DUO Provisioning

Keeper supports SAML 2.0 Authentication and SCIM provisioning with the DUO platform.

Overview

This guide covers DUO Automated Provisioning with SCIM. Before you begin the setup, we recommend that you first activate Keeper's SSO Connect integration with DUO that provides real-time user authentication and Just-in-Time (JIT) provisioning.

Please review the DUO SSO implementation guides:

SSO Connect Cloud (Recommended): Click Here

Provisioning Features

Keeper's DUO automated provisioning supports the following features:

• Creates users in Keeper

• Updates user attributes

• Activates or deactivates users (locks or unlocks them in Keeper)

• Creates teams in Keeper (from DUO groups)

• Creates roles in Keeper (with Role Mapping Prefix)

• Assigns users to provisioned teams / roles

When provisioning users, a DUO directory is mapped to a single Keeper node.

Requirements

To setup Keeper user provisioning with DUO, you need to have access to the Keeper Admin Console and a DUO Admin account.

Configuration Steps

This guide won't cover the deployment of the Keeper Security - Single Sign-On application, which is documented in our SSO Connect Cloud guide referenced in requirements above.

From your existing Keeper Security - Single Sign-On application, open the Provisioning tab:

Authentication

In Provisioning → Authentication, switch the Authentication Mode to Bearer Token:

In your Admin Console, navigate to your DUO SSO node, and create a new provisioning method for SCIM:

On the next panel:

• Copy the URL and paste it in DUO's Base URL field.

• Generate then copy the Token then paste it in DUO's Token field.

• Click Next in the Admin Console.

You may ignore the Role Mapping Prefix for now - this can be set later and is explained below.

In DUO, click on Connect to Application - this should return a success if you have submitted the SCIM provisioning method.

If you did not press Next to complete the SCIM provisioning method on your Admin Console, DUO will fail this connection test.

Attribute Mapping

By default, DUO SCIM creates users with their DUO username defined as both Name and Email in Keeper:

Note that if you have set another DUO attribute as the identifier in your Single Sign-on configuration, you should replicate it here to make sure that SCIM imports users with the same email as the one they will log in with.

You can add a displayName mapping to this panel if you want SCIM to create users with a name that matches ones of your DUO attributes:

Groups

In the Groups panel, you can define which groups will be pushed to your Keeper Enterprise:

• You can Select groups from your DUO directory.

• You can Use groups with SSO access, which will inherit from the groups assigned to the Single Sign-on application.

• You can Exclude group information, which will only import the members of the selected groups, but will not create teams in Keeper.

User Deprovisioning

The next panel offers two choices for how to handle user deprovisioning:

• Deactivate Users

• Delete Users

This choice is moot with Keeper, as active users will not be deleted regardless of the selected option, only Locked.

Running the Provisioning Cycle

DUO's automated provisioning can be enabled immediately by pressing Save and Enable, or by pressing Enable on the panel at the top of the page. Once enabled, any new changes will automatically trigger a new update and push. The provisioning can be disabled / enabled at any time.

Team and User Approvals

Because of Keeper's Zero-Knowledge architecture, Team and Team-User assignments performed by DUO cannot be applied unless an Admin is signed into the Keeper Admin Console, or one of Keeper's automated tools has been deployed.

• Perform team approvals as an Admin:

After pushing Users or Teams to the Keeper Admin Console, simply login or click "Full Sync" to process and approve the transactions.

• Tools to automate team approvals:

  • Keeper Automator service

  • Keeper Commander automation

SCIM + Team-to-Role Mapping

DUO Automated provisioning maps Push Groups to Keeper Teams. To automatically assign different teams to different Keeper Roles, you can use our "Team to Role mapping" feature.

In the above image, the role mapping prefix is set to Keeper_role_, which means that:

• A DUO group named Keeper_role_developers will not be provisioned as a Keeper team, but as a Keeper role, and all members will be assigned to that role.

• A DUO group named developers will be provisioned as a Keeper team as normal.

This system allows users to decouple roles from teams with their DUO groups.

While a user can be provisioned into multiple SCIM-synced teams, a single user cannot be provisioned into multiple prefix-mapped roles.

Best Practices / Troubleshooting

When using SCIM, you should avoid making updates to assignments from the Keeper side - your DUO directory should be considered the source of truth for all assignments. DUO cannot detect changes made on the Keeper Enterprise, hence updating assignments in Keeper may lead to discrepancies and is strongly discouraged.

Common issues

• If you click the "Connect to application" button before saving the SCIM provisioning method in the Admin Console, the test will fail. Copy the token then click Next.

• Keeper users are identified by their email, therefore when assigning the DUO user to the Keeper app, make sure the attribute mapped to userName contains a valid email address.

• When synchronizing group memberships from DUO, Keeper creates team memberships which are not immediately visible. For the provisioned users to become actual team members, the user must register with Keeper, accept the invitation and receive approval for group entry by a Keeper Administrator or auto-approved by an existing Keeper team member logged into their Web Vault.

• If you delete then re-create users / groups in Keeper, you may experience errors in DUO, as DUO saves the ID of the object and won't recognize the new one. Disabling then re-enabling the provisioning should resolve these errors.