Set up single sign-on with Duo

With Duo Single Sign-On, people sign in to Freesbe with your directory account and approve a Duo push, so Freesbe’s own second step isn’t needed. This connects them over SAML.

Before you start

• Single sign-on with your own provider comes with the Corporate and Enterprise plans.
• Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
• You need to be an owner of the workspace in Freesbe, and able to add apps in Duo.
• Keep the Freesbe page open in one tab and Duo in another: you copy details both ways.

1. Start in Freesbe

1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
2. Choose Duo and SAML 2.0, then Set up Duo.
3. The page shows Add Freesbe to Duo with the details to copy. Leave it open.

2. Add Freesbe to Duo

1. In the Duo Admin Panel, go to Applications → Protect an Application (Application Catalog), search for Generic SAML Service Provider and click Protect.
2. Under Service Provider, paste Freesbe’s Entity ID into Entity ID and its Reply URL into Assertion Consumer Service (ACS) URL.
3. Under SAML Response, set NameID format to the email address one and NameID attribute to . Optionally map the name attributes.
4. Name the application Freesbe, choose who can use it under Permitted groups, and Save.
5. Under Downloads, copy the Metadata URL.

3. Tell Freesbe about Duo

Under Tell Freesbe about Duo, paste the metadata URL and click Save.

4. Test it

1. Back on the Freesbe page, under Test it, click Test sign-in.
2. Sign in to Duo as yourself. You’re brought back to the page, which says Signed in and shows what Duo sent: your email address, name and any other attributes.
3. Nobody else can sign in through Duo until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

The page says why. The usual reasons:

• “isn’t at one of this workspace’s verified email domains”: Duo sent an address at another domain, or a username instead of the email. Send the user’s primary email as the NameID ().
• “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one Duo signs with. Paste the metadata URL again, or upload the new metadata file.
• “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in Duo doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
• “is encrypted”: turn off assertion encryption for the Freesbe app.
• The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in Duo.

See Single sign-on for everything else.

With OpenID Connect instead

Choose OpenID Connect in step 1, and protect a Generic OIDC Relying Party in Duo. Add Freesbe’s Redirect URL under Sign-In Redirect URLs, with the openid and email scopes. In Freesbe enter Duo’s Issuer, Client ID and Client Secret.