To look up the external Duo identity of the user from an LDAP/Active Directory database, configure the [usermapping source=ldap_server] section of the SPS Duo plugin.
Declaration
[usermapping source=ldap_server]
user_attribute=description
You must configure the name of the LDAP Server policy in the [ldap_server] section.
If you configure both the append_domain parameter in the [username_transform] section and the [usermapping source=ldap_server] section of the SPS Duo plugin, SPS appends the @ character and the value of the append_domain parameter to the value retrieved from the LDAP database.
user_attribute
| Type: |
string |
| Required: |
no |
| Default: |
N/A |
Description: The user_attribute must be an LDAP/AD user attribute (with a non-empty UTF8 attribute string) that contains the external identity. For example, description, cn, mail. For a complete list see the User class section of the Active Directory Schema document.
This section contains username transformation-related settings.
Declaration
[username_transform]
append_domain=<domain-without-@-character>
If you have configured [USERMAPPING], the [username_transform] process will run after the [USERMAPPING] process.
append_domain
| Type: |
string (nonrequired, no default) |
| Required: |
no |
| Default: |
N/A |
Description:
If the Duo service requires the use of domain name in the external Duo identity, configure the append_domain parameter in the [username_transform] section. In this case, SPS automatically appends the @ character and the value of this option to the username from the session, and uses the resulting username on the Duo server to authenticate the user. For example, if the domain is set to append_domain: example.com and the username is Example.User, the SPS plugin will look for the user Example.User@example.com on the Duo server.
If you configure both the append_domain parameter in the [username_transform] section and the [usermapping source=ldap_server] section of the SPS Duo plugin, SPS appends the @ character and the value of the append_domain parameter to the value retrieved from the LDAP database.
The LDAP Server policy that you want to use in an LDAP server usermapping source or an LDAP server group whitelist source. Required if you have configured [usermapping source=ldap_server] and [whitelist source=ldap_server_group].
Declaration
[ldap_server]
name=<name-of-LDAP-server-policy>
This section contains settings related to storing sensitive information of the plugin.
Declaration
[credential_store]
name=<name-of-credential-store-policy-that-hosts-sensitive-data>
name
| Type: |
string |
| Required: |
no |
| Default: |
N/A |
Description: The name of a local Credential Store policy configured on SPS. You can use this Credential Store to store sensitive information of the plugin in a secure way (for example, the ikey and skey value in the [duo] section).
For details, see Store sensitive plugin data securely.
