Contents
Duo integrates with Akamai Enterprise Application Access to add two-factor authentication, complete with inline self-service enrollment and Duo Prompt.
Duo and Akamai EAA
Duo Security’s authentication platform secures access to Akamai Enterprise Application Access (EAA), extending two-factor protection to web applications launched from a Akamai EAA browser session.
Before beginning Duo configuration, you should already have a functioning EAA tenant. You can add Duo MFA to any existing IdP in EAA. Once configured, Duo appears along with your other configured EAA multifactor options.
First Steps
- Sign up for a Duo account.
- Log in to the Duo Admin Panel and navigate to Applications → Protect an Application.
- Click Protect an Application and locate Akamai Enterprise Application Access in the applications list. Click Protect this Application to get your integration key, secret key, and API hostname. (See Getting Started for help.)
The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!
Duo Universal Prompt
The Duo Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.
| Universal Prompt | Traditional Prompt |
 |
 |
Akamai has already updated their hosted Duo Akamai Enterprise Application Access application to support the Universal Prompt, so there's no installation effort required on your part to update the application itself. You can activate the Universal Prompt experience for existing Duo Akamai Enterprise Application Access applications from the Duo Admin Panel if the traditional prompt is still selected.
If you created your Akamai Enterprise Application Access application before March 2024, it's a good idea to read the Universal Prompt Update Guide for more information, about the update process and the new login experience for users, before you activate the Universal Prompt for your application.
New Akamai Enterprise Application Access Applications
When you configure Duo in Akamai EAA for the first time, you're ready to use the Universal Prompt. Akamai Enterprise Application Access applications created after March 2024 have the Universal Prompt activated by default. If you're configuring Akamai Enterprise Application Access now, proceed with the installation instructions in this document.
The "Universal Prompt" area of the application details page shows this application as "Activation complete", with these activation control options:
- Show traditional prompt: Your users experience Duo's traditional prompt via redirect when logging in to this application.
- Show new Universal Prompt: (Default) Your users experience the Universal Prompt via redirect when logging in to this application.
Existing Akamai Enterprise Application Access Applications
You don't need to make any changes in Akamai EAA to enable use of Duo Universal Prompt, because Akamai already enabled use of frameless Duo authentication in their service.
Activate Universal Prompt
Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.
Once a user authenticates to the updated Akamai EAA, the "Universal Prompt" section of the Akamai Enterprise Application Access application page reflects this status as "Ready to activate", with these activation control options:
- Show traditional prompt: (Default) Your users experience Duo's traditional prompt when logging in to this application.
- Show new Universal Prompt: Your users experience the Universal Prompt via redirect when logging in to this application.
In addition, the "Integration key" and "Secret key" property labels for the application update to "Client ID" and "Client secret" respectively. The values for these properties remain the same.
Enable the Universal Prompt experience by selecting Show new Universal Prompt if the traditional prompt is still selected, and then scrolling to the bottom of the page to click Save.
Once you activate the Universal Prompt, the application's Universal Prompt status shows "Activation complete" here and on the Universal Prompt Update Progress report.
Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt. However, this will still deliver the Duo prompt via redirect, not in an iframe. Keep in mind that support for the traditional Duo prompt ended for the majority of applications in March 2024.
Universal Update Progress
Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.
Configure Akamai EAA Authentication
-
Log into your Akamai Enterprise Application Access (EAA) tenant's management portal as an administrator.
-
Navigate to Identity → Identity Providers.
-
Locate the identity provider (IdP) where you want to enable Duo MFA. Click the "Configure Identity Provider" gear icon to open that IdP's settings.
-
Click the MULTIFACTOR tab on the identity provider's settings page.
-
Make sure that IDP MFA Policy is enabled in the "General MFA Settings" section.
-
Scroll down to the "MFA Factors" section and check the box to enable Duo and show the Duo information fields.
-
Enter the Duo Akamai EAA application information from the Duo Admin Panel as follows.
Integration Key Your integration key (i.e. DIXXXXXXXXXXXXXXXXXX)Secret Key Your secret key API Hostname Your API hostname (i.e. api-XXXXXXXX.duosecurity.com)Duo UserID attribute Select the name format used when sending the username to Duo. One of Email, SAM Account Name, User Principal Name, or DOMAIN\SAM Account Name. The attribute selected must exist in the identity provider source directory with a value. -
Enable or disable the other non-Duo MFA options as you wish ("Email", "SMS", or "Authentication Token (TOTP)"). With these other options enabled users may use any available MFA option to log in. Disable other MFA factors if you'd like to to strictly require use of Duo authentication.
-
Click Save & Exit.
Please contact Akamai EAA support if you have any questions about using Duo two-factor authentication with your IdPs or need assistance configuring your authentication and multifactor settings in the Akamai management portal. Contact Duo Support for assistance with the Duo service itself.
Test Your Setup
If you plan to permit use of WebAuthn authentication methods (security keys, U2F tokens, or Touch ID) in the traditional Duo Prompt, Duo recommends configuring allowed hostnames for this application and any others that show the inline Duo Prompt before onboarding your end-users.
The Duo Universal Prompt has built-in protection from unauthorized domains so this setting does not apply.
User Multifactor Setup
When you log into Akamai Enterprise Application Access as an end user after Duo was enabled, you see Duo as a multifactor authentication option on the "Account Settings" page.
-
Click on DUO to begin setting up Duo authentication.
-
Click the BEGIN SETUP button for Duo to redirect to the Duo enrollment prompt (if your username sent from Akamai EAA doesn't already exist in Duo). Follow the instructions to complete Duo enrollment.
-
After you finish Duo enrollment, or if your username already exists in Duo with configured factors, you see the Duo authentication prompt on the mutifactor setup page. Complete Duo two-factor authentication when prompted and then you'll return to Akamai EAA to complete the login process.
*Universal Prompt experience shown.
-
After approving Duo authentication to verify Duo as a multifactor authentication option it may not be the default MFA option for EAA. Click Make Primary to default to Duo authentication at login.
-
Once Duo is both "Verified" and "Primary", click Next.
-
Click Exit to complete multifactor setup for EAA.
Authentication with Duo
The next time you log in after Duo enrollment/setup is completed, you can choose one of the Duo authentication options to access Akamai EAA. Complete Duo two-factor authentication when prompted and then you'll return to Akamai EAA to complete the login process.
*Universal Prompt experience shown.
Troubleshooting
Need some help? Reach out to Duo Support for assistance with creating the Akamai EAA application in Duo, enrolling users in Duo, Duo policy questions, or Duo authentication approval issues. For assistance configuring or managing Akamai EAA please contact Akamai Support.