Two-Factor Authentication for CyberArk Privileged Account Security

Overview

The Duo web application may only be used when accessing CyberArk Password Vault Web Access (PVWA) from a web browser. If you'd like to apply Duo MFA to Vault client logins, configure Duo authentication via RADIUS or LDAP.

Once configured, the CyberArk WebSDK integration takes a username context and passes it to Duo, and then prompts the user to complete Duo multifactor enrollment or authentication. If Password Vault Web Access is using IIS integrated Windows authentication and the client system is joined to the Active Directory domain as the PVWA server, the logged-in Windows username is passed to Duo. If integrated Windows authentication isn't used, then PVWA prompts for a username to pass to Duo.

After successful Duo approval, CyberArk performs primary authentication. If IIS integrated Windows authentication is configured on the PVWA server, then the logged-in Windows credentials are used. If you are not using Windows authentication, the user must enter their RADIUS or LDAP Vault authentication password (whichever method you specify when configuring Duo on the CyberArk server).

This page provides an overview of the Duo WebSDK installation process on your CyberArk PWVA deployment. The detailed instruction steps you will need to follow are in the CyberArk PVWA Authentication via Duo WebSDK document available for download from the CyberArk Support Vault (as described in step 4 in the next section.)

The Duo WebSDK integration works with PAS versions 9.8 and higher. Note that additional configuration is required for the login page to work on v10, as described in the CyberArk PVWA Authentication via Duo WebSDK document.

If you have issues configuring or using the CyberArk Duo WebSDK integration on your Password Vault deployment, please contact CyberArk's technical support.

First Steps

1. Sign up for a Duo account.

2. Log in to the Duo Admin Panel and navigate to Applications → Protect an Application.

3. Locate the entry for CyberArk Privileged Account Security with a protection type of "2FA" in the applications list. Click Protect to the far-right to configure the application and get your integration key, secret key, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications with Duo and additional application options.

4. Download the Duo WebSDK integration and the "Duo MFA Web SDK Authentication Integration Guide" instructions from the CyberArk Marketplace. You may need to register for Marketplace access first. Please direct any questions about Marketplace registration or downloads directly to CyberArk support.

5. Create an application key for use later when configuring the CyberArk WebSDK integration. The application key is a string that you should generate and keep secret from Duo. It should be at least 40 characters long. You can generate a random string in Python with:

   import os, hashlib
    print hashlib.sha1(os.urandom(32)).hexdigest()

Duo Universal Prompt

The Duo Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.

Universal Prompt	Traditional Prompt

For CyberArk Privileged Account Security applications created before March 2024, migration to Universal Prompt is a three-step process:

1. Install an update for the CyberArk Privileged Account Security application, which implements a redirect to Duo during authentication to support the Universal Prompt.
2. Authenticate with Duo 2FA using the updated application so that Duo makes the Universal Prompt activation setting available in the Admin Panel. This first authentication after updating shows the traditional Duo prompt in a redirect instead of an iframe.
3. From the Duo Admin Panel, activate the Universal Prompt experience for users of that Duo CyberArk Privileged Account Security application if the traditional prompt is still selected. Once activated, all users of the application see the Duo Universal Prompt in a redirect.

If you created your CyberArk Privileged Account Security application before March 2024, it's a good idea to read the Universal Prompt Update Guide for more information, about the update process and the new login experience for users, before you activate the Universal Prompt for your application.

New CyberArk Privileged Account Security Applications

When you install the latest version of CyberArk PAS you're ready to use the Universal Prompt. CyberArk Privileged Account Security applications created after March 2024 have the Universal Prompt activated by default. If you're configuring CyberArk Privileged Account Security now, proceed with the installation instructions in this document.

The "Universal Prompt" area of the application details page shows this application as "Activation complete", with these activation control options:

• Show traditional prompt: Your users experience Duo's traditional prompt via redirect when logging in to this application.
• Show new Universal Prompt: (Default) Your users experience the Universal Prompt via redirect when logging in to this application.

Existing CyberArk Privileged Account Security Applications

CyberArk PAS needs a software update from CyberArk installed to support the Universal Prompt. The "Universal Prompt" section reflects this status as "Update required" today. To update the CyberArk Privileged Account Security Duo application to a newer version, follow the update directions below.

Once a user authenticates to CyberArk PAS via the updated Duo application, the "Universal Prompt" section of the CyberArk Privileged Account Security application page reflects this status as "Ready to activate", with these activation control options:

• Show traditional prompt: (Default) Your users experience Duo's traditional prompt via redirect when logging in to this application.
• Show new Universal Prompt: Your users experience the Universal Prompt via redirect when logging in to this application.

