Hub for teams replacing Cisco Duo MFA with self-hosted open-source multi-factor authentication such as privacyIDEA, or the MFA built into Keycloak and authentik: editions, the on-premises proxy, export and the comparison, migration and cost pages under it.
Duo's cloud MFA with push and device trust against self-hosted privacyIDEA: factor coverage (push, FIDO2, OTP, smartcards), RADIUS and Windows logon integration, risk-based features privacyIDEA lacks, and why air-gapped or sovereignty-bound sites choose privacyIDEA.
For teams whose Duo use is mainly MFA on SSO logins: Keycloak's built-in OTP and WebAuthn against Duo push and device trust, what Keycloak does not cover (RADIUS for VPNs, Windows logon), and when pairing Keycloak with privacyIDEA fills the gap.
Replacing Duo with privacyIDEA: pulling users and hardware tokens from the Duo Admin API, resolving users from AD or LDAP, importing hardware token seeds in OATH CSV, PSKC or Yubikey formats, re-enrolling Duo Mobile users, and swapping the Duo Authentication Proxy for RADIUS.
Duo's published per-user editions against privacyIDEA on your own servers: servers and HA, an optional NetKnights Enterprise Edition subscription, SMS costs, hardware tokens, implementation and the help desk work of self-managed enrollment.
Why Duo's proxy needs outbound access to Duo's cloud on port 443 and therefore cannot serve isolated OT, defense or lab networks, and how privacyIDEA delivers OTP, FIDO2 and smartcard MFA over RADIUS and LDAP entirely on premises.
For teams that use Duo mainly as the second factor for web SSO: moving users to Keycloak OTP, WebAuthn and passkeys, planning enrollment so nobody is locked out, and keeping privacyIDEA for VPN and RADIUS flows that Keycloak does not serve.
The Duo Authentication Proxy takes RADIUS and LDAP requests from VPNs and network devices and calls Duo's cloud for the second factor. This page covers replacing it with privacyIDEA's RADIUS integration or authentik's RADIUS and LDAP outposts that never leave your network.
What Duo's Admin API can read, including users, phones, hardware tokens, integrations and authentication logs, which plans include it, its rate limits, and how to build the user and token inventory a privacyIDEA or Keycloak migration needs before the Duo contract ends.
Replacing Duo Authentication for Windows Logon and RDP with privacyIDEA's Windows credential provider: which logons each protects, offline access, behavior when the MFA server is unreachable, and the Windows Server 2016 support end that affects both.
Replacing Duo Unix (pam_duo and login_duo) for SSH and local Linux logins with privacyIDEA's PAM module or FreeIPA's built-in OTP: supported factors, what happens when the MFA service is down, and rolling the change across a server fleet.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.