lldap/example_configs/duo_auth_proxy.md

Duo Auth Proxy Configuration Guide

Configuring DuoAuthProxy

To set up DuoAuthProxy with LLDAP, you need to configure the authproxy.cfg file properly.

Access your Duo admin console

1. Log in to your Duo admin console.
2. Navigate to Applications -> Protect an Application.
3. Search for proxy and select LDAP Proxy.
4. Copy the credentials (ikey, skey, api_host) for the next step.

Example Configuration

[main]
log_stdout=true

[ad_client]
host=LLDAP
port=3890
auth_type=plain
bind_dn=uid=svc-duoauthproxy,ou=people,dc=example,dc=com
service_account_username=svc-duoauthproxy
service_account_password=password
search_dn=ou=people,dc=example,dc=com
username_attribute=uid
at_attribute=mail

[ldap_server_auto]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
api_host=api-XXXXXXXX.duosecurity.com
failmode=secure
client=ad_client
port=1812
exempt_primary_bind=false
exempt_ou_1=uid=svc-duoauthproxy,ou=people,dc=example,dc=com

Running DuoAuthProxy in Docker

docker run -d \
       --name=DuoAuthProxy \
       --network auth \
       -v /path/to/authproxy.cfg:/app/conf/authproxy.cfg \
       --restart unless-stopped \
       minimages/duoauthproxy

You can also choose to host it natively or generate your own image using the official instructions.

Connecting a Service to Duo Auth Proxy

This section demonstrates how to connect a service to Duo Auth Proxy, using Jellyfin as an example. You can follow the same approach for other services.

Preparing Jellyfin

Ensure Jellyfin is set up and added to the auth network:

docker network connect auth jellyfin

Installing LDAP Authentication Plugin

Jellyfin requires the LDAP Authentication plugin. Restart Jellyfin after installing the plugin.

Configuring LDAP Authentication in Jellyfin

LDAP Server Settings

• LDAP Server: DuoAuthProxy
• LDAP Port: 1812
• Secure LDAP: unchecked
• StartTLS: unchecked
• Skip SSL/TLS Verification: checked
• Allow Password Change: (optional, requires lldap_password_manager group)
• LDAP Bind User: uid=svc-duoauthproxy,ou=people,dc=example,dc=com
• LDAP Bind User Password: password
• LDAP Base DN for searches: ou=people,dc=example,dc=com

Click Save and Test LDAP Server Settings to check connectivity.

LDAP User Settings

• LDAP Search Filter: (uid=*)
• LDAP Search Attributes: uid, mail
• LDAP Uid Attribute: uid
• LDAP Username Attribute: uid
• LDAP Password Attribute: userPassword
• LDAP Admin Base DN: ou=people,dc=example,dc=com
• LDAP Admin Filter: (memberof=cn=lldap_admin,ou=example,dc=com)

Click Save and Test LDAP Filter Settings to verify user detection.

Final Setup

• Enter admin in Test Login Name
• Click Save Search Attribute Settings and Query User to finalize lookup
• Adjust Jellyfin User Settings as needed
• Click the big blue Save button

If existing users are present, switch their authentication provider to LDAP-Authentication.

Testing the New Authentication Flow

Log out and attempt login to verify the new authentication flow. If issues arise, restart Jellyfin and try again.