duo.html.erb

<h1>Duo Web 2FA</h1>

<iframe id="duo_iframe" width="800" height="600" frameborder="0"></iframe>

<script type="text/javascript">
$(function(){
  console.log('Duo.init');
  Duo.init({
    'host': '<%= DUOWEB[:host] %>',
    'sig_request': '<%= @sig_request %>',
  });
  console.log('Duo.ready');
  Duo.ready();
})
</script>

sessions_controller.rb

require 'duo_ruby/duo_web'

class SessionsController < ApplicationController
  skip_before_filter :verify_authenticity_token, :only => [:duo]

  def new
  end

  def create
    usr = params.fetch(:username, nil)
    pwd = params.fetch(:password, nil)
    if not (usr.nil? || pwd.nil? || (usr != 'etd') || (pwd != 'foobar' ) )
      session[:tmp_usr] = usr
      redirect_to duoweb_path
    else
      flash.now[:error] = 'Try again'
      render action: 'new'
    end
  end

  def duo
    redirect_to :root unless session[:tmp_usr]

    if params[:sig_response].present?
      # coming back from Duo callback
      if Duo::verify_response(DUOWEB[:ikey], DUOWEB[:skey], DUOWEB[:akey], params[:sig_response])
        session[:usr] = session[:tmp_usr]
        session[:tmp_usr] = nil
        redirect_to :root
      else
        flash.now[:error] = '2FA failed'
        render :action => 'new'
      end
    else
      @sig_request = Duo::sign_request(DUOWEB[:ikey], DUOWEB[:skey], DUOWEB[:akey], session[:tmp_usr])
      # render template: 'sessions/duo'
    end
  end

  def destroy
    session[:usr] = nil
    reset_session
    redirect_to :root
  end
end