---
title: "Duo OIDC Configuration for SSO"
slug: "duo-oidc-configuration-for-sso"
updated: 2026-08-14T20:24:08Z
published: 2026-08-14T20:24:08Z
canonical: "kb.expedient.com/duo-oidc-configuration-for-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.expedient.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Duo OIDC Configuration for SSO

## Duo OIDC Configuration for SSO

This guide is for the team that manages your organization's Duo tenant. It walks through creating the OIDC application AI CTRL uses for single sign-on, and ends with the values you'll send to Expedient.

> Throughout this guide, replace `your-domain.com` with your AI CTRL gateway address. Expedient will confirm it if you're unsure.

## Step 1 · Sign in to the Duo Admin Panel

Go to the [Duo Admin Panel](https://admin.duosecurity.com) and sign in with your admin credentials.

## Step 2 · Add a new application

Navigate to **Applications → Application Catalog**.

Search for **Generic OIDC Relying Party**, or the specific service you want to integrate. Click the **+ Add** button next to the correct entry to start creating your OIDC application.

## Step 3 · Configure application settings

Give the application a clear, descriptive name.

In the **Relying Party** section:

- **Grant type** — usually **Authorization Code**
- **Sign-in redirect URI** — `https://your-domain.com/oauth/oidc/callback`

In the **Scopes** section, select which scopes to support. **openid** is required; you may also add **email** and **profile** depending on your needs.

> **The Client ID and Client Secret are generated after the application is created.** You'll collect them in Step 6.

## Step 4 · Save the application

Double-check your configuration, then click **Save** at the bottom of the application page.

## Step 5 · Grant user access

By default, user access is set to **Disable for all users**. Update the **User Access** setting to either:

- Enable only for permitted groups — select specific Duo groups, or
- Enable for all users — every Duo user can use the app

Click **Save** to confirm.

## Step 6 · Collect the credentials

Go to the **Metadata** section on your new application's details page.

## What to send Expedient

Send these to your Expedient project team through your project ticket:

| Value | Where to find it |
| --- | --- |
| Client ID | Application details → Metadata |
| Client Secret | Application details → Metadata |
| Issuer URL | Application details → Metadata |

## Related articles

- [Microsoft Entra ID Configuration for SSO](https://kb.expedient.com/docs/microsoft-entra-id-configuration-for-sso)
- [Okta OIDC Configuration for SSO](https://kb.expedient.com/docs/okta-oidc-configuration-for-sso)