Authenticating with Duo

Getting started with Duo | Logging in | Duo Device Portal

NCAR Duo Authentication is export-controlled. Taking the app on your phone to Cuba, Iran, Syria, North Korea, or Sudan is strictly prohibited.

Logging in with Duo two-factor authentication (2FA) requires you to enter a "CIT" password and then use the Duo Mobile app to confirm your identity.

Three ways of logging in with Duo are:

  1. Push notification (preferred) 
    The app sends a request (a "push" notification) to your phone or tablet, asking you to approve or deny the login request.
  2. Rolling passcode
    When you can't receive a push notification, enter both your CIT password and a numerical passcode from the Duo app, separated by a comma. Example: your_password,nnnnnn
  3. Phone callback
    Enter your CIT password and the word "phone," separated by a comma, then follow instructions you receive in a phone call. Example: your_password,phone

The examples below use the push notification method of authentication.

YubiKey users

Individuals who use YubiKey tokens can contact cislhelp@ucar.edu to ask to be enrolled to use Duo 2FA.

When a Duo account is activated for someone who has a YubiKey token, the token is disabled immediately and must be returned.


Getting started with Duo

New users will have received a CISL email that includes a link for setting up a Duo account. During setup, Duo asks some questions about the device to be used, and smartphone and tablet users are asked to download this free Duo Mobile app.

DUO logo

When your setup is complete, follow the instructions below to log in to the system, such as Cheyenne, the NCAR virtual private network, or others that accept Duo 2FA.


Logging in with Duo

HPC and SSH logins

To log in to a system like Cheyenne:

  • Enter your ssh command.
  • Enter your CIT password where a token response is requested.

Duo authentication

The Duo App will send a request (a "push" notification) to your phone or tablet, asking you to approve or deny the login request.

When you approve the request, you will be logged in.

* * *

Other application logins

Duo authentication with other systems is somewhat different. Logging on to the NCAR virtual private network (VPN) is one example.

VPN login screenYou will:

  • Enter your user name.
  • Enter your CIT password.
  • You may get an automatic Duo Push, or select Send Me a Push from the Duo screen.

Duo selection windowThe Duo App will send a push notification to your phone or tablet, asking you to approve or deny the login request.

When you approve the request, you will be logged in.

 

 


Duo Device Portal

The Duo Device Portal is where users go to change device settings, add new devices they want to use for authentication (a new smartphone, tablet or landline), or update their preferred contact methods.

You can also have Duo send a push automatically after you enter your CIT password. Look for "When I log in" after you sign in to the portal.

Smartphone updates

Duo portal loginIf you get a new smartphone and want to use it instead of another smartphone that is already set up to use with Duo:

Even if your phone number hasn't changed, Duo needs to call your new phone to complete the setup process.


More information

For additional information, see the Duo Guide to Two-Factor Authentication or contact cislhelp@ucar.edu for assistance.