Knowledge Base

Duo SSO setup

Step 1: Create the app

1. Log in to Duo.
   
2. Navigate to the admin panel.
   
3. Select Applications.
   
4. Click Protect an application.
   
5. Search for "Generic SAML Service Provider."
   
6. Download the SAML metadata XML. The Duo entity ID is also displayed.
   
   📝 This XML file must be included in your SSO submission request via your Teamwork.com SSO site settings.
   

1. Navigate to the Service Provider section.
   
2. Enter the following values:
   

   Entity ID The trailing slash is required here. https://YOUR-TEAMWORK-DOMAIN.COM/

   ACS URL https://YOUR-TEAMWORK-DOMAIN.COM/singlesignon/v1/saml/acs

   Default RelayState  https://YOUR-TEAMWORK-DOMAIN.COM/launchpad/saml/start This is optional — it allows users to log in via Duo directly.

   Entity ID The trailing slash is required here. https://YOUR-TEAMWORK-DOMAIN.COM/

   ACS URL https://YOUR-TEAMWORK-DOMAIN.COM/singlesignon/v1/saml/acs

   Default RelayState  https://YOUR-TEAMWORK-DOMAIN.COM/launchpad/saml/start This is optional — it allows users to log in via Duo directly.

3. Navigate to the SAML Response section.
   
4. Use the following:
   
1. NameID format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
   
2. Signature algorithm: sha256
   
3. Signing options: You can select both "Sign response" and "Sign assertion."
   
5. Map the attributes you want to pass to Teamwork.com:
   

   Attribute	→	Outgoing
   <Email Address>	→	email
   <First Name>	→	firstname
   <Last Name>	→	lastname
   <Username>	→	nameID

   Attribute	→	Outgoing
   <Email Address>	→	email
   <First Name>	→	firstname
   <Last Name>	→	lastname
   <Username>	→	nameID

6. Configure the rest of the settings as needed. You may want to set the application's name to "Teamwork."
   
7. Save the app settings.
   

Step 3: Submit an SSO request to Teamwork.com