Cisco Duo — Integration Setup

Prerequisites

• Cisco Duo Access, Beyond, or MFA tenant
• Duo Owner role (required to create Admin API applications)
• CMDash Essentials tier or above

Step 1: Create an Admin API Application

1. Log in to the Duo Admin Panel.
2. Go to Applications → Protect an Application.
3. Search for Admin API and click Protect.
4. Name: CMDash Integration.
5. Permissions (at minimum):
   • Grant read information — required
   • Grant read log — optional, enables richer incident data in future
6. Save, then copy the Integration Key, Secret Key, and API hostname (e.g., api-XXXXXXXX.duosecurity.com).

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find Cisco Duo and click Connect.
3. Enter:
   • API hostname (without https://)
   • Credentials — paste <integration_key>:<secret_key> in a single field. CMDash stores this encrypted at rest.
4. Click Save & Test Connection.

What Syncs

Signing Scheme

Duo's Admin API uses HMAC-SHA1 signatures rather than bearer tokens. CMDash's adapter signs every request using the Date, method, path, and sorted query string. Clock skew between your Duo API host and the CMDash worker must be under ±5 minutes.

Troubleshooting

• HTTP 401 "Invalid signature": clock skew on the CMDash container. ECS tasks use the host's NTP; verify the host drift is under a minute. Also confirm the Date header is RFC 1123 format (CMDash uses toUTCString()).
• HTTP 403 "Admin API not enabled": the Admin API application has not yet finished provisioning — Duo takes 5–10 minutes after creation.
• MFA coverage reports 0%: CMDash counts users with at least one activated phone or any token. Users still in the bypass state will not count. Adjust if your enrollment flow keeps users in bypass deliberately.