CISCO-DUO-SSO

Prerequisites

Configure Cisco Duo SSO

1. Step 1:

   Log in to your Duo account as an admin or register at https://admin.duosecurity.com/.

   Enter your admin credentials and click Continue to proceed.

   

2. Step 2:

   Navigate to the Applications tab and select Application in the panel.

   Click the + Add Application button to open the application catalog.

   

   

3. Step 3:

   In the application catalog search bar, select Generic SAML Service Provider from the list, then click + Add.

   

   Enter the Application Name under Basic Configuration. Enter a name based on your preference (e.g. Profit.co).

   

4. Step 4:

   Enter the following information.

   Field	Value
   NameID format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailaddress
   NameID Attribute	<Email Address> as G Suite AuthN Source
   ACS URL	US region https://app.profit.co/app/loginservlet?a=authorize&appCode=profit&integrationCode=CISCO_DUO_GATEWAY Copy to clipboardCopy Link EU region https://eu2-app.profit.co/app/loginservlet?a=authorize&appCode=profit&integrationCode=CISCO_DUO_GATEWAY Copy to clipboardCopy Link ME region https://me1-app.profit.co/app/loginservlet?a=authorize&appCode=profit&integrationCode=CISCO_DUO_GATEWAY Copy to clipboardCopy Link SA region https://sa1-app.profit.co/app/loginservlet?a=authorize&appCode=profit&integrationCode=CISCO_DUO_GATEWAY Copy to clipboardCopy Link
   Signature Algorithm	SHA-256
   Signing Options	Sign assertion
   Map Attributes	IdP Attribute: <usernames> SAML Response Attribute: username

   Click + Add an ACS URL under the Service Provider section to enter the region URL.

   

   

   

5. Step 5:

   Click Save to update the configuration.

   

   After saving, click Download XML under the Downloads section to obtain the Issuer ID and X509 Certificate. You will need these values in a later step.

   

6. Step 6:

   In the left navigation panel, go to Applications → Duo Central.

   

   Click + Add tile to begin adding a Profit.co application tile.

   

7. Step 7:

   On the Add Tile page, select Add Application Tile from the options presented.

   

8. Step 8:

   On the Add Application Tiles page, locate and select Profit.co.

   Click Add Tile to confirm.

   

9. Step 9:

   Click the Duo Central URL displayed in the top-right corner of the Duo Central page. You’ll be redirected to the SSO login page, where users can enter your email address to sign in.

   

   

   Click the Profit.co link to access the Profit.co OKRs page.

   

10. Step 10:

    Switch to Profit.co to complete the connection.

    • Navigate to Settings from the left navigation panel.
    • Click Integrations.
    • On the Connectors page, switch to the SAML SSO tab.
    • Locate Cisco Duo and click the Authorize button.

    

    • In the Register Cisco Duo panel that opens, paste the entity ID and X509Certificate values obtained from the downloaded XML file.
    • Click Authorize to save.

    

Configure Cisco Duo User Provisioning for Profit.co

1. Attributes Mapping in Cisco Duo

   Map Duo user attributes to Profit.co fields so user details sync correctly. You need Duo Admin Panel access as an administrator. Follow the steps in order.

2. 1. Move suggested attributes to Primary attributes

   1. Log in to the Duo Admin Panel.
   2. Go to Users → User Attributes.
   3. In the Suggested attributes list, select the attributes Profit.co needs, such as department,employeeNumber,managerValue and title.
   4. Move the selected attributes to Primary attributes.
   5. Click Save.

   

   

   Note: Only primary attributes can be used in the mapping.

3. 2. Create the custom attribute

   You can create custom attributes in Duo to sync additional user details. Create a custom attribute named role, which Profit.co uses to assign roles to synced users.

   1. On Users → User Attributes, click + Add user attribute and create an attribute named Roles.
   2. Set its source to the directory field that holds the user’s role.
   3. Make sure role is in the Primary attributes list.
   4. Click Save.

   

   

   Note: Follow this order: create the attribute → add it to Primary attributes → sync → map.

   Once the set up is done, navigate to Profit.co and follow the below steps.

4. Requirements

   You need Admin access in Profit.co to retrieve the API Key and SCIM Key.

   • Navigate to Settings → Security → API Access in Profit.co
   • Copy your API Key and SCIM Key
   • Form the token using the format: API_KEY:SCIM_KEY

   

5. Step 1

   Connect Cisco Duo to Profit.co’s SCIM endpoint using your API credentials.

   1. In the Cisco Duo Admin Panel, go to Applications and open the Profit.co - Single Sign-On app.
   2. Click the Provisioning tab.
   3. Under Provisioning Mode, select Automatic.
   4. In the Authentication section, enter the following:

   Field	Value
   Authentication Mode	Bearer Token
   Base URL	US region https://app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link EU region https://eu2-app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link ME region https://me1-app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link SA region https://sa1-app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link
   Token	API_KEY:SCIM_KEY

   5. Click Connect to application to validate the connection.

   

6. After the connection is done successfully, map attributes in the Provisioning section

   1. Click Edit mappings.
   2. Click Select all to include all available attributes.
   3. Click Save Mapping.

   

   Map each Profit.co field to its Duo attribute and make sure every required field is mapped. The image below shows which Duo attribute to map to each Profit.co field.

