How to appropriately outline the path for django-duo-auth?

Question

I am currently working on implementing Duo Two-Factor Authentication into my django project. Currently it looks like django-duo-auth is the best package for this. I installed the package and went through the basic instructions on their README:

https://github.com/Elemnir/django-duo-auth/blob/master/README.rst

However this has caused my project to continuously redirect to a nonexistent subdirectory of 'duo' which is what I named the path. For example my app is loaded in XX.XX.XX.XX:YYYY Going to that url auto redirects the page to: http://XX.XX.XX.XX:YYYY/duo/login/?next=/

Or, XX.XX.XX.XX:YYYY/admin auto redirects to: http://XX.XX.XX.XX:YYYY/duo/login/?next=/admin

This simply will lead to django's generic base.html that duo_auth_form.html extends

Here are some snippets of relevant code, though it doesn't differ to much from the package's README suggestions

/urls.py

urlpatterns = [
...
    path('admin/', admin.site.urls),
    path('duo/',  include('duo_auth.urls')),
]

/settings.py

INSTALLED_APPS = [
    ...
    'duo_auth',
]

MIDDLEWARE = [
    ...
    'duo_auth.middleware.DuoAuthMiddleware',
]


DUO_CONFIG = {
    'DEFAULT': {
        'HOST': '<api-host-url>',
        'IKEY': '<integration_key>',
        'AKEY': '<app_secret_key>',
        'SKEY': '<secret_key>',
        'FIRST_STAGE_BACKENDS': [
            'django.contrib.auth.backends.ModelBackend',
        ]
    }
}

The only difference anywhere from the read me is a slight redirection in the sample do_auth_form.html where I extend to a subdirectory of my templates i.e. {% extends "dir\base.html" %} at the top of the file.

It appears like this package is fairly new and there isn't a lot of forums for issues so I figured it would be best to ask here. Any help would be appreciated!

Answer 1

I believe this is actually the django-duo-auth package working as intended. The way the middleware works is that after adding it to your project, any authenticated user who was authenticated using one of the FIRST_STAGE_BACKENDS will be checked to see if they've been authenticated with Duo as well, if not, they'll be redirected to the Duo login page at duo/login/ and prompted to complete a Duo authentication, similar to how Django's built-in @login_required decorator redirects an anonymous user to accounts/login/ to log in.

If you have users you don't want to force a second factor for, I would recommend creating a subclass of the ModelBackend that only authenticates for those users. Similar to the approach described in this issue, but inverting the logic:

https://github.com/Elemnir/django-duo-auth/issues/1