Configure Duo multifactor authentication for Splunk Enterprise in the configuration file
In authentication.conf, edit the [2FA stanza name] stanza as follows:
[authentication]
externalTwoFactorAuthVendor = <Duo>
externalTwoFactorAuthSettings = <2FA stanza name>
[<2FA stanza name>]
integrationKey = <Integration Key as provided by Duo>
secretKey = <Secret Key as provided by Duo>
applicationKey =<Manually generated secret key>
apiHostname = <API Hostname as provided by Duo>
failOpen = True|False (Default : False)
timeout = <in seconds>