Yes, you need to configure some user/password provider as primary authentication, then Duo. The directions are correct, but need to be followed EXACTLY. If you want a working Shib+MCB+Duo installation to poke at (and to diff -u -r from yours), download http://go.carleton.edu/shibcentos6 and an associated draft SANS research paper at http://tinyurl.com/shib-centos6/