Onelogin API - Verify Factor for SAML assertion when using Duo

1
votes

I've been developing an application that hits the api/1/saml_assertion, https://developers.onelogin.com/api-docs/1/saml-assertions/generate-saml-assertion , endpoint of OneLogin with Duo as my MFA. There are a couple of device elements that get returned that I'm unsure what to do with and can't seem to find any documentation on it. These elements are duo_sig_request and duo_api_hostname.

duo_sig_request looks like this:

'duo_sig_request': 'TX|<base64 encoded elements>|<what looks like a sha1 hash>:APP|<base64 encoded elements>|<what looks like a sha1 hash>'

duo_api_hostname is just the API url for Duo.

The base64 encoded elements are the user's email, what I'm assuming is the user's Duo ID, and a number that I'm unsure about since it changes with every request.

I'm assuming this information is intended to be used against https://duo.com/docs/authapi#/auth to actually trigger a Duo push, text, or call, and that sha1 is the hmac signature for Duo auth.

Has anyone successfully done what I'm attempting and can affirm that what I'm assuming is correct? Also can anyone tell me what that third element is (a device ID that changes per request maybe?) and what TX vs APP are?

Thanks in advance for any help!!

2
onelogin
have you checked developers.onelogin.com/api-docs/1/getting-started/client-sdks ? - smartin
You get MFA info so you may execute a call to Duo and get a OTP token to be provided to OneLogin in order to finalice your login. - smartin
@smartin - thanks for the response. I did look at the sdk and what I noticed is that it doesn't seem to account for Duo, or at least it appears that way when I look at github.com/onelogin/onelogin-python-sdk/blob/master/src/… . It doesn't seem to expect the duo_sig_request or duo_api_hostname and I can't find anywhere in the SDK where those would be used. Even though I have auto-push enabled, that doesn't seem to be triggered - Ben Grantham
OneLogin SDK interacts with OneLogin API, not with 3rd party services. You will need to use DUO API in order to provide them the data it expects in order to get a valid OTP Token to be used at OneLogin.. - smartin

2 Answers

0
votes

Contacted OneLogin support about this, and looks like its not supported yet.

There is a restriction on the Duo two-factor as our current interface we have with Duo does not allow it to be used by an API and always requires web GUI interaction. All other MFA devices should work.

0
votes

Duo is now supported via OneLogin API. You need to create an API App via Duo admin console. Then use the key and secret from that app in your OneLogin Duo configuration which is set via the OneLogin admin portal.