TAMU-Health Duo 2-Factor Authentication

Overview

Technology Services has two-factor authentication through Duo Security. Using Duo can help lower the chances of a malicious user accessing Texas A&M Health resources. Two-factor authentication adds a second layer of security to your online accounts and is separate and independent from your username and password. Verifying your identity using a second factor (like your phone or another mobile device) prevents anyone but you from logging in, even if they know your password.

Why Do I Need This?

Two-factor authentication is an extra layer of security for your HSCID account designed to ensure that you are the only person who can access your account, even if someone knows your password. In addition, Duo Push will alert you right away (on your selected device) if someone is trying to log in as you.

Instructions

Enrolling for the First Time

1. Go to vpn.tamhsc.edu
2. Log in with your HSCID username and password
3. Select the green Start Setup button 
4. Select device type (Mobile Phone, Tablet, Landline) and click Continue 
5. Enter the phone number and click Continue. If "Tablet" was selected for step 4, this step will not show up.
6. Select the device's operating system and click Continue 
7. If a tablet or smartphone is being used, download the Duo Mobile app. Then, select I have Duo Mobile installed  
8. Follow the directions on the screen to activate the Duo Mobile app. If the QR code cannot be scanned for some reason, click the blue link to request an activation link. The activation link must be opened on the device that is being enrolled.
   • Once the app is successfully activated, a green check mark will appear over the QR code.
9. Click the green Continue button. There will then be a page with authentication methods that can be used as a test to ensure everything is set up properly. 

NOTE: Toward the end of the setup process, you may see a drop-down menu with options for what Duo should do when you log in. It is recommended that you leave it as the default option (Ask me to choose an authentication method) to avoid future problems with your account.

Enrolling a New Device

1. Navigate to vpn.tamhsc.edu
2. Log in with your HSCID username and password
3. If you are adding a new phone that has the same phone number, click My Settings & Devices. If you are adding an additional device or a phone with a new number, click Add a new device.
4. Authenticate with your preferred method
   • The Send Me a Push method will not work if you do not have access to your old device that still has the app activated
   • If you have a new phone with the same number, you can use the Call Me method
   • If you have a backup device enrolled, you can authenticate using that
   • If you are having trouble authenticating, call Help Desk Central at (979) 845-8300 or start a chat at help.tamu.edu. 
5. After successfully authenticating, you can add your new device.
   • If you clicked Add a new device, simply follow the on-screen prompts
   • If you clicked My Settings & Devices, click Device Options next to your phone number, then click Reactivate Duo Mobile. Follow the prompts to activate the Duo app on your new device.
6. If needed, you can go back to My Settings & Devices and delete any unused devices by clicking Device Options next to the device in question, then click the red Trashcan
   • You will only be able to delete a device if you have more than once device enrolled

NOTE: Toward the end of the setup process, you may see a drop-down menu with options for what Duo should do when you log in. It is recommended that you leave it as the default option (Ask me to choose an authentication method) to avoid future problems with your account.

Reactivating Push Notifications

If you have a new phone and need to reactivate your Duo app, or if your push notifications seemed to stop working, follow the directions below:

1. Navigate to vpn.tamhsc.edu
2. Log in with your HSCID username and password
3. Click the blue link towards the left that says My Settings & Devices
4. Authenticate with your preferred method
   • If you are having trouble authenticating, call Help Desk Central at (979) 845-8300 or start a chat at help.tamu.edu. 
5. Click Device Options next to your phone number
6. Click Reactivate Duo Mobile. Follow the prompts to activate the Duo app.

Using Duo with the Texas A&M Health VPN

Setting Up for the First Time

1. Go to vpn.tamhsc.edu
2. Log in with your HSCID username and password
3. If you are not enrolled in Duo for Texas A&M Health, you will be prompted to do so. The Texas A&M Health VPN requires Duo 2-Factor Authentication.
   • Click Start Setup and follow the prompts. See the above section titled Enrolling for the First Time for more details.
4. Once you are past Duo, follow the prompts to download the Cisco Secure Client (formerly AnyConnect) Client

Using the Cisco Secure Client Client

1. Open the Cisco Secure Client client. If you do not already have it installed, you can find the download link by logging into vpn.tamhsc.edu with your HSCID username and password.
2. Enter the server name: vpn.tamhsc.edu
3. Fill out the following fields:
   1. Group: HSC_Only_Traffic 
   2. Username: your HSCID username
   3. Password: your HSCID password
   4. Second Password: enter phone to have Duo call you (Enter phone1 or phone2 if you have multiple numbers enrolled). Enter push to have a Duo push notification sent to you. You can also enter a 6-digit passcode from your Duo app.
      • If you do not have a Second Password box, this means you previously chose to have Duo automatically send you a push or phone call when you log in. If you would like to change this setting, see the directions in the section below titled Changing the Default Authentication Method. 
4. Be sure to accept the Duo notification

Changing the Default Authentication Method

It is the default setting for you to be asked to choose a Duo 2-Factor Authentication method every time you log into a Duo-required Texas A&M Health resource, including the Texas A&M Health VPN. If you are automatically receiving push notifications or phone calls and would like to change this setting, follow the directions below

1. Go to vpn.tamhsc.edu and log in with your HSCID username and password
2. You will see a blue banner on the bottom of the screen telling you a push or a call was sent to your device. Click Cancel.
3. Click the blue link towards the left that says My Settings and Devices
4. You will see a blue banner on the bottom of the screen telling you a push or a call was sent to your device. You can either accept this push/call, or click Cancel and choose a different method.
   • If you have no way to authenticate, call Help Desk Central at (979) 845-8300 or start a chat at help.tamu.edu.
5. You should now see a drop down menu that lets you choose what happens when you log in. Select the method you prefer (it is recommended that you select Ask me to choose an authentication method) then click Save.

Configuring Duo for REDCap

1. Log into redcap.tamhsc.edu from your web browser
2. You will be presented with a two-step verification screen. Click on the Duo option.
3. Provide your phone number when prompted and select Continue.
4. Verify the number was entered correctly by clicking the check box, then select Continue.
5. Select Mobile phone for the device you want to enroll.
6. Select the option corresponding to your cell phone manufacturer and select Continue.
7. From your phone’s app store, search for the Duo Mobile app and install it. Select the I have Duo Mobile installed option, and select Continue.
8. For some phones, a QR bar code will be shown. Follow the instructions for your phone to scan it, then select Continue.
9. You should see the Device successfully enrolled screen. Select Done to complete the process.
10. Return to the redcap.tamhsc.edu login screen and enter your credentials. Select Duo Push for your two-step choice. You should see a notification that a login request has been pushed to your device.
11. After accepting the push on your phone, you should be logged into your redcap.tamhsc.edu account.