Is there API for Retrieving User's Authentication Method Choice

[halleysj]

Is there an API to find out the user’s choice of authentication method. This choice can be made during enrollment, however there doesn’t seems to be a way to get that information later.

Thanks,
Halley

[Gardien]

Yes, you should be able to do this with Duo’s Admin API. You’ll need to log into your Duo cloud account and “create” by selecting Application > Protect an app and then set it up with the proper access and create the integration, secret and API hostname.

You’ll find everything you need here: Duo Admin API | Duo Security

If you use something like Splunk (there’s a SplunkApp), it would be even easier as it pulls all of the logs.

[halleysj]

Hi Gardien, Thanks for quick response. I’m referring to the API where I can retrieve value of this setting. When a users logs into our application, we need to know what their preference is in order send a push immediately with out having them to wait to request push.

[sdpnme3]

Hi Halleysj - this is something that I just asked our Duo Care engineer. We recognize that this information has to be in the Duo datastore and we want to know which of our users have this setting NOT set, so we can get them to set it. The assumption of course is that if you don’t have the setting set - then we should also be able to toggle it, instead of sending users back to enrollment page. But just getting the information out of the Duo datastore would be great.

[DuoKristina]

Hey there @sdpnme3 ,

There is no way for an admin to manage the authentication preferences set by a user in the traditional Duo prompt, and the information isn’t retrievable by any Admin API endpoint. I know this is probably not the answer you would like. I suggest you ask your Duo Care engineer to add you to the feature request for including this information in the Admin API.

The next version of the Duo authentication prompt - the Universal Prompt - does away with the traditional prompt user-set default authentication device preference. It does not have a way for the user to set a default device and action, and also ignores any preference set in the traditional prompt.