Client ID" and "Client secret" respectively. The values for these properties remain the same.
Activate Universal Prompt
Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.
Enable the Universal Prompt experience by selecting Show new Universal Prompt if the traditional prompt is still selected, and then scrolling to the bottom of the page to click Save.
Once you activate the Universal Prompt, the application's Universal Prompt status shows "Activation complete" here and on the Universal Prompt Update Progress report.
Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt. However, this will still deliver the Duo prompt via redirect, not in an iframe. Keep in mind that support for the traditional Duo prompt ended for the majority of applications in March 2024.
Universal Update Progress
Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.
Configure CAS
CAS release 6.3.4 is the minimum recommended CAS release with support for Duo Universal Prompt. After installing CAS 6.3.4 (or later; 7.x recommended), configure the Duo Security multifactor provider within CAS (v7 documentation), using the application information from the First Steps instructions above.
Grant Access to Users
If you did not already grant user access to the Duo users you want to use this application be sure to do that before inviting or requiring them to log in with Duo.
Update CAS
If you are running CAS versions below 6.3.4, you'll need to upgrade your CAS installation to version 6.3.4 or later to be able to use the Universal Prompt. Consult the CAS Upgrade Guide for more information about planning your upgrade, and use the Duo Security multifactor provider instructions to configure Duo after your CAS upgrade.
After upgrading, authenticate once with the Duo Security OIDC multifactor provider, which will show the traditional Duo Prompt in a redirect instead of the iframe. After that you can activate Universal Prompt for your application.
Troubleshooting
Need some help? Take a look at our CAS Knowledge Base articles or Community discussions. For further assistance, contact Support.