> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/enterprise-guide/user-and-team-provisioning/duo-provisioning.md). # DUO Provisioning Keeper supports SAML 2.0 Authentication and SCIM provisioning with the DUO platform. ## **Overview** This guide covers DUO Automated Provisioning with SCIM. Before you begin the setup, we recommend that you first activate Keeper's SSO Connect integration with DUO that provides real-time user authentication and Just-in-Time (JIT) provisioning. {% hint style="info" %} Please review the DUO SSO implementation guides: SSO Connect Cloud (Recommended): [Click Here](/sso-connect-cloud/identity-provider-setup/duo.md) {% endhint %} ## **Provisioning Features** Keeper's DUO automated provisioning supports the following features: * Creates users in Keeper * Updates user attributes * Activates or deactivates users (locks or unlocks them in Keeper) * Creates teams in Keeper (from DUO groups) * Creates roles in Keeper (with Role Mapping Prefix) * Assigns users to provisioned teams / roles When provisioning users, a DUO directory is mapped to a single Keeper node. ## **Requirements** To setup Keeper user provisioning with DUO, you need to have access to the Keeper Admin Console and a DUO Admin account. ## **Configuration Steps** This guide won't cover the deployment of the **Keeper Security - Single Sign-On** application, which is documented in our SSO Connect Cloud guide referenced in requirements above. From your existing **Keeper Security - Single Sign-On** application, open the **Provisioning** tab:

### Authentication In **Provisioning → Authentication**, switch the **Authentication Mode** to *Bearer Token*:

In your **Admin Console**, navigate to your DUO SSO node, and create a new provisioning method for SCIM:

On the next panel: * Copy the **URL** and paste it in DUO's **Base URL** field. * Generate then copy the **Token** then paste it in DUO's **Token** field. * Click Next in the Admin Console. You may ignore the **Role Mapping Prefix** for now - this can be set later and is explained below.

In DUO, click on **Connect to Application** - this should return a success if you have submitted the SCIM provisioning method.

{% hint style="info" %} If you did not press Next to complete the SCIM provisioning method on your Admin Console, DUO will fail this connection test. {% endhint %} ### Attribute Mapping By default, DUO SCIM creates users with their DUO username defined as both Name and Email in Keeper:

{% hint style="info" %} Note that if you have set another DUO attribute as the identifier in your Single Sign-on configuration, you should replicate it here to make sure that SCIM imports users with the same email as the one they will log in with. {% endhint %} You can add a `displayName` mapping to this panel if you want SCIM to create users with a name that matches ones of your DUO attributes:

### Groups In the **Groups** panel, you can define which groups will be pushed to your Keeper Enterprise: * You can **Select groups** from your DUO directory. * You can **Use groups with SSO access**, which will inherit from the groups assigned to the Single Sign-on application. * You can **Exclude group information**, which will only import the members of the selected groups, but will not create teams in Keeper.

### User Deprovisioning The next panel offers two choices for how to handle user deprovisioning: * Deactivate Users * Delete Users This choice is moot with Keeper, as active users will not be deleted regardless of the selected option, only Locked.

## Running the Provisioning Cycle DUO's automated provisioning can be enabled immediately by pressing **Save and Enable**, or by pressing **Enable** on the panel at the top of the page. Once enabled, any new changes will automatically trigger a new update and push. The provisioning can be disabled / enabled at any time.

## **Team and User Approvals** Because of Keeper's Zero-Knowledge architecture, Team and Team-User assignments performed by DUO cannot be applied unless an Admin is signed into the Keeper Admin Console, or one of Keeper's automated tools has been deployed. * Perform team approvals as an Admin: After pushing Users or Teams to the Keeper Admin Console, simply login or click "Full Sync" to process and approve the transactions. * Tools to automate team approvals: * [Keeper Automator service](/sso-connect-cloud/device-approvals/automator.md) * [Keeper Commander automation](/sso-connect-cloud/device-approvals/commander-cli.md) ## **SCIM + Team-to-Role Mapping** DUO Automated provisioning maps Push Groups to Keeper Teams. To automatically assign different teams to different Keeper Roles, you can use our "Team to Role mapping" feature.

In the above image, the role mapping prefix is set to `Keeper_role_`, which means that: * A DUO group named `Keeper_role_developers` will not be provisioned as a Keeper team, but as a Keeper role, and all members will be assigned to that role. * A DUO group named `developers` will be provisioned as a Keeper team as normal. This system allows users to decouple roles from teams with their DUO groups. {% hint style="info" %} While a user can be provisioned into multiple SCIM-synced teams, a single user cannot be provisioned into multiple prefix-mapped roles. {% endhint %} ## **Best Practices / Troubleshooting** When using SCIM, you should avoid making updates to assignments from the Keeper side - your DUO directory should be considered the source of truth for all assignments. DUO cannot detect changes made on the Keeper Enterprise, hence updating assignments in Keeper may lead to discrepancies and is strongly discouraged. ### Common issues * If you click the "Connect to application" button before saving the SCIM provisioning method in the Admin Console, the test will fail. Copy the token then click Next. * Keeper users are identified by their email, therefore when assigning the DUO user to the Keeper app, make sure the attribute mapped to `userName` contains a valid email address. * When synchronizing group memberships from DUO, Keeper creates team memberships which are not immediately visible. For the provisioned users to become actual team members, the user must register with Keeper, accept the invitation and receive approval for group entry by a Keeper Administrator or auto-approved by an existing Keeper team member logged into their Web Vault. * If you delete then re-create users / groups in Keeper, you may experience errors in DUO, as DUO saves the ID of the object and won't recognize the new one. Disabling then re-enabling the provisioning should resolve these errors. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.keeper.io/enterprise-guide/user-and-team-provisioning/duo-provisioning.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.