This article explains how to configure the SAML SSO integration of Duo with Quickpass. 

Prerequisites

• Duo configured with the user accounts that will be used for accessing Quickpass..
• Primary or Super Role in Quickpass
• Owner or Administrator role for Duo
• All of your Technicians configured in Login Management in Quickpass will need an account in Duo with exactly the same email address.
  Manual - https://support.getquickpass.com/hc/en-us/articles/360040722434-How-to-Setup-Quickpass-Dashboard-Logins
  Bulk Import - https://support.getquickpass.com/hc/en-us/articles/4411037813783-How-to-Bulk-Import-Quickpass-Dashboard-Logins 
  • Note the Primary and Super Roles will still be able to login with their Quickpass Account username and password to allow access in the case of challenges with the SSO.
• Initial configuration steps as per https://support.getquickpass.com/hc/en-us/articles/4419178721559-Setting-up-Dashboard-Logins-for-SSO-SAML-
• Before turning this feature on, log in to your Quickpass account twice - once in a regular browser and once in an incognito/private window or another browser. This is to ensure that you are still logged in to your account if you get locked out in the other window.

Instructions

1. Log in to the Duo Portal. In the left-hand menu, click Applications

    

2. Click Protect an Application at the top of the screen.

   
   
   

3. Search for Generic Service Provider.  Select the 2FA with SSO HOSTED BY Duo by clicking Protect

   
   
   

4. Duo Metadata values to be placed in the Quickpass SAML SSO Setup Screen 
   1. Copy and paste the SSO URLS from Duo to the Quickpass Dashboard to match this image
      
5. Certificate and FingerPrints
   1. Download the Certificate File from the Duo page and save it somewhere temporarily while completing the setup.
      
      1. Open this file in a Text Editor
      2. Copy the contents
      3. Paste the Value into the SAML SSO - Certificate on the Quickpass Dashboard (ensure that there are no leading or trailing spaces before or after the ---- characters)
   2. Copy the SHA-256 Fingerprint from the Duo Setup page and Paste it into the Quickpass Fingerprint box.
      
      
      
   3. On the Quickpass SAML SSO Page click on Save.
6. Duo Service Provider Configuration 
   1. Entity ID
      1. Enter your Quickpass Entity ID value from the Quickpass Dashboard
      2. Paste that value into the Entity ID value on the Duo Service Provider Page
         
   2. Assertion Consumer Service (ACS) URL

      NA or Oceania	https://admin.getquickpass.com/api/auth/sso/login/callback
      EU	https://eu-admin.getquickpass.com/api/auth/sso/login/callback

   3. Default Relay State
      1. Enter your Quickpass Entity ID value from the Quickpass Dashboard
7. Duo SAML Response
   
   1. Configure all of the values to match this image.
      
8. Duo Policy 
   1. These values should be based upon your Duo Sign In Policy for your company.  These values are likely already configured for your Technical Team based upon your configuration of Duo.
      https://duo.com/docs/policy 
9. Duo Settings 
   1. Name - Give the new application a name (we suggest Quickpass SSO)
   2. Other Values will be adjusted based upon the behaviour you want to have happen when the Technician signs into Duo.
   3. Permitted Groups
      1. This can be left blank if you want to allow all of your technicians currently setup with Duo to use the sign in process.
         1. Remember that the Technician Login Roles must also be created in Quickpass Login Management
            https://support.getquickpass.com/hc/en-us/articles/360040722434-How-to-Setup-Quickpass-Dashboard-Logins
      2. You can create a Duo Group if you wish to have a specific set of Technicians that use the SSO to sign in to Quickpass if you wish.
         https://duo.com/docs/using-groups
10. Click the SAVE button at the bottom of the screen,

Testing

1. In another browser or an Incognito/Private Browser Log open the Quickpass Dashboard
   

   NA or Oceania	https://admin.getquickpass.com
   EU	https://eu-admin.getquickpass.com

2. Click Log In with SSO
   
3. Enter the Email Address that is configured for the Login Role Account you are testing - Click Log In
   
4. You should be prompted to sign into the Duo Single Sign-On just as you normally are.
   
5. Sign in with the credentials from the SSO Source you normally use.
6. You should be prompted with whichever Duo Sign In options you configured in the Duo Policy Section
   
7. Approve the Duo Push or other Authentication method used for Duo SSO.
8. Upon approval, the Technician should be logged into the Quickpass Dashboard with the proper account and permissions as assigned in the Quickpass Login Management.

Duo Central

If your team uses Duo Central to keep a list of applications that your Team can use for SSO Sign In.

1. Click Add Tile
2. Select Application Tile
3. Put the checkmark in the box for the Application you configured above.
4. Click Add tile
5. Click the Edit Link
6. Click Add Custom Logo
7. Download this file and use it for the Logo.
   
8. Click Save.
9. You can now use this to directly sign into the Quickpass SSO Login Page.