Does Splunk Cloud support DUO two factor authentication?

[dschneider]

Does Splunk Cloud support DUO two factor authentication? I am a cloud customer who is also a duo customer. I do not see the ability to add DUO under authentication methods.

Thanks in Advance!

[john_byun]

Is this really not possible with Splunk Cloud? Is there a workaround to get MFA working?

[davidpaper]

Hi,

While it is true that there is no direct support for 2FA (Duo) in Splunk Cloud anymore (it was removed after 6.6 I believe), the way to still achieve 2FA is to do it at the SAML/IDP layer. As long as your IDP supports 2FA and the 2FA bits happen outside of Splunk, go for it.

[khourihan_splun]

Duo IDP is not supported in in Cloud b/c it cuts off local users needed for administration in Splunk Cloud. If DUO re-writes its IDP in the future it maybe possible.

[john_byun]

Can Splunk build in an option to enable Duo on an account basis instead of globally?

[pgreer_splunk · Accepted solution]

Yes, but the cloud instance needs to be at 6.5.x.

[splunkindonuts]

Can Splunk please confirm that this is still a valid answer? My Splunk Cloud ver 7.2 does not appear to have any options for configuring Duo support.

This page https://docs.splunk.com/Documentation/Splunk/8.0.0/Security/AboutMultiFactorAuth clearly states

"Splunk Cloud does not support
multifactor authentication with Duo
Security."

which is a contradiction to this accepted answer.

If Duo is supported in Cloud 7.x/8.x please point us to the appropriate documentation.

[bohanlon_splunk]

I downvoted this post because this answer is obsolete (and now wrong). see splunk internal engineering reference; spl-154283

[timroberts213]

How do we find this document?

[dschneider]

Thanks Much!