# Duo SSO

## Overview

Panther supports integrating with [Duo](https://duo.com/) as a SAML provider to enable logging in to the Panther Console via SSO.

For more information on features, terminology, and limitations of SSO integrations with the Panther Console, see [Identity & Access Integrations](https://docs.panther.com/system-configuration/saml).

## How to configure SAML SSO to the Panther Console with Duo

### Step 1: Obtain the Duo SSO parameters from Panther

1. Log in to the Panther Console.
2. In the upper-right corner, click the gear icon, and then click **General**.
3. Navigate to the **Identity & Access** tab.
4. Next to **Enable SAML (Security Assertion Markup Language)**, set the toggle to `ON`.
5. If using [IdP-initiated login](https://docs.panther.com/system-configuration/saml/..#idp-initiated-vs.-sp-initiated-login), set the **Use IdP-Initiated Single Sign On (SSO)** toggle to `ON`.
6. Copy the the **Audience** and **ACS Consumer URL** values and store them in a secure location. You will need them in the following steps.
   * If using IdP-initiated login, also copy the **Relay State** value.

{% hint style="info" %}
It's recommended to use [SP-initiated login](https://docs.panther.com/system-configuration/saml/..#sp-initiated-login-recommended), as it is generally considered more secure than IdP-initiated login.
{% endhint %}

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-800628a71753e4ef33d50d9bbf9231f05441120b%2FScreenshot%202025-10-10%20at%203.03.25%E2%80%AFPM.png?alt=media" alt="In the Settings section of the Panther Console, within the Identity &#x26; Access tab, various fields like &#x22;Enable SAML&#x22;, &#x22;Audience&#x22; and &#x22;ACS Consumer URL&#x22; are shown"><figcaption></figcaption></figure>

### Step 2: Create the Duo app

1. Log into the [Duo Admin Panel](https://admin.duosecurity.com/).
2. In the left-hand navigation bar, navigate to **Applications** → **Application Catalog**.
3. Search for **Generic SAML Service Provider**. Click **+Add**.

   <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c35735fea0c08509570fc42b8bf0fc99f9af4351%2FGeneric%20SAML.png?alt=media" alt="Application Catalog in the Duo Admin Panel showing the &#x22;Generic SAML Service Provider&#x22; application" width="375"><figcaption></figcaption></figure>
4. In the **Service Provider** section, configure the following:
   * **Entity ID**: Paste the **Audience** value you obtained in the Panther Console in Step 1.
   * **Assertion Consumer Service (ACS) URL**: Paste the **ACS Consumer URL** value you obtained in the Panther Console in Step 1.
   * **Default Relay State:** If using IdP-initiated login, paste the **Relay State** value you copied from the Panther Console in Step 1. If using SP-initiated login, leave this value blank.

     <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c98fed50296b49e48d3a0e74e74655cad8603e62%2FScreenshot%202025-11-04%20at%208.30.32%E2%80%AFAM.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>
5. In the Duo Admin Panel, scroll to the bottom of the page, and click **Save**.

Keep this Duo Admin Panel browser window open, as you will need the **Metadata URL** value in the next steps.

### Step 3: Configure Duo SAML in Panther

1. Navigate back to the **Identity & Access** section in the Panther Console from Step 1. In the **Default Role** field, choose the Panther role that your new users will be assigned by default when they first log in via SSO.

{% hint style="warning" %}
Panther highly recommends not setting this value to `Admin`.
{% endhint %}

2. Return to the Duo Admin Panel. Copy the **Metadata URL** value and paste it into the **Identity Provider URL** field in the Panther Console.
3. Click **Save Changes**.

To test your setup, go to your Panther sign-in page and click **Login with SSO**.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4537547853dd91d5c43d3b0bb9c3fa6717129b33%2Fimage%20(12)%20(3).png?alt=media" alt="The Panther login page displays a &#x22;Login with SSO&#x22; button at the bottom."><figcaption></figcaption></figure>