Skip to main content

Setting up SAML Authentication with Duo

Updated

Read supports single sign-on (SSO) with several SAML identity providers. This article explains how to set up SAML with Duo. For other providers, see How to: Setup SAML Authentication with Read AI.

Prerequisites

You’ll need:

  • A Read Workspace on the Enterprise+ plan
  • An admin in your Read Workspace
  • An administrator of your Duo account

Step 1: Copy your ACS URL and Entity ID from Read

  1. A Read Workspace admin opens Workspace Settings from the menu in the bottom left, goes to Settings, and expands the Advanced (Enterprise+ Required) section.
  2. Scroll to the SAML section.
  3. Copy the ACS URL and Entity ID. You’ll need them in Step 3.
Screenshot 2024-11-22 at 7.50.28 PM.png

Step 2: Create a new application in Duo

  1. Sign in to the Duo Admin Panel.
  2. Go to Applications and click Add Application.
  3. In the Application Catalog, select Generic SAML Service Provider and click Add.
  4. Name the application. For example, “Read AI.”

 

Step 3: Enter Read’s details in Duo

In the new application’s settings:

  1. Set Metadata Discovery to None.
  2. In Entity ID, paste the Entity ID you copied in Step 1 (https://api.read.ai).
  3. In Assertion Consumer Service (ACS) URL, paste the ACS URL you copied in Step 1.
  4. Set NameID format to Email address, and NameID attribute to <Email Address>.

  5. Under Map attributes, add these mappings: 

    Duo attribute SAML response attribute
    <Email Address> email
    <First Name> first_name
    <Last Name> last_name
  6. Under Permitted groups, choose which users can sign in to Read with Duo.

  7. Click Save.

     

 

Step 4: Enter Duo’s details in Read

  1. In Duo, find the Metadata section of the application and copy:

    • Entity ID
    • Single Sign-On URL
    • Certificate. Download it or copy its contents. 

  2. In Read, go back to Workspace Settings > Settings > Advanced > SAML.
  3. Paste each value into the matching field.
    • Duo’s Entity ID → Read’s IdP Entity ID (or Issuer)
    • Duo’s Single Sign-On URL → Read’s SSO URL
    • Duo’s Certificate → Read’s Certificate
  4. Click Save.
Duo Application Configuration Screen. Entity ID, SSO URL, and Certificate must all be input into Read AI's SAML settings

 

Step 5: Test sign-in

  1. Make sure your user is in one of the permitted groups in Duo.
  2. Open a private or incognito browser window and go to the Read sign-in page.
  3. Choose to sign in with SSO and enter your work email.
  4. Complete the Duo sign-in. You should be signed in to your Read account.

If sign-in fails, double-check the values from Steps 3 and 4, especially the certificate and the attribute mappings.

 

Step 6 (optional): Require SAML sign-in

To make everyone on your verified domains sign in through Duo, turn on Enforce SAML on Verified Domains in Workspace Settings > Settings > Advanced > SAML.

Test sign-in (Step 5) before turning this on, so you don’t lock people out.

Related articles