Duo Security's two-factor authentication secures Shibboleth identity provider logins, offering inline user enrollment, self-service device management, and support for a variety of authentication methods — such as passkeys and security keys, Duo Push, or Verified Duo Push — in the Duo Universal Prompt.
Shibboleth versions 3.3 and later include a supported Duo authentication plugin (DuoAuthnConfiguration). Shibboleth 4.1 and later use a new plugin mechanism, with an updated Duo plugin (DuoOIDCAuthnConfiguration) available which supports the Duo Universal Prompt.
The Duo Shibboleth authentication plugin performs a second factor authentication after primary authentication, so you will need a working service provider configured with Shibboleth before continuing.
This application communicates with Duo's service on SSL TCP port 443.
Firewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability. If your organization requires IP-based rules, please review Duo Knowledge Base article 1337.
Effective June 30, 2023, Duo no longer supports TLS 1.0 or 1.1 connections or insecure TLS/SSL cipher suites. See Duo Knowledge Base article 7546 for additional guidance.
Before starting:
Previously, the Client ID was called the "Integration key" and the Client secret was called the "Secret key".
The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!
The new Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.
| Universal Prompt | Traditional Prompt |
 |
 |
Migration to Universal Prompt for your Shibboleth application is a three-step process:
Before you activate the Universal Prompt for your application, it's a good idea to read the Universal Prompt Update Guide for more information about the update process and the new login experience for users.
When you install the latest version of Shibboleth you're ready to use the Universal Prompt. If you're configuring Shibboleth now, proceed with the installation instructions in this document.
The "Universal Prompt" area of the application details page shows that this application is "New Prompt Ready", with these activation control options:
Shibboleth needs a software update installed to support the Universal Prompt. The "Universal Prompt" section of your existing Shibboleth application reflects this status as "App Update Ready". To update Shibboleth application to a newer version, follow the update directions below.
Once a user authenticates to Shibboleth via the updated Duo application, the "Universal Prompt" section of the Shibboleth application page reflects this status as "New Prompt Ready", with these activation control options:
In addition, the "Integration key" and "Secret key" property labels for the application update to "Client ID" and "Client secret" respectively. The values for these properties remain the same.
Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.
Enable the Universal Prompt experience by selecting Show new Universal Prompt, and then scrolling to the bottom of the page to click Save.
Once you activate the Universal Prompt, the application's Universal Prompt status shows "Update Complete" here and on the Universal Prompt Update Progress report.
Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt. However, this will still deliver the Duo prompt via redirect, not in an iframe.
Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications in-scope for Universal Prompt support. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.
Shibboleth 4.1 is the first release with support for Duo Universal Prompt. After installing Shibboleth 4.1 or later, configure the DuoOIDCAuthnConfiguration authentication plugin within Shibboleth, using the application information from the First Steps instructions above.
If you are running Shibboleth versions below 4.1, you'll need to upgrade your Shibboleth installation to version 4.1 or later to be able to use the Universal Prompt. Consult the Shibboleth upgrade documentation for more information about planning your upgrade, and use the DuoOIDCAuthnConfiguration authentication plugin instructions to configure Duo after your Shibboleth upgrade.
After upgrading, authenticate once with the DuoOIDCAuthnConfiguration authentication plugin, which will show the traditional Duo Prompt in a redirect instead of the iframe. After that you can activate Universal Prompt for your application.
Need some help? Take a look at the Shibboleth Frequently Asked Questions (FAQ) page or try searching our Shibboleth Knowledge Base articles or Community discussions. For further assistance, contact Support.
