Skip navigation
Documentation

Duo for Central Authentication Server (CAS)

Last Updated: July 29th, 2021

Contents

Duo Security's two-factor authentication secures Central Authentication Server (CAS) identity provider logins, complete with self-service enrollment and Duo Prompt.

Apereo's CAS project version 5.0 and later include Duo as a multifactor provider, and has updated the Duo integration for the Duo Universal Prompt in version 6.3.0. See the CAS Documentation for configuration instructions.

Connectivity Requirements

This application communicates with Duo's service on TCP port 443. Firewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability. If your organization requires IP-based rules, please review this Duo KB article.

First Steps

  1. Sign up for a Duo account.
  2. Log in to the Duo Admin Panel and navigate to Applications.
  3. Click Protect an Application and locate the entry for CAS (Central Authentication Service) in the applications list. Click Protect to the far-right to configure the application. and get your Client ID, Client secret, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications in Duo and additional application options.

    Previously, the Client ID was called the "Integration key" and the Client secret was called the "Secret key".

Treat your secret key like a password

The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!

Duo Universal Prompt

The new Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.

Universal Prompt Traditional Prompt
 Duo Push in Universal Prompt  Duo Push in Traditional Prompt

Migration to Universal Prompt for your CAS (Central Authentication Service) application is a two-step process:

  • Install an update from Apereo for the CAS application to support the Universal Prompt.
  • Activate the Universal Prompt experience for users of that Duo CAS (Central Authentication Service) application.

Before you activate the Universal Prompt for your application, it's a good idea to read the Universal Prompt Update Guide for more information about the update process and the new login experience for users.

New CAS (Central Authentication Service) Applications

When you install the latest version of CAS you're ready to use the Universal Prompt. If you're configuring CAS (Central Authentication Service) now, proceed with the installation instructions in this document.

The "Universal Prompt" area of the application details page shows that this application is "New Prompt Ready", with these activation control options:

  • Show traditional prompt: (Default) Your users experience Duo's traditional prompt when logging in to this application.
  • Show new Universal Prompt: Your users experience the Universal Prompt when logging in to this application.

Universal Prompt Info - Application Ready for Universal Prompt

Existing CAS (Central Authentication Service) Applications

CAS needs a software update from Apereo installed to support the Universal Prompt. The "Universal Prompt" section reflects this status as "App Update Ready" today. To update the CAS (Central Authentication Service) Duo application to a newer version, follow the update directions below.

Universal Prompt Info - Update Available

Once a user authenticates to CAS via the updated Duo application, the "Universal Prompt" section of the CAS (Central Authentication Service) application page reflects this status as "New Prompt Ready", with these activation control options:

  • Show traditional prompt: (Default) Your users experience Duo's traditional prompt when logging in to this application.
  • Show new Universal Prompt: Your users experience the Universal Prompt when logging in to this application.

Universal Prompt Info - Application Ready for Universal Prompt

In addition, the "Integration key" and "Secret key" property labels for the application update to "Client ID" and "Client secret" respectively. The values for these properties remain the same.

Activate Universal Prompt

Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.

Enable the Universal Prompt experience by selecting Show new Universal Prompt, and then scrolling to the bottom of the page to click Save.

Once you activate the Universal Prompt, the application's Universal Prompt status shows "Update Complete" here and on the Universal Prompt Update Progress report.

Universal Prompt Info - Universal Prompt Activation Complete

Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt.

Universal Update Progress

Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications in-scope for Universal Prompt support. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.

Configure CAS

CAS release 6.3.4 is the minimum recommended CAS release with support for Duo Universal Prompt. After installing CAS 6.3.4 (or later), configure the Duo Security multifactor provider within CAS, using the application information from the First Steps instructions above.

Update CAS

If you are running CAS versions below 6.3.4, you'll need to upgrade your CAS installation to version 6.3.4 or later to be able to use the Universal Prompt. Consult the CAS Upgrade Guide for more information about planning your upgrade, and use the Duo Security multifactor provider instructions to configure Duo after your CAS upgrade.

Troubleshooting

Need some help? Take a look at our CAS Knowledge Base articles or Community discussions. For further assistance, contact Support.