2FA: Log in to WebAccess Using Two-Factor Authentication

Article Intended For

Penn State faculty, staff, students, and other affiliates currently enrolled in two-factor authentication (2FA).

Introduction

There are five methods that can be used to complete two-factor authentication when you log in to WebAccess:  Duo Push, Duo Passcode, Phone Call, SMS Text Passcode, and Duo Token Passcode.

This article provides the following information for each of those methods:

• Step-by-step instructions for using the method
• Where to find help if it isn't working for you
• What you need in order to use that method of authentication 

Article Body

  Initial Steps - All Methods:

    On the device (laptop, desktop, phone or tablet) you're using to log in to the site you want to access:

1. • Note that if you have already logged in to another resource using WebAccess today, you may not be required to log in again in order to gain access to other WebAccess protected sites.
     Navigate to the website or service you wish to log in to.
     

2. Log in to your Penn State Access Account:
   
   1. On the WebAccess log in screen, enter your user ID (Example: abc123) and password.
   2. Click Log In.
      
      
3. If you chose Remember me for 24 hours the last time you logged in to WebAccess with this device and browser, and 24 hours have not yet passed:
   • The website you're logging in to appears. Your log in is complete.
   • For more information about the Remember me feature, see knowledge base article 2FA: How Do I Use "Remember Me" for Two-Factor Authentication?
     
     

4. If you did not choose Remember me the last time you logged in (or it's been more than 24 hours):
   
   
   • The Authentication Required screen is displayed. 
     
     
   • If you have more than one device enrolled, a drop-down list shows the devices you have enrolled for 2FA, using the nicknames you chose when you enrolled them.
     
     NOTE:  If you enrolled a Duo token, it will not be listed in the drop-down.
     
     
5. Decide whether to take advantage of the Remember me checkbox:
   
   • Don't check Remember me if you're logging in from a shared device. Only check it if you're logging in from a device you own, and you're the only one who uses that device.
   • To learn more about this feature, see knowledge base article 2FA: How Do I Use "Remember Me" for Two-Factor Authentication?
     
     
6. Click one of the following links to navigate to the remaining steps, trouble-shooting resources, and requirements for using each method of authentication:
   
   
   • Duo Push (requires smartphone, tablet or Apple watch)
   • Duo Passcode (requires smartphone, tablet or Apple watch)
   • Phone Call (requires smartphone, cellphone, landline or VOIP)
   • SMS Text Passcode (requires smartphone or cellphone)
   • Duo Token Passcode (requires Duo Token)
     
     

Duo Push

   Step-by-Step Instructions Continued:

7. Choose the device you wish to use for authentication:
   
   
   • If it's not already selected, select the smartphone or tablet you wish to use to authenticate from the drop-down list of enrolled devices.  
     
     
     
     NOTE: Make sure the screen on that device is unlocked (unless you wish to authenticate using your Apple Watch, in which case your phone must be locked).
     
     
8. Choose the method of authentication:
   • Click Send Me a Push.  A request to approve log in is sent to your device.  
   • If Send Me a Push is not displayed as an option, you may need to re-activate Duo Mobile.  For additional information, see knowledge base article 2FA: Activate or Re-Activate Duo Mobile on My Smartphone to Receive Duo Push and Duo Passcodes.

       On the device you're using to authenticate (your smartphone, tablet, or Apple watch):

9. A log in request notification is displayed on your screen. 
   • The notification shows the name of the resource requesting authentication (in this case, WebAccess), and offers the option to Approve or Deny the request.
   • Follow the on-screen instructions to approve the request.  The website you're logging in to appears as soon as you approve the authentication request.

Where to Find Help if Duo Push Isn't Working: 

• 2FA: No Duo Push option on the WebAccess Authentication Required Screen
• 2FA: I'm no longer receiving Duo Push Notifiations on My Enrolled Smartphone

What You Need in Order to Use the Duo Push Method of Authentication:

    The Duo Push method can be used with the following enrolled devices:

• A smartphone on which the Duo Mobile app is installed and activated
• An Apple watch on which the Duo Mobile app is enabled
• A tablet on which the Duo Mobile app is installed and activated

    Additional Requirements: 

• The phone or tablet you're using to authenticate must have an internet connection via Wi-Fi or cellular data.
• To receive Duo Push notifications on your Apple Watch, you must enroll and install Duo Mobile on your iPhone and enable Apple Watch notifications for Duo Mobile. To learn how, see knowledge base article 2FA: Add (Enroll) a Phone for Use with Two-Factor Authentication.

Duo Passcode

   Step-by-Step Instructions Continued:

    On the device you wish to use to authenticate (your smartphone or tablet):

7. Open the Duo Mobile app. 
   
        On your Android or iPhone:

• If Penn State is the only account you have linked to Duo Mobile, a Duo passcode is displayed on your screen as soon as you open the app on your Android or iPhone.

• If you have more than one account linked to Duo Mobile on your Android or iPhone, tap the down-arrow (  ) next to your Penn State account to expand it and show your Duo passcode.

                On your Windows phone:

• Tap the green key symbol  or Generate Passcode , depending on your version of Windows.

     On the device you're using to log in to the site you wish to access (laptop, desktop, phone, or tablet):

8. Choose your method of authentication:
   
   
   1. On the 2FA Authentication Required screen, click Enter a Passcode or Enter a Bypass Code. 
      (It is not necessary to select the device you're using.)
      
      
   2. Enter the six-digit code generated by Duo Mobile in the text box that's displayed.
      
      
   3. Click Log In.
      
      
      • The website you're logging in to appears.
        
