Cisco Duo

Trustle reads users, groups, group members, applications, and administrators from Duo. Trustle can create, disable, and delete users, and add and remove group members.

Prerequisites

• A Duo account with the Owner role. Duo lets only an Owner create an Admin API application.

Configure Cisco Duo

Step 1: Create an Admin API application

1. Sign in to the Duo Admin Panel.
2. Go to Applications → Protect an Application.
3. Search for Admin API. Click Protect next to it.

Step 2: Grant permissions

1. On the Admin API application page, go to Settings → Permissions.

2. Select each permission in the table:

   Permission	Required	What Trustle does with it
   Grant resource → Read	Yes	Imports users, groups, and group members. Test Connection uses it.
   Grant resource → Write	Yes	Creates, disables, and deletes users. Adds and removes group members.
   Grant applications	Yes	Imports applications and the groups that can use them. Without it, the sync fails. Test Connection does not check it.
   Grant administrators → Read	Yes	Imports administrators and their roles. Without it, the sync fails. Test Connection does not check it.

3. Leave the other permissions clear. Trustle does not use Grant administrators → Write, Grant read log, Grant read information, Grant settings, Grant identity verification, or Grant set Admin API permissions.

   

   The screenshot also shows Write under Grant administrators and Grant read log. Trustle does not need them.

4. Click Save Changes.

Step 3: Collect the values for Trustle

Copy each value from the Details section of the Admin API application page.

Trustle field	Where to find it in Duo	Example
Integration Key	Details → Integration key	DIXXXXXXXXXXXXXXXXXX
Secret Key	Details → Secret key. Click Copy.	<secret-key>
API Hostname	Details → API hostname. Enter it without https://.	api-xxxxxxxx.duosecurity.com

Connect in Trustle

1. In Trustle, go to Connections.
2. Under Identity Providers, find Duo and click Connect.
3. Enter a Connection Name, for example Duo production. Description is optional.
4. Enter the values from Step 3.
5. Select Use as Identity Provider if Duo is the source of your users. Trustle allows one identity provider at a time.
6. Click Test Connection.
7. After the test passes, click Save Connection.

Note

Test Connection reads one user. It does not check Grant applications or Grant administrators. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the Duo connection.
2. Wait for the first sync to finish.
3. Check that the user count and the group count match the Duo Admin Panel.

If something is missing, see Troubleshooting.

Security notes

Note

• Use a dedicated Admin API application for Trustle only.
• Grant only the four permissions in Step 2.
• Store the secret key in a secret manager. Never commit it to a repository.
• Reset the secret key on your normal schedule. Then paste the new key into the Trustle connection.

Troubleshooting

Test Connection fails

• Integration Key and Secret Key: copy both from the same Admin API application. A mismatch gives error 40103 (invalid signature).
• API Hostname: enter the value from Details, for example api-xxxxxxxx.duosecurity.com. Do not add https:// or a slash at the end.
• Grant resource → Read: the test reads one user, so it fails without this permission.

Test Connection passes, but the sync fails with error 40301

The application is missing Grant applications or Grant administrators → Read. Duo then refuses those calls with 40301 (forbidden), and the whole sync fails.

Select both permissions in Step 2. Then run the sync again.

Trustle cannot change users or group members

The application is missing Grant resource → Write. Select it in Step 2.

The sync fails with error 429

Duo limits the number of Admin API calls per account. Run the sync again later. For a large account, ask Duo support for a higher limit.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the API Hostname. Never send a secret, key, or token.