Set up Confidential SSO and Provisioning with Duo

Step 1: Register a New Application in Duo

1. Sign in to the Duo Admin Panel, select Application, and then select Protect an Application.

2. Search for and select Generic SAML Service Provider and then select Protect.

   

3. Paste "https://sso.nitro.dashlane.com/saml/callback" for the ACS URL and "dashlane-nitro-sso-[teamUUID]" for Entity ID.

   

4. In the Policy section, for Group policies, select Apply a policy to a group of users.

   

5. From the Select a policy drop-down list, choose the policy and groups you want to apply to the Dashlane application and select Apply policy.

   

6. Select Save to confirm your generic SAML service provider settings.

Step 2: Download Duo Metadata

1. On the same page, in the Downloads section, select Download XML for SAML Metadata.

   

2. Open the XML metadata file that was downloaded to your computer using an application like TextEdit for Mac or Notepad for Windows.

   

3. Select all and copy the contents of the XML file.

   

Step 3: Configure Dashlane with Duo Metadata

1. Log in to the Dashlane browser extension and open the Admin Console

2. In the Configurations section of the left menu, select Single sign-on. If you've already started the setup, select Edit. Otherwise, select Set up Confidential SSO.

   

3. Navigate to Step 2: Save your IdP metadata and paste the metadata copied earlier.

4. Select Save.

   

Step 4: Verify your domain in DNS Provider

1. In Step 3: Verify your domain(s) in the Admin Console, enter your company email domain and select Verify domain. Note the copy buttons you'll use to copy the hostname and TXT values to your public DNS provider.

   

2. In a new browser tab, navigate to your Public DNS provider and Add a TXT Record. The exact steps vary depending on your provider.

   

3. Paste the Host Name and TXT Value from the Dashlane Admin Console into the new TXT record, and select Save.

   

4. After you've entered the record, wait a few minutes, and in the Dashlane Admin Console, select Verify domain.

   

   If you wish, you can verify as many domains as you own in the Domain Management page.

   Domain verification for professional plans

(Optional) Just In Time Provisioning

You can turn on Just In Time Provisioning to automatically add any employee with your verified domains at their first login attempt.

Before you turn on Just in Time Provisioning, ensure your plan members have already been added to the Dashlane SAML application in your IdP.

After you turn it on, they can install the Dashlane browser extension and create their account.

If your plan is out of seats, members won’t be able to log in until you buy more seats.

If you’re using Just in Time Provisioning along with another automatic provisioning method, like SCIM or AD sync, make sure to add all of your plan members to your synced groups. Otherwise, plan members who aren’t added to synced groups will be removed the next time the directory syncs.

More about Just in Time Provisioning

Step 5: Assign Users in Duo

1. In the Duo Admin Panel, navigate to the Applications tab.
2. Select your Dashlane SSO application and assign it to the users.

Step 6: Test Your SSO configuration

1. Return to the Dashlane Admin Console, and perform a Test connection.

2. A success message appears if SSO was set up as expected.

   

Step 7: Enable SSO for All Users

1. After testing is successful, activate SSO in Dashlane Step 4: Activate SSO for verified domains.

2. Notify members about the new SSO login method. Members with an account created with a Master Password must do a final login with the Master Password before activating SSO. To see how the process works for members, refer to this article:

   Migrate your existing plan members to SSO

3. Ensure that members can log in with their Duo credentials.

   

Step 1: Generate SCIM API Token in Dashlane

1. Log in to the Admin Console
2. In the Configurations section, select Confidential Provisioning.

3. Select Set up or Edit if you've already started the setup.

   If this option is grayed out and unavailable, you either need to set up Confidential SSO first, or you've already set up Self-hosted SSO, SCIM, or Active Directory.

4. If you haven't done so during the SSO setup, please follow the steps to verify your organization's domain.

   Domain verification for professional plans

   

5. In Step 1: Generate SCIM API token, select Generate Token.
6. Copy the SCIM API token in Step 2: Copy token.
   
   

Step 2: Configure SCIM API Token in DUO

1. In your DUO account, select Applications in the sidebar and select Generic SAML Service Provider.

   

2. In the Single Sign-On tab, in the User access section, select Enable for all users.

   

3. Next, select Copy in the Metadata URL section.

   

4. Insert your unique identifier in Entity ID, in this format: dashlane-nitro-sso-...

   If you've already set up SSO with DUO, or if you want to set up SCIM Provisioning without SSO, you can skip this step.

   

5. Insert https://sso.nitro.dashlane.com/saml/callback in the Assertion Consumer Service (ACS) URL* field.

   

6. In the Provisioning tab, under the Authentication mode field, select Bearer Token.

   

7. In the Admin Console, turn on automatic user provisioning, then select the Copy icon to copy your unique SCIM API token.

8. Turn on the toggle for Step 3: Activate automatic user provisioning.

   

9. Insert your unique SCIM API token in the Base URL field.

   

10. Under the Groups section, select Use groups with SSO access and choose Exclude group information.

    Note: If SSO access was previously turned on for all users please select Select groups. This way, you can choose which users to provision if you don’t want to provision the entire directory.

    

11. If you want to create new groups, go to Users.

    

12. Then select Groups.

    

13. In Groups, select Add users to group.

    

14. Add your users to your group.

    

15. Once you provision your users, you will see the outbound logs in Reports.

    

16. In the Dashlane Admin Console, you will be able to see your provisioned users in the Users tab.

    

17. In Users, in the Groups section, add “GroupToSyncWithDashlane”. Add the group name the admin wants to sync to Dashlane

    

    

18. If you remove a user, your Users tab will reflect this.

    

(SSO) Error message: We couldn't verify your SSO connection

Error when testing the connection with Dashlane in the Admin Console. You might also see this error when trying to save the metadata.

How to fix

• Confirm you're opening and logging in to the Admin Console from the Dashlane browser extension.

  Install the Dashlane browser extension

• If your IDP's admin portal is open, log out of your Duo admin account and close the browser tab before testing the connection with Dashlane again.