SSO AuthenticationSAML 2.0
Duo Security
Configure Duo Single Sign-On as a SAML 2.0 identity provider for Safeguard.
Duo Security
Example values
The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.
In Duo Security — the SAML app / SP details (you enter these at the IdP):
| Field | Example value |
|---|---|
| ACS URL (Duo calls this the Assertion Consumer Service (ACS) URL) | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde/broker/duo/endpoint |
| SP Entity ID / Audience | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde |
| Name ID format | EmailAddress |
email attribute | the signed-in user's email (Duo's Email address field, sent as a SAML Response attribute named email) |
In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):
| Field | Example value |
|---|---|
| Alias | duo |
| Display Name | Sign in with Duo Security |
| SSO Service URL | https://sso-<id>.sso.duosecurity.com/saml2/sp/<integration-key>/sso |
| Entity ID | https://sso-<id>.sso.duosecurity.com/saml2/sp/<integration-key>/metadata |
| X.509 Certificate | the PEM block below |
-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE------ In the Duo Admin Panel, go to Applications → Protect an Application, and protect Generic SAML Service Provider (via Duo Single Sign-On).
- Under SAML Response, set Entity ID to the SP Entity ID Safeguard shows after Save, and Assertion Consumer Service (ACS) URL to the ACS URL Safeguard shows after Save.
- Set NameID format to Email Address and NameID value to Email address.
- Under SAML Response → Attributes, add an attribute named
emailmapped to Email address — separate from the NameID setting above. - Copy the Single Sign-On URL, Entity ID, and Certificate from the Metadata section.
- In Safeguard, click Add Provider → SAML 2.0 → Duo Security, and enter those three values.
- Confirm an Authentication Source (your upstream directory — AD, Azure, Google, etc.) is linked to this Duo SSO application.
- Click Test in Safeguard to confirm.
Common errors: an "AuthSource error" at Duo means the Duo SSO Authentication Source isn't linked to this application yet — link it under the application's settings before testing.