Add a Generic OIDC Relying Party application in Duo Single Sign-On, copy its values into MSPCFO, and invite your people to MSPCFO before they sign in.

INFO This is Duo Single Sign-On, Duo's identity provider, not Duo's MFA prompt on its own. Duo Single Sign-On must already be set up with an authentication source (such as Active Directory or another identity provider) in your Duo Admin Panel.

1. Add the application

1. In the Duo Admin Panel, go to Applications and choose Protect an Application (or Add application).
2. Search for Generic OIDC Relying Party and choose Protect.

2. Configure it

1. Under Relying Party, add the Sign-In Redirect URL https://app.mspcfo.com/user/auth/duo/callback.
2. Under Scopes, make sure openid, email and profile are included. Map the email claim to the user's email attribute, and map the name claims if you want MSPCFO accounts to get people's names.
3. Grant type: Authorization Code.
4. Set the application name (e.g. MSPCFO) and who may use it (user groups / policy), then choose Save.

[SCREENSHOT: Duo Generic OIDC Relying Party configuration]

3. Copy the values

From the application's Metadata section, copy:

• Client ID (starts with DI) → MSPCFO Client ID
• Client Secret → MSPCFO Client secret
• Issuer, which looks like https://sso-abc12345.sso.duosecurity.com/oidc/DIXXXXXXXXXXXXXXXXXX. The host part, sso-abc12345.sso.duosecurity.com, goes in MSPCFO's Duo SSO hostname. Pasting the full Issuer URL also works; MSPCFO keeps just the host.

ALERT The hostname must end in .sso.duosecurity.com (or .sso.duofederal.com for Duo Federal).

[SCREENSHOT: Duo application Metadata section]

4. Finish in MSPCFO

Save, then run Test sign-in as someone who already has an MSPCFO account at your company.

5. Invite your people first

WARNING Duo is invitation-only. Duo doesn't confirm that an email address belongs to the person signing in, so MSPCFO doesn't create accounts from Duo sign-ins.

Before someone signs in with Duo for the first time:

1. Invite them on the MSPCFO Users page with the email address Duo sends for them (on one of your company's domains).
2. Their first Duo sign-in matches them by that email and links their Duo account. After that they sign in with Duo as usual.

Someone who hasn't been invited sees: "Your organization's single sign-on can't create new MSPCFO accounts. Ask your administrator to invite you, then sign in with SSO."

Duo-specific problems