Prerequisites
- A RansomLeak tenant with admin access
- The "Manage Integrations" permission
- Duo administrator rights
Your tenant is reachable at https://<your-subdomain>.ransomleak.com.
Replace
<your-subdomain> with your own subdomain throughout this guide. For help during
setup, email support@ransomleak.com.
Provisioning is configured on the same Duo application that carries single sign-on. If you have not added RansomLeak to Duo yet, follow Configure SAML SSO with Cisco Duo first, then return here. The two are independent: you can run either on its own.
Supported features
- Create users
- Update user attributes
- Deactivate on offboarding
- Push groups as roles
- Bearer token authentication
- SCIM 2.0 discovery endpoints
RansomLeak implements Users and Groups with full CRUD and PATCH, alongside the
/Schemas, /ServiceProviderConfig and /ResourceTypes
discovery endpoints, so Duo can introspect the service before it writes to it.
Get your SCIM credentials
In RansomLeak, sign in as a tenant admin and go to Admin → Tenant Settings → SCIM. Click Generate Token. RansomLeak shows your SCIM bearer token and base URL:
https://<subdomain>.ransomleak.com/scim/v2 Copy the token now — it is shown only once, and generating a new one invalidates the previous token.
Connect Duo
Duo offers this as generic SCIM 2.0 provisioning for applications it has not separately verified. The Generic SAML Service Provider application type carries it: its Provisioning tab offers generic SCIM with Bearer Token authentication, which is what RansomLeak uses.
-
In the Duo Admin Panel, open the RansomLeak application and go to the Provisioning tab. Enable provisioning and choose Bearer Token as the authentication method.
-
Paste the RansomLeak Base URL and Token, then click Connect to application. Enter the raw token only — do not add a
Bearerprefix. -
Assign the Duo groups that should be provisioned. Duo pushes their members into RansomLeak, and keeps them in step as membership changes.
Attribute mapping
Out of the box Duo sends userName and nothing else. Without this step your users arrive
with their email address in place of their name, so configure the mapping before you enable the
connection for a real group.
In the Attribute mapping section of the Provisioning tab, click
Edit mappings. Select at least displayName,
emails, name.givenName and name.familyName, plus
title and department if you want job titles and teams.
When you add emails, Duo leaves its source column blank while every other row
fills itself in. Set it to Email Address by hand, or Duo sends the attribute
empty.
Duo keeps two independent attribute mappings, and they are easy to confuse. The one on the Single Sign-On tab shapes the SAML assertion sent at login; the one on the Provisioning tab shapes the SCIM payload. Setting names on the SSO tab does not populate them through provisioning, or the other way round — configure whichever tab matches the behaviour you are after.
| SCIM attribute | Populates in RansomLeak |
|---|---|
userName | Email / login |
emails[type eq "work"].value | |
name.givenName / name.familyName | First and last name |
title | Job title |
…:enterprise:2.0:User:department | Team (created automatically if the name is new) |
…:enterprise:2.0:User:manager | Reporting line, used to build your org hierarchy |
Groups and roles
RansomLeak groups correspond to tenant roles, so a group pushed from Duo assigns that role to its members. Name your Duo groups after the RansomLeak roles you want applied, or members arrive carrying a role you did not intend. A group must be empty before RansomLeak will delete it.
Provisioning is one-directional. Duo is the source of truth and pushes changes into RansomLeak. RansomLeak never writes users back into Duo.
Troubleshooting
| Symptom | Fix |
|---|---|
| Provisioning returns 401 | The SCIM token was regenerated or revoked in RansomLeak. Generate a new one and repeat the connection steps above. |
| Users arrive with an email address as their name |
Duo is sending only userName. Add name.givenName,
name.familyName and displayName under
Edit mappings on the Provisioning tab.
|
The emails attribute arrives empty | Its source column is blank. Set it to Email Address in Edit mappings; Duo does not fill this one in for you. |
| New users are refused | Your license pool is exhausted. RansomLeak refuses the create rather than taking a license from an existing user. Free a license or raise your seat count. |
| Members land with an unexpected role | A pushed Duo group creates or matches a RansomLeak role of the same name. Rename the Duo group, or adjust the role in RansomLeak. |
| Attribute changes do not appear | Duo pushes on its own sync cadence rather than instantly. Check the provisioning log on the application for the most recent sync before assuming a mapping is wrong. |
Frequently asked questions
Can Duo create and deactivate RansomLeak accounts automatically?
Yes. RansomLeak exposes a standard SCIM 2.0 endpoint authenticated with a bearer token, which is one of the two authentication methods Duo Automated Provisioning supports. Setup is pasting a base URL and a token on the application's Provisioning tab, then assigning the Duo groups you want provisioned. Membership changes flow through from then on, and Duo groups land as RansomLeak roles.
Does the SCIM token expire?
It does not expire on a schedule. The token stays valid until an administrator regenerates or revokes it in RansomLeak, at which point the old token stops working immediately and must be replaced in Duo. Treat it as a long-lived credential and rotate it on whatever cadence your policy requires.
Which Duo application type supports SCIM provisioning?
The Generic SAML Service Provider application. Duo offers generic SCIM 2.0 for applications it has not separately verified, and that application type carries it: its Provisioning tab offers generic SCIM with Bearer Token authentication, which is what RansomLeak uses. No pre-built RansomLeak tile is required.
Why do provisioned users arrive without a name?
Duo sends only userName until you add the other attributes yourself. Open Attribute mapping on the Provisioning tab, click Edit mappings, and select displayName, emails, name.givenName and name.familyName. Until you do, RansomLeak has nothing to build a name from and falls back to the email address.
Does provisioning ever write back into Duo?
No. Provisioning is one-directional. Duo is the source of truth and pushes changes into RansomLeak; RansomLeak never creates, updates, or deletes users in Duo.
Need a hand?
Email support@ransomleak.com and we will help you connect Duo to your tenant.