Duo

Duo Security - a part of Cisco Secure - is a cloud-based authentication solution, and provides two-factor authentication, endpoint remediation, and secure single sign-on tools.

In order to integrate Duo Security with Relyance AI you will need an integration key, secret key, API subdomain, and username from Duo.

In Duo Security:

1. Login to your Duo Security account.

2. Click on the Applications menu item. 3. Click on Protect an Application. 4. Locate the entry for Auth API in the applications list and click the Protect button on the right. 5. Copy and temporarily store your integration key, secret key, and API hostname (the subdomain prefix before the "duosecurity.com" part) values. You'll need this information to complete your Relyance AI setup in later steps. 6. If you have not already defined a Duo username for the integration, click the Users menu item. 7. Click the Add User button. 8. Enter a Username; record this as this will be used for the username value in the Relyance AI steps later. 9. Click Add User. 10. Enter values for Full Name and Email. 11. Click the Save Changes button.

In Relyance AI:

1. Login to your Relyance account.
2. Navigate to the Settings Menu in the bottom left-hand side.
3. Select Integrations.
4. Click on the Vendor Integration tab.
5. Find the Duo Security integration card and click it to open its connections.
6. Under Authentication Method, choose Custom.
7. Paste the integration key, secret key, API hostname, and username values recorded from the Duo Security steps above into their respective fields.

9. Click Authenticate.
10. At this point, you should see the following result on the Vendor Integrations page:

11. Congratulations, you are now connected to Duo Security.

If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. A credential rotated at the vendor is not picked up here. Integration Key and Secret Key are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
2. Check the address fields before suspecting the credentials. API Subdomain identifies which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "cisco_duo" {
  vendor = "cisco_duo"
  name   = "<your connection name>"

  auth = {
    method = "api-key"
    params = {
      subdomain = "<subdomain>"
      user = "<user>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      ikey = var.cisco_duo_ikey
      skey = var.cisco_duo_skey
    }
    secrets_wo_version = 1
  }

  scans = { "property-inspection" = { enabled = true } }
}