Skip navigation
Documentation

Duo Universal Prompt Update Guide

Last Updated: October 22nd, 2020

Contents

Introducing the Universal Prompt

Duo's next-generation authentication experience, the Universal Prompt, is coming to web-based applications that display the current Duo Prompt in browsers and select thick-client applications that use single sign-on. The Universal Prompt experience will deliver an updated look and feel designed to make it easier than ever for end-users to to enroll an authentication device in Duo, log in to Duo-protected services, and manage their devices.

Duo Push in the Universal Prompt

Learn more about the design process for the Universal Prompt on the Duo Blog.

When the Universal Prompt becomes available, migration will be a two-step process:

  • Update the application to support the Universal Prompt. This may involve installing a software upgrade provided by Duo or one of our technology partners on your application server, or making a configuration change in the admin console of a cloud-hosted application where you use Duo.
  • Enable the Universal Prompt experience for users of that application.

Watch the Duo Blog for future updates about the Duo Universal Prompt.

Changes to Support the Universal Prompt

The current Duo Prompt is delivered via an inline frame (or "iFrame") using our WebSDK, which means that the Duo Prompt web content is embedded within a web page hosted by the protected application.

Duo Prompt iFrame Experience Example

When planning for the Universal Prompt it soon became apparent that switching from use of inline frames to a "frameless" approach, derived from OIDC standards, would provide enhanced stability and compatibility across our web application integrations, and lay a foundation for future improvements to Duo authentication and device trust.

The most obvious difference between today's iFrame Duo 2FA applications and updated frameless Duo 2FA applications is that instead of showing the Duo Prompt within a page hosted by the application, the application will instead redirect to a page hosted by Duo at duosecurity.com to show the Duo Prompt, and then redirect back to the protected application after the user completes two-factor authentication.

Duo Prompt Frameless Experience Example

To achieve the "iFrame to frameless" migration, we've updated the Duo Web SDK with this new technical design as version 4.0, and will then utilize the updated v4 SDK to bring the Universal Prompt to Duo's own web application integrations such as 2FA for Confluence, Duo Authentication for AD FS, and Duo Network Gateway, to name just a few.

Customers and technical partners can access the Duo Web v4 SDK and OIDC standards-based API today to begin the process of updating developed Duo integrations to support the Universal Prompt.

Read more about the new developer tooling supporting the Universal Prompt on the Duo Blog.

Universal Prompt Application Scope

As mentioned, Duo's Universal Prompt is coming to applications that show the Duo Prompt as a web page today, but with some exceptions. These Duo 2FA offerings are not in scope for the Universal Prompt:

We'll continue to support the iFrame Duo Prompt for these applications as we explore alternate configurations that provide a path forward, like migrating from RADIUS authentication to Duo Single Sign-On SAML implementations.

Application Updates

As Duo adds support for the Universal Prompt to applications, you'll see a new section on the details page of the application indicating your progress towards the Universal Prompt for that application.

Most on-premises applications will require that you install a software update with the necessary changes to support the Universal Prompt on your web application server. This software update may be supplied by Duo or by our technical partners, depending on who developed the integration. Users of cloud-hosted SaaS services may need to make a configuration change to your account to enable the Universal Prompt support, at the direction of Duo or the Duo partner that operates the service.

Application waiting on update availabiility

Universal Prompt Info - Update Not Yet Available

When Universal Prompt support becomes available for a given Duo integration, whether maintained by Duo or by a partner (or by you, our customer, in the case of Duo application you may have developed in-house), the Universal Prompt details on that application's properties page in the Duo Admin Panel will indicate availability of an application software update, with a link to update instructions.

Application update available

Universal Prompt Info - Update Available

Once the necessary updates have been applied to an application, the Universal Prompt details show that the application is ready for the new prompt experience once released.

Application ready for Universal Prompt

Universal Prompt Info - Application Updated

Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications in-scope for Universal Prompt support.

Application Update Instructions

As Universal Prompt support becomes available for Duo applications, you'll find links to the application instructions here.

Universal Prompt Enablement

When the Universal Prompt end-user experience becomes available, you'll be able to activate it for a single Duo application from the Universal prompt area of the application's page, or enable it for multiple applications from the Universal Prompt Update Progress report.

Until that time, the "Activate Universal Prompt" control shall remain inactive.

Track Universal Prompt Update Progress

The Universal Prompt Update Progress report, accessible at ReportsUniversal Prompt Progress in the Duo Admin Panel, acts as a centralized location for determining which of your applications will be capable of supporting the new prompt, monitoring updates to the availability of required software updates needed to support the Universal Prompt, and viewing which applications have the necessary update in place. Later, when the Universal Prompt becomes available, the progress report will show which applications are ready for you to activate the new prompt and which applications have already completed the full Universal Prompt UI migration.

Universal Prompt Update Progress Report