Cisco DUO SSO
How to enable Single-Sign-On (SSO) with Cisco DUO and OpenID Connect
To enable Single Sign-On (SSO) with Cisco DUO you will need to configure Crewmojo using the generic OpenID Connect integration and Cisco DUO with the "Generic OIDC Relying Party - Single Sign-On"
This guide assumes you already have a configured Cisco DUO account with an Authentication Source for Single Sign-On and users to test with.
The users from Cisco DUO must have accounts in Crewmojo. This is usually synced from your HRIS or Payroll system. Please ensure this is set up before turning on SSO.
Cisco DUO Set Up
In the admin portal for DUO. Navigate to Applications > Protect an Application. Find "Generic OIDC Relying Party" from the list and click "Protect".
If you don't see "Protect" it is because your DUO authentication source is not properly configured.
The Metadata section is generated by DUO. You will need this later for the Crewmojo side of the set up.
Relying Party settings
Relying Party is set up as follows:
Sign-In Redirect URLs
For Sign-In Redirect URLs, specify the following:
OIDC Response settings
You need to edit the scopes of the OIDC response as follows
Settings section
Set the Name as 'Crewmojo'
Don't forget to Save your changes
Crewmojo Set Up
Back in the Crewmojo application. Ensure you have Admin permissions and navigate to the Company Settings > Integrations tab
Under the OpenID section, fill in the data from the Metadata provided in the Cisco DUO settings as per the above section. You will need to supply:
Client ID
Client Secret
Issuer URL
Authorization URL
Token URL
JWKS URL
After you have supplied all the fields click 'Enable OIDC'
Once this step is completed, you need to set the SSO method at the top of the page to OpenID Connect
Last updated
