Feature Request: DUO MFA Support on Nextcloud Roadmap

[AndyXheli]

Hello,

I’d like to submit a request for DUO MFA support in Nextcloud. I’ve noticed a few discussions about this on the help forums, but haven’t seen anything mentioned in the official documentation.

Does the Nextcloud team have any plans to implement DUO MFA—not just for individual users, but also for enterprise organizations? DUO is widely used by large companies, and it would be great to see support extended to both enterprise environments and smaller organizations or home users.

Could you please share any feedback on whether DUO integration is on the roadmap, or if it's being considered for future releases?

Reference Links

Link 1
https://github.com/christophwurst/twofactor_duo

Link 2
https://help.nextcloud.com/t/2fa-two-factor-duo-universal-prompt-new-method-for-nextcloud-any-versions/198951

Link 3
https://community.cisco.com/t5/apis/duo-security-2fa-two-factor-with-nextcloud-21/td-p/4876718

[joshtrichards]

Can't Duo already be integrated via the OIDC and/or SAML w/ Nextcloud?

There are numerous potential integration paths. Admittedly I haven't tried a Nextcloud+Duo combo myself.

But Authentik and Keycloak already integrate w/ Nextcloud (and DUO). Others like Auth0 and Okta too.

https://duo.com/docs/sso

https://duo.com/docs/sso-oidc-redhat-keycloak

https://duo.com/docs/oauthapi

https://github.com/nextcloud/user_oidc?tab=readme-ov-file

https://github.com/nextcloud/user_saml

[AndyXheli]

This would be more just for MFA. So for example user database would be with in Nextcloud but MFA would get handled via Duo

Like below. the below pic is O365

Network Diagram

Duo Entra ID CA Authentication Network Diagram
User accesses Microsoft Online or other services using Entra ID authentication.
User submits primary Entra ID credentials.
User selects the Duo EAM method, which redirects the client browser to Duo.
User receives the Duo Prompt and submits factor selection.
User receives Duo Push authentication request on device.
Authentication approval returned to Duo service.
Secondary authentication approval returned to client.
Client sends Duo approval back to Entra ID.
Entra ID grants application or service access once the MFA requirement and all other aspects of the user's effective conditional access policy is satisfied.