About multifactor authentication with Duo Security

Multifactor authentication lets you configure a primary and secondary login for Splunk Enterprise users. Duo Security multifactor authentication secures Splunk Web logins on Splunk Enterprise instances.

Splunk Cloud Platform does not support multifactor authentication with Duo Security.

With Splunk Enterprise with Duo Security multifactor authentication, you must set up a second authentication method and then use that method for future logins. The login workflow is as follows:

1. You log into Splunk Web page using your login credentials. This is the primary login.
2. You then see a second login page, "Duo Authentication". This is the secondary login.
3. The first time you log in, you follow the instructions on the Duo login page to set up your preferred method for accessing your secondary credentials:
   • Login with credentials sent through a push notification on your your smart phone (Duo Security Mobile app required).
   • Login with credentials sent through an SMS message to your cell phone.
   • Login with credentials sent through a phone call made to your cell phone.
   • Login by entering a one time code that the Duo Mobile app generates.
4. After the initial login and configuration, every time you reach the secondary login, you receive those login credentials using your preferred method.

Duo Traditional Prompt and Universal Prompt

The Traditional Prompt is the default authentication experience for Duo Security users when they log in to Splunk Enterprise. The Universal Prompt is a more secure and advanced authentication experience than the Traditional Prompt. It supports advanced authentication features like Verified Duo Push, Risk-Based Authentication, and Passwordless login which streamline the experience for end-users and administrators. To learn about the Universal Prompt, see "About the Duo Universal Prompt" on the Duo website.

If you use the Traditional Prompt for Duo multifactor authentication, upgrade Splunk Enterprise on-premises to versions: 9.1.6, 9.1.7, 9.2.3, 9.3.1, or higher. These versions support Duo Universal Prompt. Next, migrate from the Traditional Prompt to the Universal Prompt. Due to the deprecation of the Traditional Prompt, continued use of this experience might result in authentication failures in the future. Versions: 9.2.0, 9.2.1, 9.2.2, and 9.3.0 do not support Duo Universal Prompt.

Set up Duo Security for multifactor authentication

1. Create an account for your Splunk Enterprise configuration on the Duo website. Visit the Duo website for more information on how to create accounts in Duo.
2. Provide Splunk Enterprise with the information from your Duo Security Account. See Configure Splunk to use Duo Security multifactor authentication for more information.