Zoomed Image
USA
800 691 9120
UK
01225 704844

SSO with DUO Option 1 – Duo Generic OIDC Relying Party

xAssets Configuration Guide
Single Sign On

SSO with DUO Option 1 – Duo Generic OIDC Relying Party

This page provides step-by-step instructions for configuring Duo Security as the single sign-on provider for xAssets using the "Generic OIDC Relying Party" application. This is the preferred Duo option because Duo handles the entire authentication flow, collecting both the username/password and processing the two-factor authentication (2FA) workflow.

For the alternative Duo option where xAssets collects the username before handing off to Duo, see SSO with Duo Option 2.

Prerequisites

  • A Duo Security account with administrator access
  • The "Generic OIDC Relying Party -- Single Sign-On" application available in your Duo plan
  • Configuration-level access to xAssets
  • The SSOADMIN account created and in the Admins group (see SSO Introduction and Setup)

Step 1: Enable the OIDC Application in Duo

  1. Log in to the Duo Admin Panel
  2. Navigate to Applications > Protect an Application
  3. Find and enable the Generic OIDC Relying Party -- Single Sign-On application

Duo Generic OIDC Relying Party application

Step 2: Configure OIDC Scopes

  1. In the Duo Admin Panel, click into the application
  2. Navigate to OIDC Response > Scopes
  3. Ensure the following scopes are enabled: openid, profile, and email

Duo OIDC scopes configuration

Step 3: Set the Redirect URL

  1. In the application configuration, set the Sign in Redirect URLs to:
https://yourinstancename.hosted.xassets.net/a.aspx

Replace yourinstancename with your actual xAssets instance name.

  1. Click Save at the bottom of the page

Step 4: Note the Connection Details

From the Duo Admin Panel application page, note the following values:

  • SSO Domain -- the domain part of your Duo SSO addresses, in the format sso-xxxxxxxx.sso.duosecurity.com. You can find this in any of the URLs shown on the Generic OIDC Relying Party screen.

Screenshot

  • Client ID:

Screenshot

  • Client Secret:

Duo client secret field

Step 5: Configure xAssets

  1. Log in to xAssets as a configuration-level user
  2. Navigate to Admin > Settings
  3. Set the AUTHENTICATIONTYPE SpecialOption to DUO GENERIC

Step 6: Create a Credential Pack in xAssets

  1. Navigate to Discover > Prepare > Credentials
  2. Click Create Credentials
  3. Configure the credential pack as follows:
Field Value
Credential Type Named Credentials
Collection Server Application Server
Pack Name DUOGENERIC-SSO
Domain Name The Duo SSO Domain (e.g., sso-xxxxxxxx.sso.duosecurity.com)
Username The Client ID from Step 4
Password The Client Secret from Step 4
  1. Save the credential pack and verify it appears when you refresh the credentials list

Step 7: Test the Login

  1. Open a new private/incognito browser window
  2. Navigate to your xAssets URL
  3. Duo should present its login page, collecting username, password, and 2FA
  4. After successful authentication, you should be returned to xAssets and logged in

If the login fails, see Troubleshooting. To log in without Duo for troubleshooting:

https://myinstance.clustername.xassets.net/a.aspx?logondirect=direct

Note: Other options on the Duo configuration page may be changed, but the settings described above represent the tested configuration for the xAssets integration with Duo.