NCAR Duo Authentication is export-controlled. Taking the app on your phone to Cuba, Iran, Syria, North Korea, or Sudan is strictly prohibited.



Overview

Logging in with Duo two-factor authentication (2FA) requires you to enter a CIT password and then use a Duo-configured device to confirm your identity.


Getting Started

To get started, contact the help desk to request enrollment (and to get a CIT password if you don't already have one). We will send you a link for setting up a Duo account.

During setup, Duo asks some questions about the device you want to use. Smartphone and tablet users are asked to download the free Duo Mobile app.

When your setup is complete, follow the instructions below to log in to the system, such as Cheyenne, the NCAR virtual private network, or others that accept Duo 2FA.


Authentication Methods

There are four ways of authenticating with Duo:

Push Notification (preferred)

The app sends a request (a "push" notification) to your phone or tablet, asking you to approve or deny the login request.

Rolling Passcode

When you can't receive a push notification, enter both your CIT password and a numerical passcode from the Duo app, separated by a comma. 

Phone Callback

Enter your CIT password and the word "phone," separated by a comma, then follow instructions you receive in a phone call. 

Duo/YubiKey 4

Some NCAR/UCAR staff use Duo authentication with a YubiKey 4 token. After inserting the token in your USB port, enter your CIT password and a comma, then lightly touch the gold button on your token. The examples below use the push notification method of authentication. See How to Use Append Mode for more information on other methods.


Logging in with Duo

Logging in with Duo two-factor authentication (2FA) requires you to enter a CIT password and then use a Duo-configured device to confirm your identity.

Enter your username.

Enter your CIT password.

You may get an automatic Duo Push, or select Send Me a Push from the Duo screen. The Duo App will send a push notification to your phone or tablet, asking you to approve or deny the login request.

You may also use one of the other authentication methods above. 

When you approve the request, you will be logged in.


Duo Device Portal

The Duo Device Portal is where you can change device settings, add new devices (a new smartphone, tablet or landline), or update your preferred contact methods.

You can also choose to have Duo send you a push automatically after you enter your CIT password. Look for "When I log in" after you sign in to the portal.


Frequently Asked Questions

Can I log in without my smartphone?

If you don't have your smartphone with you and need to authenticate with Duo, you can use a secondary device to login.

  • If you have already added a secondary device to your Duo account, maybe an office phone or home landline: Choose the secondary device from the dropdown menu, then select Call Me. (See image below.)
  • If you have not added a secondary device, call CISL at 303-497-2400 and we will add one for you.

Screenshot of Duo Authentication Options in the app.

I'm not getting a "push," what should I do?

If you request a Duo push but do not get one, check the following before trying again:

  1. Make sure your phone is not in airplane mode and that you have a good wireless or cellular data connection.
  2. Make sure you are entering your CIT password correctly at “Token Response.”
  3. If you just received a new temporary password, did you enroll and change it on the CIT Password Portal? If you haven’t done that yet, go to the portal and create your own unique password.
  4. Open the Duo app on your phone and make sure the UCAR logo appears (see image below). If you don’t see it, call 303-497-2400 for re-enrollment assistance.
  5. Open the Duo app and “pull down” it to refresh it.
  6. Restart your phone to complete the failed Duo app updates.

What should I do if my Duo push and passcode options only work intermittently?

If your Duo push and passcode options only work intermittently, this might indicate that you have a weak connection at times.

  1. First, select Call Me if you need to log in immediately (see image below). After you answer the call, press any key on your phone as instructed.
  2. Follow up by calling CISL at 303-497-2400 if the intermittent problems continue. Your phone may need to be reactivated.

I usually log in using my CIT password and YubiKey 4, but sometimes I want to get a push or have Duo call my smartphone instead and the Duo Mobile app doesn’t always work for me. What should I do?

If your Duo push, call, or passcode method isn’t functioning as it should, check your wireless or cellular data connection. If those are fine, restart your phone.

If the problem persists, submit a ticket or call CISL at 303-497-2400 to reactivate the app.

I replaced my smartphone. How do I connect my new phone to Duo Mobile?

When you replace your smartphone and need to use it to authenticate, use one of the following methods to get your new phone up and running with Duo Mobile:

Use Duo Instant Restore, a feature for recovering Duo-protected accounts.

Alternative 

  1. Go to the Duo Device Portal.
  2. Choose Call Me. Even if your phone number hasn't changed, Duo needs to call your new phone to complete the setup process.
I can't authenticate after entering my Passcode or YubiKey after the comma. What's the problem?

It is important to note that using the comma separation with Passcodes and YubiKeys works well with services such as Cheyenne. However, it does not work with Single Sign-On applications or some web-based logins because Single Sign-On sites and most web-based logins allow you to enter your Passcode or do a YubiKey touch after you have entered your CIT password.

Duo User Guides

For additional information, see the following links or contact the help desk for assistance.