   Note: The userName attribute must always be mapped to Email Address in Duo.

   

   

   Note: Manager and department data do not sync. The Duo provisioning mapping doesn’t expose these fields, so under the current implementation they aren’t synced as part of provisioning.

7. Groups

   Under the Groups section, select Select groups and choose the group you created.

   Under the Users section, choose the User deprovisioning behavior. This decides what happens in Profit.co when a user or group is removed in Duo:

   • Deactivate Users: The user stays in Profit.co but is set to disabled. This is the default and keeps their data intact.

   Click Save and enable.

   

8. Step 2

   1. Go to Users → Groups and open the group you created.
   2. Click + Add users to group, search for the user, and click Add User To Group.
   3. Once the user is added to the group, they will be automatically created in Profit.co.

   

9. Supported Attributes

   The supported attributes are as follows,

   • First name
   • Last name
   • Employee number
   • Email address
   • Job title
   • Department
   • Manager
   • Roles

10. Department Sync

    1. Existing departments: If the department already exists in Profit.co, the user is assigned to it unless the department is disabled. No duplicate departments are created.
    2. New departments: If the department does not exist in Profit.co, it is created automatically and the user is assigned to it during provisioning.

11. Roles Sync

    When any of the roles below are selected in Cisco Duo, the matching role is automatically applied in Profit.co.

    SCIM Role	Profit.co Role
    manager	Profit Manager
    user	Profit User
    read Only	Profit Read Only
    department Access Only	Department Access Only

SCIM Default Role Selection

1. 

2. Sync Default Roles

   By default, the Global app row lists Profit User. Every user synchronized from Cisco Duo through SCIM is automatically assigned this role in Profit.co.

3. Sync Selected Roles

   To assign other roles during synchronization:

   1. In the SCIM Role Selection section, click + Add Role.
   2. In the Roles dialog, choose roles from the Global, App Specific or Add-on tabs.
   3. Check each role you want. Your choices appear under Selected Roles on the right of the dialog.
   4. Click Add to apply the roles, then click Authorize to save the configuration.

   

Update Default Roles on User Update

When Update default roles on user update is enabled, a user’s existing role in Profit.co is preserved when their record is updated through SCIM.

When this option is disabled, SCIM updates will assign the user the role configured in Profit.co.

Group-Based Role Assignment

• Once a group is created in Cisco Duo and users are added to it, the same group name can be configured in Profit.co for role mapping.
• After this mapping is configured, whenever a user is added to that Cisco Duo group, Profit.co automatically assigns the predefined roles associated with the group.

Note: The group name in Profit.co must exactly match the group name in Cisco Duo for the role mapping to work.

Restrict Re-Creation of Terminated Users

Profit.co provides a Restrict Re-Creation of Terminated Users option within the SCIM configuration.

When this toggle is enabled, users who have been terminated in Profit.co through SCIM provisioning cannot be automatically recreated, even if their account information is updated in Cisco Duo.

When this toggle is disabled, any subsequent update to a terminated user’s account in Cisco Duo may result in the user being recreated as a new user in Profit.co.

User Enrollment Flow

1. Step 1:

   Log in to the Duo Admin Panel at https://admin.duosecurity.com/.

   Navigate to Users in the left panel and click on the user you want to enroll.

   For user enrollment-related queries, refer to the Duo enrollment guide.

   

2. Step 2:

   Under the Device enrollment section, click Send email. A confirmation banner will confirm the email was sent.

   Note: You can also click Generate code to share an enrollment link manually.

   

3. Step 3:

   The user receives an email from Duo Security (no-reply@duosecurity.com) with a unique enrollment link. Click the link to begin enrollment.

   

4. Step 4:

   Clicking the enrollment link opens the Duo device management portal in the browser.

   

   The user clicks Get started to proceed.

   

5. Step 5:

   Select a device type for identity verification:

   • Device verification(Recommended) — Uses the device’s biometrics or PIN.
   • Duo Mobile — Receives a push notification or passcode on a mobile device.
   • Security key — Uses a physical hardware security key.

   For Duo Mobile, proceed with the steps below.

   

6. Step 6:

   Select the country code, enter your phone number, check the consent checkbox, and click Continue.

   

7. Step 7:

   Click Send me a passcode to receive a verification code via SMS, or Or call my phone for a voice call.

   

8. Step 8:

   Scan the QR code using your camera app or the Use QR Code option in the Duo Mobile app to complete activation.

   

9. Step 9:

   Once activation is complete, the Device enrollment field in the Duo Admin Panel updates to Enrolled. The user can now log in to Profit.co using Cisco Duo SSO.

   

10. Step 10:

    Click the Duo Central subdomain URL. You will be redirected to the Duo page.

    Click the Profit.co link to access the Profit.co OKRs page.

    

    

Summary