Skip to content

Provisioning

The Duo connector supports provisioning, allowing you to create and manage accounts and entitlements in Duo directly from SailPoint.

Prerequisite: Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

Important

This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

Default Create Account Attributes

Account Attribute Generator Description
user_type Static Generator is Static. The default value is 'User'. When you want to manage as administrator, this value need to be set as "Administrator" in the Static Value field.
username Identity Attribute This is an Identity Attribute. The Duo user name as taken from the SailPoint user name.
name Identity Attribute This is an Identity Attribute. The Duo administrator name as taken from the SailPoint user name.
email Identity Attribute This is an Identity Attribute. The email address of the user.
phones Identity Attribute This is an Identity Attribute. The phone number of the user.
realname Disable It is disabled by default. The real name of the user.
password Disable It is disabled by default. The password of the administrator user. The Duo source supports password management of Duo administrators for external management of the password on the Duo native system. Refer to the following details:
- has_external_password_mgmt: Set this to true in the Static Value field for the administrator's password along with the password attribute. Set it to false if passwords are self-managed. The default value is false.
- password: Provide the password for the Duo administrator after setting the has_external_password_mgmt attribute to true.
role Disable It is disabled by default. This is the Duo administrator role. The default role ‘Owner’ is assigned to the administrator if the role value is not provided as available in the Duo managed System. To set this to other role, this must be configured as 'Static' and the role name must be provided in the Static Value field.

Note

The phone_type and phone_platform attributes are supported as Create Account attributes and while configuring, both these attributes must be set in combination. Without providing values for both the attributes, for single or multiple phone numbers assigned to an account, the default phone type is set as Mobile and the default phone platform is set as Generic Smartphone in the Duo managed system.

User Attribute

The Duo connector creates a Duo user if the user_type = User attribute is present in the Create Account section. If you have marked this attribute as Disabled, while creating a Duo user, you may change that and set this value as User as per your requirement.

You can also skip this usage and retain Disabled as a value.

There is no impact and change in creation of a Duo administrator and user_type must be set to Administrator while creating the Duo administrator.

Duo Admin User

The Duo source supports aggregation, provisioning, and password management of the administrator user in the Duo managed target system.

For the new Duo sources, on the UI, select Manage Administrator User to start managing the Administrator Users.

For provisioning of the Admin user, the additional attributes that you must consider with the existing attributes are:

  • user_type
  • name
  • password (Optional)
  • phone (Optional)
  • role

Refer to Default Create Account Attributes for more information.

To send an email with the set up link while creating the Duo administrators, add the send_email attribute in the Create Account section and set it to true as a Static Value field. The default value is false.

For Pre-existing Sources

Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) to add the following attributes using APIs.

  • Add schema attributes as per the following settings:
    • role: Administrator role: string
    • user_type: Type of user: string
    • restricted_by_admin_units: Administrator account restricted by an administrative unit assignment: boolean
  • Add the adminUsersUri attribute key with a value such as /admin/v1/admins.
  • To enable the password management for administrator user, the feature value PASSWORD must be added to the features string. Add the featuresString attribute key with a value such as PROVISIONING, SYNC_PROVISIONING, UNLOCK, ENABLE, SEARCH, PASSWORD.

Caution

Password management is applicable for the administrator users and not for the normal users.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.