Skip navigation
Documentation

Duo Universal Prompt Update Guide - Public Preview

Last Updated: July 29th, 2021

Contents

Duo Universal Prompt is in Public Preview. Please contact us if you have any issues or feedback about your experience using the Universal Prompt.

Introducing the Universal Prompt

Duo's next-generation authentication experience, the Universal Prompt, provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.

Universal Prompt Traditional Prompt
 Duo Push in Universal Prompt  Duo Push in Traditional Prompt

Duo Universal Prompt will be generally available for in-scope applications that display the Duo traditional prompt today in browsers and select thick-client applications that use single sign-on.

Future updates during the Universal Prompt preview period will extend the new experience to first-time user enrollment of authentication devices in Duo, self-service management of authentication options, and endpoint security posture and management verification functionality.

Learn more about the design process for the Universal Prompt on the Duo Blog.

Your complete migration from traditional Duo prompt to Universal Prompt will be a two-step process:

  1. (Limited Current Availability) Update the application to support the Universal Prompt. This may involve installing a software upgrade provided by Duo or one of our technology partners on your application server, or making a configuration change in the admin console of a cloud-hosted application where you use Duo.

    Duo and our partners are working to make these application updates available throughout the Universal Prompt preview.

  2. (Available as Public Preview) In the Duo Admin Panel, enable the Universal Prompt experience for users of that application after the application has been updated with Universal Prompt support.

Watch the Duo Blog for future updates about the Duo Universal Prompt.

Public Preview Details

The Universal Prompt preview does not have full feature partity with the traditional prompt yet. We'll be adding additional functionality and features to the Universal Prompt experience throughout the preview period.

Available Now

Future Updates

Features and functionality in active development:

We'll let you know when the Universal Prompt experience includes these features.

Browser Support

The Universal Prompt supports Chrome (Desktop and Mobile), Firefox, Safari (Desktop and Mobile), Edge, and Internet Explorer. Not all browsers support all Duo authentication methods, so for the widest compatibility we recommend Chrome.

Check the table below for supported browser versions and Duo login option compatibility. Duo's support for the minimum browser version includes Duo Push, passcode, and phone call authentication options. Other login options, like Touch ID, may require a different browser or a newer minimum browser version, as noted in the table.

Browser Minimum Supported
Version
Security Keys
Minimum Version
Touch ID
Minimum Version
Chrome 38 70 70
Safari 9 13 on macOS
13.4 on iOS
Not supported
Firefox 47 60 Not supported
Edge 17 79 Not supported
Internet Explorer 11 Not supported Not supported

While other browsers may work with the Universal Prompt, we actively test and support the browsers and minimum versions listed in the table.

When you log in Duo checks your current browser or client compatibility with the Universal Prompt. If your browser or client is not compatible, Duo will show you the traditional prompt experience instead.

Changes to Support the Universal Prompt

We've made some underlying changes to support the Universal Prompt user experience.

Move Away from iFrames

Duo delivers the traditional prompt via an inline frame (or "iFrame") using our v2 WebSDK, which means that the Duo Prompt web content is embedded within a web page hosted by the protected application.

Duo Traditional Prompt in an iFrame

Duo Prompt iFrame Experience Example

When planning for the Universal Prompt it soon became apparent that switching from use of inline frames to a "frameless" approach, derived from OIDC standards, would provide enhanced stability and compatibility across our web application integrations, and lay a foundation for future improvements to Duo authentication and device trust.

The most obvious difference between traditional iFrame Duo 2FA applications and updated frameless Duo 2FA applications is that instead of showing the Duo Prompt within a page hosted by the application, the application will instead redirect to a page hosted by Duo at duosecurity.com to show the Duo Prompt, and then redirect back to the protected application after the user completes two-factor authentication. The redirect page shows either the Universal Prompt or the traditional prompt; dependent on the Universal Prompt activation status for that appplication.

Duo Universal Prompt in a Redirect

Duo Prompt Frameless Experience Example

Duo Traditional Prompt in a Redirect

Duo Prompt Frameless Experience Example

To achieve the "iFrame to frameless" migration, we've updated the Duo Web SDK with this new technical design as version 4.0, and have begun using this updated v4 SDK to bring the Universal Prompt to Duo's own web application integrations such as 2FA for Confluence, Duo Single Sign-On apps, and Duo Network Gateway, to name just a few.

Customers and technical partners should make use of the Duo Web v4 SDK and OIDC standards-based API today to begin the process of updating developed Duo integrations to support the Universal Prompt.

Read more about the new developer tooling supporting the Universal Prompt on the Duo Blog.

Renamed Application Fields

Each Duo application you create has a unique identifier and an associated key used to sign or verify the two-factor authentication request. These are called the "Integration Key" or ikey and the "Secret key" or ikey.

We've relabeled these two pieces of application information to better align with the OAuth 2.0 specification. These values are now known as the "Client ID" or client_id and the "Client secret" or client_secret for applications that support Universal Prompt.

The names may have changed, but the values for any existing integrations remain the same.

Universal Prompt Application Scope

As mentioned, Duo's Universal Prompt supports applications that show the Duo Prompt and device management as a web page today, but with some exceptions. The following Duo 2FA offerings are not in scope for the Universal Prompt:

We'll continue to show and support the iFrame-based Duo Prompt for these applications as we explore alternate configurations that provide a path forward, such as migrating from RADIUS authentication to Duo Single Sign-On SAML implementations.

