Zoomed Image
USA
800 691 9120
UK
01225 704844

SSO with DUO Option 2 – Duo Web API

xAssets Configuration Guide
Single Sign On

SSO with DUO Option 2 – Duo Web API

This page provides step-by-step instructions for configuring Duo Security as the single sign-on provider for xAssets using the "Web SDK" (Web API) application. With this option, xAssets collects the username via a form before passing control to Duo for two-factor authentication.

From a security perspective this is acceptable, but the Generic OIDC option (Option 1) is preferred because Duo handles the entire authentication flow in that case.

Prerequisites

  • A Duo Security account with administrator access
  • The "Web SDK" application available in your Duo plan
  • Configuration-level access to xAssets
  • The SSOADMIN account created and in the Admins group (see SSO Introduction and Setup)

Step 1: Enable the Web SDK Application in Duo

  1. Log in to the Duo Admin Panel
  2. Navigate to Applications > Protect an Application
  3. Find and enable the Web SDK application

Duo Web SDK application

Step 2: Note the Connection Details

  1. Click into the Web SDK application
  2. Record the following values:

Duo Web SDK credentials

  • Client ID
  • Client Secret
  • API Hostname (in the format api-xxxxxxxx.duosecurity.com)
  1. Set Username normalization to None
  2. Click Save at the bottom of the page

Step 3: Configure xAssets

  1. Log in to xAssets as a configuration-level user
  2. Navigate to Admin > Settings
  3. Set the AUTHENTICATIONTYPE SpecialOption to type 9 -- DUO

Step 4: Create a Credential Pack in xAssets

  1. Navigate to Discover > Prepare > Credentials
  2. Click Create Credentials
  3. Configure the credential pack as follows:
Field Value
Credential Type Named Credentials
Collection Server Application Server
Pack Name DUO-SSO
Domain Name The API Hostname (e.g., api-xxxxxxxx.duosecurity.com)
Username The Client ID from Step 2
Password The Client Secret from Step 2

Screenshot

Duo client ID field

Duo client secret field

  1. Save the credential pack and verify it appears when you refresh the credentials list

Step 5: Test the Login

  1. Open a new private/incognito browser window
  2. Navigate to your xAssets URL
  3. xAssets should display a username form
  4. After entering the username, control passes to Duo for 2FA
  5. After successful authentication, you should be returned to xAssets and logged in

If the login fails, see Troubleshooting. To log in without Duo for troubleshooting:

https://myinstance.clustername.xassets.net/a.aspx?logondirect=direct

Note: Other options on the Duo configuration page may be changed, but the settings described above represent the tested configuration for the xAssets integration with Duo.

Choosing Between Option 1 and Option 2

Feature Option 1 (Generic OIDC) Option 2 (Web API)
Username collection Handled by Duo Handled by xAssets
Password collection Handled by Duo Handled by Duo (after username)
2FA Handled by Duo Handled by Duo
Preferred Yes Fallback if Generic OIDC is unavailable