RIVET SSO: DUO

1. Set up user accounts in Duo

Add each user that will be logging in to RIVET to Duo. Their email address in Duo must match the email on their RIVET account — if they haven't been invited to RIVET yet, invite them first.

2. Configure the “RIVET” application in Duo

1. In your Duo Admin Panel, set up the "RIVET" application as a Generic SAML Service Provider

2. Go to the “RIVET” application in Duo settings page

3.  Enable for all users
4. Grab the “Metadata URL” from Duo for RIVET

5) Ensure SAML Response NameID format & attribute selections are correct (email address) — the value should match the login email of the user in RIVET. This can be found on the Worker Profile of the user in question

3. Configure your RIVET SSO settings

1. In RIVET, start the configuration by navigating to the Security tab in Manage Organization
2. For the Identity Provider Dropdown, select “Duo”.

3. Paste the “Metadata URL” from DUO into the “IDP XML Metadata URL” field in RIVET
4. Enter your organization’s domain into the Authorized Domain field
5. Press save
6. Get the “Entity ID” from RIVET for Duo

7. Get the “Reply URL” from RIVET for Duo. In Duo, the matching field is “Assertion Consumer Service URL”
8. Paste both values into the corresponding fields on the RIVET application in Duo, then save