Application Updates

As Duo adds support for the Universal Prompt to applications, you'll see a new section on the details page of the application indicating your progress toward the Universal Prompt for that application.

Waiting on App Provider

Most on-premises applications will require that you install a software update with the necessary changes to support the Universal Prompt on your web application server. This software update may be supplied by Duo or by our technical partners, depending on who developed the integration. Users of cloud-hosted SaaS services may need to make a configuration change to your account to enable the Universal Prompt support, at the direction of Duo or the Duo partner that operates the service.

The status shows "Waiting on App Provider" when viewing the Universal Prompt information for an application that has no update available. Contact the application provider (which may be Duo, or one of Duo's partners) to request Duo Universal Prompt support.

Your users continue to see the current Duo prompt experience until an application update becomes available, you apply the update, and you then activate the Universal Prompt.

Application waiting on update availability

Universal Prompt Info - Update Not Yet Available

App Update Ready

When Universal Prompt support becomes available for a given Duo integration, whether maintained by Duo or by a partner (or by you, our customer, for any Duo applications you may have developed in-house), the Universal Prompt details on that application's properties page in the Duo Admin Panel will indicate availability of an application software update as "App Update Ready", with a link to update instructions.

Your users continue to see the current Duo prompt experience until you apply the update, and then activate Universal Prompt for that application.

Application update available

Universal Prompt Info - Update Available

New Prompt Ready

Once the necessary updates have been applied to an application, the Universal Prompt details show that the application is ready for the new prompt experience. The status "New Prompt Ready" for updated applications reflects that you've done all the work required to update your application for the Universal Prompt.

Use the activation control options to determine the login experience for your users:

  • Show traditional prompt: (Default) Your users experience Duo's traditional prompt when logging in to this application.

  • Show new Universal Prompt: Your users experience the Universal Prompt when logging in to this application.

Your users continue to see the current Duo prompt experience until you activate the Universal Prompt.

Application ready for Universal Prompt

Universal Prompt Info - Application Ready for Universal Prompt

Update Complete

Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.

Enable the Universal Prompt experience for an application by selecting Show new Universal Prompt in the activation options, and then scrolling to the bottom of the page to click Save.

Once you activate the Universal Prompt, the application's Universal Prompt status shows "Update Complete" here and on the Universal Prompt Update Progress report.

Application using Universal Prompt

Universal Prompt Info - Universal Prompt Activation Complete

Universal Update Progress

Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications in-scope for Universal Prompt support.

Application Update Instructions

As Universal Prompt support becomes available for Duo applications, you'll find links to the application instructions here.

  • Microsoft Azure Active Directory: The prompt for this application is hosted within Duo's cloud service, so we've already made the application updates necessary to support the Universal Prompt experience. No further action needed at this time.

  • Duo Single Sign-on: Duo Single Sign-On is a SAML identity provider hosted in Duo's cloud service. Any SSO service provider application that uses Duo Single Sign-On is ready for the Universal Prompt, including Duo Central. No further action needed at this time.

  • Duo Web SDK 4.0: Python, Java, Go, and PHP client libraries for adding Duo Prompt to your applications. Update existing Web SDK v2 applications. These clients support both the "Web SDK" and "Partner WebSDK" applications.

  • Duo OIDC standards-based Auth API: An API for adding the Duo Prompt to your application in any language. Update existing Web SDK v2 applications. Supported by both the "Web SDK" and "Partner WebSDK" applications.

  • Confluence: Upgrade to the Duo v2 plugin.

  • Jira: Upgrade to the Duo v2 plugin.

  • Duo Network Gateway: Upgrade to v1.5.10 or later and apply the "Enable Frameless" option for each of your Web and SSH applications in the Network Gateway admin console.

  • PingFederate: Install the Duo Security Integration Kit 3.0 available from Ping.

  • CAS (Central Authentication Service): Upgrade to CAS 6.3.4 or later and then configure the Duo Security multifactor provider.

  • Shibboleth: Upgrade to Shibboleth 4.1 or later and then configure the DuoOIDCAuthnConfiguration authentication plugin.

  • Additional applications to follow...

Track Universal Prompt Update Progress

The Universal Prompt Update Progress report, accessible at ReportsUniversal Prompt Progress in the Duo Admin Panel, acts as a centralized location for determining which of your applications have the new prompt active, monitoring updates to the availability of required software updates needed to support the Universal Prompt, and viewing which applications have the necessary update in place.

When viewing the status information for a given application, we show you the number of users who have authenticated to that application in the past 30 days under the application's name.

Universal Prompt Update Progress Report

Use the tabs to filter the report views by your application's Universal Prompt readiness status:

  • All: Shows the Universal Prompt status for all in-scope applications.
  • App Update Ready: Applications which need an available software update to frameless prompt delivery as a prerequsite to Universal Prompt.
  • New Prompt Ready: Applications updated to frameless prompt delivery and ready for Universal Prompt activation. Click the Activate new prompt for users toggle to activate the new prompt experience.
  • Update Complete: Users of this application receive the Universal Prompt.
  • Waiting on App Provider: Applications without an available update to support the Universal Prompt.

Troubleshooting

Need some help? Take a look at our Universal Prompt Knowledge Base articles. If you're having issues applying the software updates to support Universal Prompt or require other technical assistance, contact Support.

Please also contact us if you have any feedback about your organization's experience activating and using the Universal Prompt during the public preview.