@@ -0,0 +1,44 @@
1+---
2+id: cisco_duo
3+title: Cisco Duo
4+---
5+
6+Cisco Duo SSO can be configured with OAuth2 Proxy using the OIDC provider.
7+
8+1. Create a new **Generic OIDC Relying Party - Single Sign-On** application in the Duo Admin Portal
9+2. Configure OAuth2 Proxy with the following options:
10+
11+```
12+provider = "oidc"
13+provider_display_name = "Duo SSO"
14+scope = "openid email profile"
15+pass_access_token = true
16+code_challenge_method = "S256"
17+```
18+
19+3. Configure Provider endpoints. Copy the following values from the corresponding fields in the Duo Admin Portal:
20+
21+```
22+# Copy from "Client ID" field
23+client_id = "XXXXXXXX"
24+
25+# Copy from "Client Secret" field
26+client_secret = "XXXXXXXX"
27+
28+# Copy from "Issuer" field
29+oidc_issuer_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx"
30+
31+# Copy from "JWKS URL" field
32+oidc_jwks_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/jwks"
33+
34+# Copy from "Token Introspection URL" field
35+validate_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/token_introspection"
36+
37+# Copy from "UserInfo" field
38+profile_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/userinfo"
39+
40+# Copy from "Token URL" field
41+redeem_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/token"
42+```
43+
44+4. Complete Configuration by filling in any remaining required fields and save your configuration.