support for Duo Universal Prompt

[fredtj]

Hello,

Vaultwarden's current Duo MFA implementation uses the traditional Duo iframe prompt. Use of this prompt will be deprecated on March 20th, 2024.
To continue using Duo, Vaultwarden needs to migrate to the Duo Universal Prompt before that date.

https://duo.com/docs/universal-prompt-update-guide

Are there any plans to update the Duo implementation in Vaultwarden before March 20th 2024?

Thanks in advance!

[BlackDex]

I think this has to be done by Bitwarden since that is build-in into the web-vault and they maintain and develop the web-vault.

[misilot]

It was recently added by Bitwarden

https://community.bitwarden.com/t/support-for-duo-universal-prompt/37017/22
Release notes: https://bitwarden.com/help/releasenotes/#2024-2-3

[fredtj]

It seems already available in Bitwarden via SSO, see https://duo.com/docs/sso-bitwarden and https://bitwarden.com/help/about-sso/

Vaultwarden as far as I can tell does not yet have this option.

Regards

[Gerardv514]

I have checked my duo account and I see universal prompt is selected. Are we supposed to do something else, I am still seeing the traditional prompt, should I be seeing the universal prompt yet?

[agentdr8]

I had to create another Duo app and select Bitwarden in the Duo admin console before the universal prompt showed as being available. Then changed the global Duo keys in the VW admin panel. But after doing that, I'm still seeing an error trying to use the Universal Prompt with the testing docker image:

And after seeing that error, now the new BW app in Duo is no longer showing the option for Universal Prompt, so it seems like the integration in VW web 2024.3.1 is still not compatible with UP.

[Gerardv514]

I now see in Duo Admin portal, when you create another DUO app for Bitwarden it now says DUO Universal backend has been update.

I believe we now have to wait for VW to make the necessary updates to support the Universal Prompt; that is probably why you're receiving the setup error.

[agentdr8]

@BlackDex - If BW implemented the new Duo Universal Prompt changes in 2024.2.3, are those changes not part of VW's web-vault 2024.3.1?

[misilot]

Server Side pieces would need to be updated as well per dani-garcia/bw_web_builds#157 (comment)

[azaloum90]

Any Update on this? Not sure what is entailed from the server side?

[BlackDex]

There need to be server side changes for this. Which are not implemented.

[mjd2000]

Shouldn't DUO support be removed from the main page then? It does not seem to be working at all without the upgrade to universal prompt

[azaloum90]

It does work without the universal prompt, but it could stop working at any time which is obviously problematic. Adam Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: mjd2000 ***@***.***> Sent: Thursday, May 16, 2024 8:34:57 PM To: dani-garcia/vaultwarden ***@***.***> Cc: azaloum90 ***@***.***>; Comment ***@***.***> Subject: Re: [dani-garcia/vaultwarden] support for Duo Universal Prompt (Discussion #3953) Shouldn't DUO support be removed from the main page then? It does not seem to be working at all without the upgrade to universal prompt — Reply to this email directly, view it on GitHub<#3953 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACEMYBYW5ENFAM6OQ5QTETDZCVGDDAVCNFSM6AAAAAA5SLN4HSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TINRTHE3TO>. You are receiving this because you commented.Message ID: ***@***.***>

[Simon-CR]

also looking forward to this...