I'm trying the Duo TFA service in the hope to integrate it into several independent Drupal sites. So far I've tested with 2 sites, by creating 2 separate integrations, and setting up each site with their respective API keys generated by https://admin-85bc0047.duosecurity.com/. My account is linked to this email: scorlosquet@gmail.com.

The problem I found is that if the same username is used on both sites, then Duo assumes that they are the same user on both sites. Here are the steps to reproduce the problem:

- create 2 integrations and configure both sites (including API keys)
- log in with username "john.smith" on site A
- after entering the password, I'm asked to setup Duo for my account, as expected
- log in with the same username "john.smith" on site B
- I entered my password, which is not the same as for site A, this is a totally separate account
- even though this user happens to have the same username, I want this second user to go through the Duo TFA setup process as well because it's a separate user, but instead, I'm shown the screen where I can trigger a push to login. This means that the Duo service thinks the second user logging in to site B is the same user as for site A, which is not be the case.

I would like to isolate all my sites from each other, and each username not to be matched across all my integrations. Each site is for a different customer, and there are likely to be usernames overlap. How can I isolate all each integrations from the others?

Comments

DuoSupport’s picture

DuoSupport commented

The only way to isolate integrations (rather pools of users) is to have completely separate duosecurity.com accounts for each. Since you can only have one account per email address you will need to use another account or alias to sign up again at https://signup.duosecurity.com/

scor’s picture

scor commented

I have more than a dozen of separate sites to implement Duo on, so having a separate administrator account for each is going to be a nightmare. I'd have to maintain dozens of email addresses, passwords, TFA on my phone, and billing will also be quite cumbersome. I don't mind at all having all the sites belonging to one administrator account, all I need is for each user to be in its own namespace. Isn't there a way for the Duo Drupal module to send a unique sitename suffixed to the username when contacting Duo after the primary auth (password) has worked? For example, instead of requesting Duo login for "john.smith", it would send "john.smith-siteA" as username to the Duo API. I would be happy to provide a patch for such feature.

DuoSupport’s picture

DuoSupport commented

This functionality does not already exist in the module. But what you're describing is the workaround we usually advise for users of our open source integrations. I advise forking our GitHub repository and then submitting a pull request with the patch. https://github.com/duosecurity/duo_drupal