I am curious if anyone has ever set up SSO specifically using Duo, I have only done Okta in the past. With Duo, you are forced to encrypt assertions when creating the SAML app. However, when you do this, the Control Room wants both the public and private keys, and I see nowhere that the private key is exposed in the Duo interface, only the public. I have a ticket in to support, but thus far the only response has been "this is a Duo issue". Of course Duo support has been even less responsive.