Automatic Provisioning in Duo Directory via SCIM

Hello, and thank you for watching this dual success capsule. Today we will cover automatic provisioning in dual directory via skim.00:06My name is Sheila Vida and I am a security customer success specialist. In this capsule, we will touch on some Duo directory features along with defining and showing what skin is.00:15We will demonstrate how it's implemented in Duo and leave you with a couple of takeaways. Duo directory is Duo's security 1st identity and access management solution. It extends our secure MFA platform with IAM and identity provider or IDP function.00:31Analytics.00:52The items that you see here is how Duo directory provides those IDP services. You could now store passwords within Duo and use it as your primary authentication source. If passwordless and show passwordless is in your roadmap.00:54Duo directory can empower you for that as well. You could also define attributes which are unique to your organization with a directory that is hosted in Duo. But what we will focus on the most today is around user provisioning and automatically managing your username.01:12Information via the SCIM protocol. SCIM stands for system for cross domain identity management. And it is an open standard protocol which automates the thinking of user information between different systems.01:32And there are two directions, so to speak, an inbound skin and an outbound skin. An inbound skim, user information that might be stored in an external identity provider could be synced in duo.01:50In this configuration, you will set up the connection between your identity provider as an external directory integration in duo. And then once that connection is done, it will do the process and identify what groups in Duo directory are managed by this integration.02:09Outbound scheme, on the other hand, is user information hosted in Duo directory automatically sent to a configured SAML or OIDC service provider? Once the connection between Duo as an IDP and the.02:29Service providers established?02:47Duo automatically reads the schema information from the connected application and show you which attributes are required. You can then map the attribute to what's existing in duo. And if your workflow requires it, you could also map additional SCIM attributes.02:49Once you have defined the connection and the attributes that you're gonna be sending, you do have the ability to select which groups you want to start pulling from Duo and sending the information over to the application.03:11Now let's do a quick demo on how to configure skin in duo. We will start with logging in as an user with a correct right so we are logging as an administrator here. Then we go to.03:26Users external directory.03:45And this is inbound scheme configuration, so we added an external directory and we chose the generic scheme integration. We did see that a named Okta integration is there as well. So we gave it a name and then we define what attributes we want to pull from the external.03:47IDP store that you do have. And then once you do complete the setup, you are provided with a base URL and bear token that you then provide to the source IDP provider. And then you will see the users synced to Duo.04:08Now let's go to outbound scim, which is in the application side of duo. For this extra example, we're gonna use secure access and we will start the configuration by going to this service provider, the secure access application and set up a directory integration, and then we select the method as ID.04:28And we name it with a distinct name and we call it to a skim for this organization, and then you will need to generate the token which will need to be provided to duo. So we go back to Duo and then we create that secure.04:49Their access integration.05:09I clicked the wrong button there, so let's click add to add the secure access application and then we'll go to the provisioning tab. We'll get that URL and token information from the secure access integration we created.05:13And then we will click connect to application to initiate the process and then we'll define the attributes that we want sent over. And it auto detects what attributes secure access might need and we selected a couple of them here.05:32And then we select the group that we're gonna be syncing by skim, and we have a group called secure access testers. We want users to be deleted from secure access if it's deprovisioned in duo. And we see that it actually instantaneously did that process.05:53So let's go to that secure access tester group that we defined, and we will see that we do have two users associated with this group, Readinax and pen test.06:13Let us go open that application page one more time because that's where we're gonna be monitoring the logging behavior and let's keep that tab open. It actually has already processed it as you can see here. Let's confirm that that is the case in secure access. Let's.06:30Complete that configuration page and then let's extend the group actually let's fresh the page 1st and then let us see if Frida and pen test.06:50Have been synced to secure access by skim. And we do see that at least Frida is. Let's click more information. The attributes that we wanted was sent over and then they are part of the secure access testers group.07:06Alright, now let us test a deprovisioning workflow where we remove freedom from the group that we are syncing with and see how that would affect.07:27Secure access. So we remove Frida from the secure access tester group that we're syncing, and we'll open the application page again under that provisioning tab.07:44So we could see the behavior once it has completed its processing, and it is not quite made it there yet. That was our thinking from earlier.08:04Alright, let's refresh that page and while we're waiting for that to come in, oh actually it just, it just did. So let's verify if that's the case in secure access. Let's just refresh this page.08:25And then we'll see if Frida's information has been deleted and secure access as configured, and we will see that it has.08:43But pen test, which is part of the securex Accessor Group is still available. All right, and we did see the log earlier, and that's how outbound skin works.08:59Right, to close this capsule off, we're leaving with two main takeaways. The 1st one is Skim as a protocol assistance enable enables consistent user inventory across your different systems. And it does this instantaneously as well.09:19Skim is implemented in Duo via the Duo directory. With user information managed in Duo directory, you could automatically sync its states, its attributes into a connected SSO, SAML or OIDC application.09:39Thank you for joining us for today's success capsule.09:57