# Duo

![Duo Security Vector Logo - (.SVG + .PNG) - VectorLogoSeek.Com](https://assets.relyanceuat.xyz/images/docs/6654146332301/ext-a77e8c0a16.png)
[Duo Security](https://duo.com/) - a part of Cisco Secure - is a cloud-based authentication solution, and provides two-factor authentication, endpoint remediation, and secure single sign-on tools.

In order to integrate Duo Security with Relyance AI you will need an integration key, secret key, API subdomain, and username from Duo.

#### In Duo Security:

![mceclip0.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6654612518029.png)
![mceclip1.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6654667687565.png)
1. Login to your Duo Security account.

![mceclip6.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6655172297485.png)
![mceclip7.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6655263228941.png)
2. Click on the **Applications** menu item.
3. Click on **Protect an Application**.
4. Locate the entry for **Auth API** in the applications list and click the **Protect** button on the right.
5. Copy and temporarily store your ***integration key***, ***secret key***, and ***API hostname*** (the subdomain prefix before the "duosecurity.com" part) values. You'll need this information to complete your Relyance AI setup in later steps.
6. If you have not already defined a Duo username for the integration, click the **Users** menu item.
7. Click the **Add User** button.
8. Enter a **Username**; record this as this will be used for the ***username*** value in the Relyance AI steps later.
9. Click **Add User**.
10. Enter values for **Full Name** and **Email**.
11. Click the **Save Changes** button.

![mceclip2.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6654644651789.png)

![mceclip3.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6654729120653.png)

#### In Relyance AI:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Vendor Integration** tab.
5. Find the **Duo Security** integration card and click it to open its connections.
6. Under **Authentication Method**, choose **Custom**.
8. Paste the ***integration key***, ***secret key***, ***API hostname,*** and ***username*** values recorded from the Duo Security steps above into their respective fields.

![mceclip4.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6655063331853.png)

9. Click **Authenticate**.
10. At this point, you should see the following result on the Vendor Integrations page:

![mceclip5.png](https://assets.relyanceuat.xyz/images/docs/6654146332301/6655039025037.png)

11. Congratulations, you are now connected to **Duo Security**.

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **A credential rotated at the vendor is not picked up here.** **Integration Key** and **Secret Key** are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
2. **Check the address fields before suspecting the credentials.** **API Subdomain** identifies which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

<!-- failure-modes:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "cisco_duo" {
  vendor = "cisco_duo"
  name   = "<your connection name>"

  auth = {
    method = "api-key"
    params = {
      subdomain = "<subdomain>"
      user = "<user>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      ikey = var.cisco_duo_ikey
      skey = var.cisco_duo_skey
    }
    secrets_wo_version = 1
  }

  scans = { "property-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->