LDAP

Supported Devices

Duo can be integrated with most devices and systems that support LDAP for authentication.

This configuration doesn't support inline self-service enrollment. You'll need to create your users in Duo ahead of time using one of our other enrollment methods, like directory sync or CSV import. Read the enrollment documentation to learn more.

First Steps

To integrate Duo with your LDAP device, you will need to install a local proxy service on a machine within your network. Before proceeding, you should locate (or set up) a system on which you will install the Duo Authentication Proxy. The proxy supports Windows and Linux systems (in particular, we recommend Windows Server 2012 R2 or later, Red Hat Enterprise Linux 6 or later, CentOS 6 or later, or Debian 6 or later).

Then you'll need to:

1. Sign up for a Duo account.
2. Log in to the Duo Admin Panel and navigate to Applications.
3. Click Protect an Application and locate LDAP Proxy in the applications list. Click Protect this Application to get your integration key, secret key, and API hostname. See Getting Started for help.

Install the Duo Authentication Proxy

The Duo Authentication Proxy can be installed on a physical or virtual host. We recommend a system with at least 1 CPU, 200 MB disk space, and 4 GB RAM (although 1 GB RAM is usually sufficient).

Configure the Proxy

After the installation completes, you will need to configure the proxy.

The Duo Authentication Proxy configuration file is named authproxy.cfg, and is located in the conf subdirectory of the proxy installation. With default installation paths, the proxy configuration file will be located at:

The configuration file is formatted as a simple INI file. Section headings appear as:

[section]

Individual properties beneath a section appear as:

name=value

The Authentication Proxy may include an existing authproxy.cfg with some example content. For the purposes of these instructions, however, you should delete the existing content and start with a blank text file. We recommend using WordPad or another text editor instead of Notepad when editing the config file on Windows.

Configure the Proxy for Your Primary Authenticator

In this step, you'll set up the Proxy's primary authenticator — the system which will validate users' existing passwords. The primary authentication source for Duo LDAP must be another LDAP directory. In most cases, this means configuring the Proxy to communicate with Active Directory.

Active Directory

To use Active Directory as your primary authenticator, add an [ad_client] section to the top of your config file. Add the following properties to the section:

Required

search_dn=DC=example,DC=com

Optional

security_group_dn=CN=DuoVPNUsers,OU=Groups,DC=example,DC=com

For example:

[ad_client]
host=1.2.3.4
host_2=1.2.3.5
service_account_username=duoservice
service_account_password=password1
search_dn=DC=example,DC=com
security_group_dn=CN=DuoVPNUsers,OU=Groups,DC=example,DC=com

For advanced Active Directory configuration, see the full Authentication Proxy documentation.

Configure the Proxy As a LDAP Server

Next, you need to set up the Authentication Proxy to handle LDAP authentication requests. To do so, create a ldap_server_auto section with the following properties:

Required

Optional

A completed config file, using Active Directory as the primary authenticator, should look something like:

[ad_client]
host=1.2.3.4  
service_account_username=duoservice  
service_account_password=password1  
search_dn=cn=Users,dc=example,dc=com  

[ldap_server_auto]
client=ad_client
ikey=DIXXXXXXXXXXXXXXXXXX
skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
api_host=api-XXXXXXXX.duosecurity.com
failmode=safe  
ssl_key_path=ldap_server.key  
ssl_cert_path=ldap_server.pem

Make sure to save your configuration file when done.

Start the Proxy

net start DuoAuthProxy

net stop DuoAuthProxy & net start DuoAuthProxy

# /opt/duoauthproxy/bin/authproxyctl start

# /opt/duoauthproxy/bin/authproxyctl status

# /opt/duoauthproxy/bin/authproxyctl restart

If you modify your authproxy.cfg configuration after initial setup, you'll need to stop and restart the Duo Authentication Proxy service or process for your change to take effect.

Configure Your LDAP Client(s)

Once the proxy is up and running, you need to configure your LDAP clients to use it for authentication.

In your clients' settings, set the LDAP server to the IP address or host name of your Duo authentication proxy. Set the LDAP server port to 636 to secure the connection with SSL.

The service user name and service password configured on the LDAP client(s) should be the same as it would be if you were configured to connect directly to the AD or LDAP server.

If your clients allow you to configure the LDAP timeout, set them to values such that the clients will not give up for at least 60 seconds. This is necessary if your users choose to use Duo's out-of-band factors (phone callback, push) to log in, as the authentication proxy will not be able to respond to a LDAP authentication request until the user responds to the authentication challenge. If your clients do not allow you to configure the LDAP timeout behavior, then your users may be unable to authenticate with Duo's out-of-band factors.

Test Your Setup

To test your setup, attempt to log in to your newly-configured system as a user enrolled in Duo with an authentication device.

When you enter your username and password, you will receive an automatic push or phone callback.

Alternatively you can add a comma (",") to the end of your password, followed by a Duo passcode. For example, given a username 'bob', with password 'password123' and a Duo passcode '123456', you would enter:

username: bob
password: password123,123456

In addition, you may also enter the name of an out-of-band factor in lieu of a passcode. You may choose from the following factor names:

Returning to the previous example, if you wanted to use Duo Push (rather than a passcode) to authenticate, you would enter:

username: bob
password: password123,push

You can also specify a number after the factor name if you have more than one device enrolled (as the automatic push or phone call goes to the first capable device attached to a user). So you can enter phone2 or push2 if you have two phones enrolled and you want the authentication request to go to the second phone.

Troubleshooting

Need some help? Take a look at our LDAP Knowledge Base articles or Community discussions. For further assistance, contact Support.

Network Diagram

1. Primary authentication initiated to application or service
2. Application or service send authentication request to Duo Security’s authentication proxy
3. Primary authentication using Active Directory
4. Duo authentication proxy connection established to Duo Security over TCP port 443
5. Secondary authentication via Duo Security’s service
6. Duo authentication proxy receives authentication response
7. Application or service access granted