        
   4. If the website does not appear:
      • Return to the Duo app on your phone and tap the refresh symbol (  ) to generate a new passcode. 
      • Enter the new passcode in the box provided on the 2FA Authentication Required screen, and try again. 
      • If you're not logged in at this point, call the IT Service Desk for assistance.

Where to Find Help if Duo Passcodes Aren't Working:

• 2FA: I'm no longer able to use Duo generated passcodes for 2FA Notification

What You Need in Order to Use the Duo Passcode Method of Authentication:

  The Duo Passcode method can be used with the following enrolled devices:

• A smartphone on which the Duo Mobile app is installed and activated
• An Apple Watch on which the Duo Mobile app is enabled
• A tablet on which the Duo Mobile app is installed and activated

  Additional Requirements: 

• The phone or tablet you're using to authenticate does NOT need to have an internet connection (Wi-Fi or cellular data).
• The phone or tablet you're using to authenticate does NOT need to have a cellular connection.
• To use your Apple Watch to generate a Duo Passcode, you must have enrolled and installed Duo Mobile on your iPhone and enabled Apple Watch notifications for Duo Mobile. See knowledge base article 2FA: Add (Enroll) a Phone for Use with Two-Factor Authentication to learn how.
  
  

Phone Call

   Step-by-Step Instructions Continued:

7. Choose your device:
   
   • If it's not already selected, select the phone you wish to use to authenticate from the drop-down list of enrolled devices.
     
     
     
     
8. Choose your method of authentication:
   • Click Call Me.
   • The 2FA service generates a phone call to the phone you selected.
     
     
9. Answer the phone call and follow the instructions you hear to approve the authentication request.
   • The website you're logging in to appears as soon as you approve the authentication request.
     
     

Where to Find Help if the Phone Call Method of Authentication Isn't Working:

• 2FA: Trouble using Phone Call Method of Two-Factor Authentication (2FA)

What You Need in Order to Use the Phone Call Method of Authentication:

  The phone call method can be used with the following enrolled devices:

• An enrolled smartphone with or without the Duo Mobile app installed
• An enrolled basic cellphone with voice and text only (non-smartphone)
• A landline telephone
• A VoIP (Voice Over Internet Protocol) phone

  Additional Requirements:

• If you're using a smartphone or basic cellphone to authenticate, it must have a cellular connection.

SMS Text Passcode

   Step-by-Step Instructions Continued:

7. Choose your device:
   
   • If it's not already selected, choose the phone you want to use to receive SMS texted passcodes.
     
     
     
     
8. Choose your method of authentication:
   
   
   1. Click Enter a Passcode.
      
      A text box for entering a passcode is displayed.
      
      
9. Request or locate an existing text message containing a passcode:
   
   
   • If you previously requested and received a list of passcodes in an SMS text message:
     
     
     • Open your device, find the text message you received and identify an unused passcode.
       
       
       • If you've already used at least one of the 10 passcodes you received via text message, a hint is displayed at the bottom of the Duo Prompt to help you choose a code you haven't used yet. 
       
       
       • Example:  Your next SMS passcode starts with 2.
         
         
         
         
   • To receive a new list of passcodes:
     
     
     • Click the Text Me New Codes button in the blue area at the bottom of the Duo Prompt.
       
       
       
       The 2FA service sends a text message with 10 one-time use passcodes to the phone you selected. 
       
       NOTE:  You may use the remaining passcodes for future log-ins.  Each passcode may be used for one log in.  Each time you select the same phone for authentication, a hint in the blue area at the bottom of the Duo prompt indicates which of the remaining passcodes should be used next.
       
     
     
     
10. On the 2FA Authentication Required screen on the device you're using to log in:
    
    
    1. Enter one of the passcodes from the text message in the box provided, and click Log in.
       
    2. The website you're logging in to appears.
       
       

What You Need in Order to Use the SMS Text Passcode Method of Authentication:

  The SMS text passcode method can be used with the following enrolled devices:

• Any enrolled device capable of sending and receiving text messages

  Additional Requirements: 

• The phone you're using to authenticate does NOT need to have an internet connection.
• The phone you're using to authenticate must have a have a cellular connection in order to request and receive a list of passcodes in a text message.
• Once you receive the text message, you don't need a cellular connection to use the passcodes it contains for authentication.

 
Duo Token Passcode

   Step-by-Step Instructions Continued:

7. Choose your method of authentication:
   
   
   1. Click Enter a Passcode or Enter a Bypass Code (whichever one is currently displayed on the Authentication Required screen). 
      
      A text box for entering a passcode is displayed.
      
      
   2. Press and release the button on your Duo Token to display a passcode.
      
      
   3. Enter the passcode in the box provided on the Authentication Required screen and click Log In.
      
      
   4. The website you're logging in to appears.  
      
      

Where to Find Help if the Duo Token Passcode Method of Authentication Isn't Working:

• 2FA: Trouble Using Duo Token for Two-Factor Authentication (2FA)

What You Need in Order to Use the Duo Token Passcode Method of Authentication: 

• Duo Tokens are the only type of hardware tokens that may be used for 2FA. Other legacy hardware tokens, such as Vasco tokens, will not work.  To learn how to purchase a Duo Token, see knowledge base article 2FA: Why might I need a Duo Token for Two-Factor Authentication and How Do I Get One?

Links

• 2FA: What is Two-Factor Authentication and Who Must Enroll?
• 2FA: Enroll or Unenroll for Two-Factor Authentication