Prerequisites
- Admin access to your RansomLeak tenant
- A Duo edition that includes Duo Single Sign-On
- Owner or administrator rights in the Duo Admin Panel
- Duo email matches each user's RansomLeak email
Your tenant is reachable at https://<your-subdomain>.ransomleak.com.
Replace
<your-subdomain> with your own subdomain throughout this guide. For help during
setup, email support@ransomleak.com.
Duo Single Sign-On must already be active for your Duo account, with an authentication source configured — Duo Directory, Active Directory, or an external SAML identity provider. RansomLeak federates with Duo itself, so whichever source you use behind Duo is transparent to this integration.
Supported features
- SP-initiated SSO
- IdP-initiated SSO and Duo Central
- Just-in-time user provisioning
- SHA-256 signed assertions
- Single Logout (SLO)
- SCIM 2.0 provisioning of users and groups
First sign-in. A user who reaches RansomLeak through Duo without an existing account is created on the spot, with your tenant's default role and a license from your pool. If no license is free, the sign-in is refused rather than a license being taken from someone else.
Add the application in Duo
RansomLeak does not yet have a pre-built tile in the Duo Application Catalog. You add it with Duo's Generic SAML Service Provider application, which takes exactly the same values a pre-built tile would fill in for you and produces an identical sign-in experience.
-
Sign in to the Duo Admin Panel and go to Applications → Add Application.
-
Search for Generic SAML Service Provider — the entry carrying the SSO label, not the one for Duo's traditional two-factor connectors — and click Add.
-
Name it RansomLeak so it is recognizable in Duo Central and in your administrator logs.
Configuration steps
RansomLeak provisions SAML per tenant. You fill in the RansomLeak service provider values in Duo, then send us your Duo identity provider values so we can configure the Service Provider side for your tenant.
-
On the Duo application's Service Provider section, enter:
Entity IDhttps://<subdomain>.ransomleak.comAssertion Consumer Service (ACS) URLhttps://<subdomain>.ransomleak.com/api/auth/saml/callbackService Provider Login URLhttps://<subdomain>.ransomleak.com/app/loginAlternatively, point Duo at the RansomLeak metadata document and let it read the entity ID and ACS URL for itself:
SP metadatahttps://<subdomain>.ransomleak.com/api/auth/saml/metadata -
Under SAML Response, set:
- NameID format —
emailAddress - NameID attribute — the user's email address
- Signature Algorithm — SHA-256
- Sign response and Sign assertion — enable at least one; enabling both is fine
- Encrypt the SAML assertion — leave off
- NameID format —
-
Map the attributes in the table below, then save the application.
-
Set User access so the Duo groups that should reach RansomLeak are permitted. Duo blocks all users from a new application until you grant access.
-
Copy these values from the Duo application's Metadata section and send them to support@ransomleak.com, asking us to enable SAML SSO for your tenant:
- Single Sign-On URL
- Entity ID
- The downloaded certificate
- Single Log-Out URL, if you want SLO
We configure the SP side and confirm when it is live. Duo also publishes a metadata URL for the application, which you can send instead of the three values.
Attribute mapping
The SAML NameID must be the user's email address (emailAddress format).
RansomLeak reads the following attributes from the assertion:
| Duo attribute | SAML attribute name | Populates in RansomLeak |
|---|---|---|
| Email Address | email | Email / login |
| First Name | firstName | First name |
| Last Name | lastName | Last name |
RansomLeak also accepts the common alternatives givenName and
surname for the two name attributes. If neither name attribute is sent, sign-in still
succeeds — only the email is required.
Role mapping (optional). RansomLeak can map a SAML attribute to a tenant role. To drive roles from Duo, add a group or role attribute to the application and tell us which attribute to map.
Signing in
Both directions work once the tenant is configured.
-
SP-initiated. Go to your RansomLeak sign-in page and choose Sign in with SSO. You are redirected to Duo, complete your second factor, and land back on the RansomLeak dashboard.
https://<subdomain>.ransomleak.com/app/login -
IdP-initiated. Launch RansomLeak from Duo Central, or from the Duo application's Single Sign-On URL.
An IdP-initiated launch always opens the dashboard rather than a deep link, because
RansomLeak does not read a target path out of RelayState. Deep links still work
normally for a user who is already signed in.
Troubleshooting
| Symptom | Fix |
|---|---|
| "Invalid audience" or a redirect loop |
The Duo Entity ID field must hold the RansomLeak entity ID (https://<subdomain>.ransomleak.com), exactly, with no trailing slash.
|
| Signature errors | Confirm the signature algorithm is SHA-256 and that at least one of Sign response or Sign assertion is enabled. If the Duo certificate was rotated, send us the new one. |
| "Email not provided in SAML assertion" |
Set the NameID format to emailAddress and the NameID attribute to the user's
email, or map an email attribute.
|
| "User account is disabled" | The account exists in RansomLeak but was deactivated. SSO deliberately will not re-enable it; re-enable the user in RansomLeak, or let provisioning do it. |
| Users reach Duo but not RansomLeak | Check User access on the Duo application — a new application admits nobody until groups are granted access. |
Frequently asked questions
Does RansomLeak work with Cisco Duo Single Sign-On?
Yes. RansomLeak is a SAML 2.0 service provider, and Duo Single Sign-On is a SAML 2.0 identity provider, so the two federate directly. In Duo you add RansomLeak using the Generic SAML Service Provider application, paste in the RansomLeak entity ID and ACS URL, and send the Duo IdP values to RansomLeak support. Your users then reach RansomLeak with their Duo credentials and whatever Duo policy and second factor you already enforce.
Is there a pre-built RansomLeak tile in the Duo Admin Panel?
Not yet. RansomLeak is configured through Duo's Generic SAML Service Provider application, which is a fully supported path — the only difference is that you paste a handful of values yourself instead of a tile pre-filling them. Your users see no difference at sign-in.
Does RansomLeak support both SP-initiated and IdP-initiated sign-in?
Both. Users can start at the RansomLeak sign-in page and be redirected to Duo, or launch RansomLeak from Duo Central. Note that an IdP-initiated launch always lands on the RansomLeak dashboard rather than a deep link, because RansomLeak does not currently read a target path out of RelayState.
What signature algorithm and NameID format are required?
SHA-256, and a NameID in emailAddress format carrying the user's work email. SHA-1 is not supported. Duo can sign the SAML response, the assertion, or both; RansomLeak accepts any of those as long as at least one valid SHA-256 signature is present. Encrypted assertions are not currently supported, so leave that option off in Duo.
Need a hand?
Email support@ransomleak.com and we will help you connect Duo to your tenant.