Skip navigation

Effective October 28, 2019 Duo Security will be transitioning to Cisco's Privacy Statement. View the Duo Privacy Data Sheet.

Documentation

Two-Factor Authentication for CyberArk Privileged Account Security

Last Updated: April 29th, 2019

Duo helps secure your CyberArk Privileged Account Security Solution with two-factor authentication for Password Vault browser logins, complete with inline self-service enrollment and Duo Prompt.

Overview

The Duo web application may only be used when accessing CyberArk Password Vault Web Access (PVWA) from a web browser. If you'd like to apply Duo MFA to Vault client logins, configure Duo authentication via RADIUS or LDAP.

Once configured, the CyberArk WebSDK integration takes a username context and passes it to Duo, and then prompts the user to complete Duo multifactor enrollment or authentication. If Password Vault Web Access is using IIS integrated Windows authentication and the client system is joined to the Active Directory domain as the PVWA server, the logged-in Windows username is passed to Duo. If integrated Windows authentication isn't used, then PVWA prompts for a username to pass to Duo.

After successful Duo approval, CyberArk performs primary authentication. If IIS integrated Windows authentication is configured on the PVWA server, then the logged-in Windows credentials are used. If you are not using Windows authentication, the user must enter their RADIUS or LDAP Vault authentication password (whichever method you specify when configuring Duo on the CyberArk server).

This page provides an overview of the Duo WebSDK installation process on your CyberArk PWVA deployment. The detailed instruction steps you will need to follow are in the CyberArk PVWA Authentication via Duo WebSDK document available for download from the CyberArk Support Vault (as described in step 4 in the next section.)

The Duo WebSDK integration works with PAS versions 9.8 and higher. Note that additional configuration is required for the login page to work on v10, as described in the CyberArk PVWA Authentication via Duo WebSDK document.

If you have issues configuring or using the CyberArk Duo WebSDK integration on your Password Vault deployment, please contact CyberArk's technical support.

First Steps

  1. Sign up for a Duo account.
  2. Log in to the Duo Admin Panel and navigate to Applications.
  3. Click Protect an Application and locate CyberArk Privileged Account Security in the applications list. Click Protect this Application to get your integration key, secret key, and API hostname for use later when configuring the CyberArk WebSDK integration. (See Getting Started for help.)
  4. Download the Duo WebSDK integration from CyberArk:
    1. Login to the CyberArk Support Vault and navigate to the CyberArk IntegrationsTechnology PartnersDuo SecurityWebSDK Authentication folder.
    2. Download the Duo Security WebSDK Authentication.zip file and the CyberArk PVWA Authentication via Duo WebSDK document.
  5. Create an application key for use later when configuring the CyberArk WebSDK integration. The application key is a string that you should generate and keep secret from Duo. It should be at least 40 characters long. You can generate a random string in Python with:

    import os, hashlib
    print hashlib.sha1(os.urandom(32)).hexdigest()

Treat your secret key like a password

The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!

Install the Duo Integration on the PVWA Server

Before you begin, you should have obtained the Duo Security WebSDK Authentication.zip file and the CyberArk PVWA Authentication via Duo WebSDK document from the CyberArk Support Vault as described in First Steps - step 4 above.

Review the CyberArk Duo WebSDK document first and determine if you want to use integrated Windows Authentication (IWA) in IIS for access to PWVA, or if you want to require RADIUS or LDAP authentication in PWVA after Duo authentication.

You will also need Remote Desktop or console access to your Password Vault server, and administrator access to Password Vault Web Access via your browser.

  1. Copy the Duo Security WebSDK Authentication.zip file to your CyberArk Password Vault Web Access server and extract the contents.

  2. Refer to the CyberArk PVWA Authentication via Duo WebSDK document you downloaded earlier for detailed installation and configuration instructions. Follow the directions to deploy Duo in your CyberArk Password Vault environment.

    1. Copy files from the downloaded zip into the PasswordVault folders.
    2. Define the Duo custom authentication method in PWVA.
    3. Edit the PWVA web.config file to add the Duo integration key, secret key, and API hostname you copied from the Duo Admin Panel, the application key you generated, and to reference the "DuoSecurity" IIS module.
    4. Change the IIS authentication method for the PasswordVault application as required (this depends on whether or not you chose to use IWA).
    5. Update the "Local Internet" zone settings to include the PWVA site with automatic logon on all client systems if using IWA.
    6. If not using IWA, configure the additional RADIUS or LDAP authentication method.
  3. If you are using Password Vault version 10, be sure to change the logon page from v10 to v9 as specified in the "USING THE CYBERARK V10 INTERFACE" section of the CyberArk PVWA Authentication via Duo WebSDK document.

For additional information about adding the Duo Web authentication method, including IIS instructions for Windows integrated authentication, please refer to the CyberArk PVWA Authentication via Duo WebSDK document available for download from the CyberArk Support Vault, as well as the "Defining Authentication Methods in PVWA", "Windows Authentication", "RADIUS Authentication", "LDAP Authentication" sections in the "CyberArk Privileged Account Security Installation Guide".

Test your Setup

Navigate to the Privileged Account Security web login page and click the new Duo login option (this name matches the "DisplayName" you specified when configuring the Duo authentication method).

CyberArk Duo WebSDK Login - Choose Method

In this example, the Duo authentication method was configured to use LDAP authentication so PVWA must prompt for a username to pass to the Duo service.

CyberArk Duo WebSDK Login - Enter Username

Next, complete Duo enrollment or authentication.

CyberArk Duo WebSDK Login - Duo Authentication

After successful Duo authentication, PVWA prompts for the LDAP primary password. Note that the username is the same one originally provided to Duo, so the Duo username and PVWA usernames should match.

CyberArk Duo WebSDK Login - Primary Authentication

If you're using IIS's integrated Windows authentication for PVWA logins, Windows will automatically provide a username to the Duo service for secondary authentication and perform primary authentication after Duo using the logged in Windows credentials.

Troubleshooting

If you have any issues with installing the CyberArk WebSDK integration, configuring your Password Vault authentication methods, or questions about IIS integrated authentication for PVWA, please contact CyberArk support. See the "DEBUGGING" section in the CyberArk PVWA Authentication via Duo WebSDK document.

Additionally, you may find the "CyberArk Privileged Account Security Installation Guide" documentation available from CyberArk helpful.

Need some help with Duo authentication? Take a look at our Knowledge Base articles or Community discussions. For further assistance, contact Duo Support.