How to Synchronize Users to Duo from Active Directory

Summary

This video by Matt from Duo Security provides a comprehensive guide on synchronizing users and groups from Active Directory (AD) using the Duo Authentication Proxy on Windows. It covers essential prerequisites, configuration steps, and the process of importing users and groups into Duo. Viewers learn how to set up the authentication proxy, configure directory sync settings, and manage user attributes, with practical demonstrations and best practices highlighted throughout. The video emphasizes the importance of understanding the synchronization process and offers insights into managing enrollment for new users effectively.

Takeaways

• 😀 Ensure you read the Duo documentation for synchronizing users from Active Directory before proceeding.
• 😀 Duo can synchronize users from various directories, including Azure Active Directory and OpenLDAP.
• 😀 Prerequisites for setting up Active Directory sync include knowing the AD server's hostname, port, and base DN.
• 😀 LDAPS or STARTTLS requires an SSL certificate for secure network traffic between the authentication proxy and the domain controller.
• 😀 The Duo Authentication Proxy must be installed on a Windows Server 2012 or later system that is joined to the AD domain.
• 😀 The minimum recommended version of the Duo Authentication Proxy for AD sync is 2.6.0, with updates encouraged.
• 😀 Use the Duo Admin Panel to configure the directory sync after setting up the authentication proxy.
• 😀 You can customize which Active Directory attributes get imported into Duo, but the username attribute is fixed post-sync.
• 😀 The directory sync feature runs automatically twice a day, but manual syncs can be initiated via the Duo Admin Panel.
• 😀 Users created through AD sync must activate their Duo access, which can involve sending enrollment emails if desired.

Q & A

What is the purpose of the Duo Authentication Proxy?

The Duo Authentication Proxy is used to synchronize Duo users and groups from an existing Active Directory domain.

What are the prerequisites for setting up Active Directory synchronization with Duo?

You need to know your Active Directory server hostname or IP address, the port to use, the base DN, and have a Duo administrator account with the necessary roles.

Which Windows Server versions are compatible with the Duo Authentication Proxy?

Windows Server 2012 or later is required, with a recommendation for Windows Server 2012 R2 or later.

What steps should be taken to configure the Duo Authentication Proxy?

You need to download a pre-configured file, edit the current proxy configuration file, save it, and then start the authentication proxy service.

How can you test the connection between the Duo Authentication Proxy and Active Directory?

In the Duo Admin Panel, you can click the test connection link in the authentication proxy section to verify the connection.

What options are available for authentication type in the directory sync configuration?

You can choose from integrated authentication, which requires no additional configuration, or other authentication types as specified in the documentation.

What is the significance of the 'sync attributes' section?

This section allows customization of which Active Directory attribute values are imported to Duo, including the ability to set default attributes and add username alias attributes.

What happens to users marked for deletion during the sync process?

If a user is specified for sync but is no longer a member of any synced group, they will be marked for deletion in Duo.

How frequently does the directory sync run automatically?

Directory sync runs automatically twice a day at a set time chosen at random.

What should be done if users have not activated their Duo access after sync?

You can send activation links to users who have not yet activated the Duo Mobile app directly from the Users page in the Duo Admin Panel.