In addition, the "Integration key" and "Secret key" property labels for the application update to "Client ID" and "Client secret" respectively. The values for these properties remain the same.

Activate Universal Prompt

Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.

Enable the Universal Prompt experience by selecting Show new Universal Prompt if the traditional prompt is still selected, and then scrolling to the bottom of the page to click Save.

Once you activate the Universal Prompt, the application's Universal Prompt status shows "Activation complete" here and on the Universal Prompt Update Progress report.

Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt. However, this will still deliver the Duo prompt via redirect, not in an iframe. Keep in mind that support for the traditional Duo prompt ended for the majority of applications in March 2024.

Universal Update Progress

Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.

Install the Duo Integration on the PVWA Server

Before you begin, you should have obtained the Duo Security WebSDK Authentication zip file and the Duo MFA Web SDK Authentication Integration Guide document from the CyberArk Marketplace as described in First Steps - step 4 above.

Review the Duo MFA WebSDK document from CyberArk first and determine if you want to use integrated Windows Authentication (IWA) in IIS for access to PWVA, or if you want to require RADIUS or LDAP authentication in PWVA after Duo authentication.

You will also need Remote Desktop or console access to your Password Vault server, and administrator access to Password Vault Web Access via your browser.

1. Copy the Duo Security WebSDK Authentication.zip file to your CyberArk Password Vault Web Access server and extract the contents.

2. Refer to the Duo MFA Web SDK Authentication Integration Guide document you downloaded earlier for detailed installation and configuration instructions. Follow the directions to deploy Duo in your CyberArk Password Vault environment.

   1. Copy files from the downloaded zip into the PasswordVault folders.
   2. Define the Duo custom authentication method in PWVA.
   3. Edit the PWVA web.config file to add the Duo integration key, secret key, and API hostname you copied from the Duo Admin Panel, the application key you generated, and to reference the "DuoSecurity" IIS module.
   4. Change the IIS authentication method for the PasswordVault application as required (this depends on whether or not you chose to use IWA).
   5. Update the "Local Internet" zone settings to include the PWVA site with automatic logon on all client systems if using IWA.
   6. If not using IWA, configure the additional RADIUS or LDAP authentication method.

3. If you are using Password Vault version 10, be sure to change the logon page from v10 to v9 as specified in the "USING THE CYBERARK V10 INTERFACE" section of the Duo MFA Web SDK Authentication Integration Guide document.

For additional information about adding the Duo Web authentication method, including IIS instructions for Windows integrated authentication, please refer to the CyberArk PVWA Authentication via Duo WebSDK document available for download from the CyberArk Support Vault, as well as the "Defining Authentication Methods in PVWA", "Windows Authentication", "RADIUS Authentication", "LDAP Authentication" sections in the "CyberArk Privileged Account Security Installation Guide".

Test your Setup

Navigate to the Privileged Account Security web login page and click the new Duo login option (this name matches the "DisplayName" you specified when configuring the Duo authentication method).

In this example, the Duo authentication method was configured to use LDAP authentication so PVWA must prompt for a username to pass to the Duo service.

Next, complete Duo enrollment or authentication.

After successful Duo authentication, PVWA prompts for the LDAP primary password. Note that the username is the same one originally provided to Duo, so the Duo username and PVWA usernames should match.

If you're using IIS's integrated Windows authentication for PVWA logins, Windows will automatically provide a username to the Duo service for secondary authentication and perform primary authentication after Duo using the logged in Windows credentials.

Update CyberArk

If you are running versions of the Duo MFA Web SDK Authentication below 2.0, you'll need to upgrade to version 2.0 or later to be able to use the Universal Prompt. Download the Duo MFA Web SDK Authentication zip file from the CyberArk Marketplace and follow the instructions provided in the downloaded zip file to upgrade.

After upgrading, authenticate once with the updated application, which will show the traditional Duo Prompt in a redirect instead of the iframe. After that you can activate Universal Prompt for your application.

Troubleshooting

If you have any issues with installing the CyberArk WebSDK integration, configuring your Password Vault authentication methods, or questions about IIS integrated authentication for PVWA, please contact CyberArk support. See the "DEBUGGING" section in the CyberArk PVWA Authentication via Duo WebSDK document.

Additionally, you may find the "CyberArk Privileged Account Security Installation Guide" documentation available from CyberArk helpful.

Need some help with Duo authentication? Take a look at our Knowledge Base articles or Community discussions. For further assistance, contact Duo Support.