Home Projects Roadmap Blog GitHub Contact
Projects / Homelab & Infrastructure / Authentik Duo Push MFA
Active Identity · MFA

Authentik Duo Push MFA

Replacing routine rolling-code TOTP entry with approve/deny push notifications, while keeping a safe fallback throughout the rollout.

AuthentikDuoMFAChange management

Objective

Replace routine rolling TOTP entry with approve/deny push notifications in Authentik, keeping a safe fallback active during rollout so no one gets locked out mid-migration.

Current status

A Duo Auth API integration has been created, and a Duo Authenticator Setup stage named Duo Authentik now exists in Authentik. The project is not complete: the stage still needs a stage-configuration flow, user enrollment, and attachment to the login validation flow.

TOTP stays enabled until Duo Push has been enrolled and tested successfully — no early cutover.

Environment

  • Authentik, hosted on Proxmox.
  • Duo integration type: Auth API / 2FA.
  • Intended user experience: a Duo Mobile approve/deny prompt.

Completed work

  • Confirmed Authentik supports Duo Push through a Duo Authenticator Setup stage.
  • Created a Duo account and Auth API integration.
  • Mapped Duo's credentials to Authentik's configuration (integration key → client ID, secret key → client secret, API hostname → API hostname).
  • Created the Duo Authentik setup stage.
  • Avoided changing the active login flow before a fallback path was retained.

Remaining configuration

SettingValue
NameSet up Duo Push
TitleSet up Duo Push
Slugduo-push-setup
DesignationStage Configuration
AuthenticationRequire authenticated user
  1. Bind Duo Authentik to the new configuration flow.
  2. Attach that flow to the Duo setup stage if required by the Authentik UI.
  3. Expose the flow through user settings or an enrollment route.
  4. Enroll the intended Duo Mobile device.
  5. Enable Duo in the login flow's Authenticator Validation stage.
  6. Keep TOTP and recovery codes available during testing.

Acceptance criteria

  • A test login produces a Duo Push notification.
  • Approving the notification completes login.
  • Denying the notification blocks login.
  • TOTP still works as a fallback.
  • Recovery codes are stored securely outside the documentation.
  • An unenrolled user cannot become locked out without a recovery path.

Risks

  • Removing TOTP too early could cause an account lockout.
  • Duo secrets must never be copied into the documentation.
  • A configuration-flow mistake could expose enrollment too broadly.
  • Changes to the shared Authentik login flow may affect OpenClaw and other protected applications.

Related

Authentik Identity Platform OpenClaw on Proxmox