Duo OIDC Configuration for SSO
This guide is for the team that manages your organization's Duo tenant. It walks through creating the OIDC application AI CTRL uses for single sign-on, and ends with the values you'll send to Expedient.
Throughout this guide, replace
your-domain.comwith your AI CTRL gateway address. Expedient will confirm it if you're unsure.
Step 1 · Sign in to the Duo Admin Panel
Go to the Duo Admin Panel and sign in with your admin credentials.
Step 2 · Add a new application
Navigate to Applications → Application Catalog.
Search for Generic OIDC Relying Party, or the specific service you want to integrate. Click the + Add button next to the correct entry to start creating your OIDC application.
Step 3 · Configure application settings
Give the application a clear, descriptive name.
In the Relying Party section:
- Grant type — usually Authorization Code
- Sign-in redirect URI —
https://your-domain.com/oauth/oidc/callback
In the Scopes section, select which scopes to support. openid is required; you may also add email and profile depending on your needs.
The Client ID and Client Secret are generated after the application is created. You'll collect them in Step 6.
Step 4 · Save the application
Double-check your configuration, then click Save at the bottom of the application page.
Step 5 · Grant user access
By default, user access is set to Disable for all users. Update the User Access setting to either:
- Enable only for permitted groups — select specific Duo groups, or
- Enable for all users — every Duo user can use the app
Click Save to confirm.
Step 6 · Collect the credentials
Go to the Metadata section on your new application's details page.
What to send Expedient
Send these to your Expedient project team through your project ticket:
| Value | Where to find it |
|---|---|
| Client ID | Application details → Metadata |
| Client Secret | Application details → Metadata |
| Issuer URL | Application details → Metadata |