Learn how to enroll in Duo multi-factor authentication
Getting Started
To better protect your personal data and your WRDS account from unauthorized access, WRDS requires that you use multi-factor authentication when logging in.
Multi-factor authentication (MFA) involves two or more unique forms of authentication. WRDS requires these two sources of authentication:
- Your WRDS username and password, and
- A security code or explicit approval confirmed from a trusted external device.
When you log into WRDS for the first time using your WRDS username and password, you are prompted to enroll a second authentication source via Duo. WRDS has chosen Duo as our third-party MFA partner, allowing for secure yet flexible MFA authentication to WRDS for all WRDS users.
Follow the steps below to learn how to use Duo to authenticate to WRDS.
To read more about Duo, please visit the official documentation at Duo Guide.
Recommended MFA Method
WRDS supports Duo Mobile for all MFA at WRDS. Duo Mobile is a smartphone app available for iPhone or Android phones that greatly streamlines the MFA approval flow as you log in to WRDS.
- Verify that your smartphone OS is on the list of supported iPhone or Android versions. Duo Mobile does not support Windows Phone.
- Download the Duo Mobile app on your smart device. The app can be downloaded directly from your device's app store.
- Proceed to Enroll Your WRDS Email.
Other MFA Methods
If you are unable to use Duo Mobile -- perhaps because you do not have a smartphone or your smartphone does not support Duo Mobile -- please contact WRDS Support for further guidance.
Please include the following when you write in:
- Your WRDS username
- The Email address associated with your WRDS account. Please use the Email address associated with your WRDS account when you write in: please do not write in from a personal Email!
- Why you are unable to use Duo Mobile
Enroll Your WRDS Email
When you log into the WRDS website for the first time, you will be shown the following screen. Click the Please click here button to request an Email with a setup link and instructions:
Access the Email account that is associated with your WRDS account (usually the Email address given to you by your institution), and check for an Email from WRDS with the subject WRDS Two-Factor Authentication by Duo. Click the link in the Email to enroll your WRDS account in MFA via Duo.
Duo Mobile
With Duo Mobile, you receive a push notification from the Duo Mobile app on your smartphone when you log in to WRDS. Approve the connection request via the Duo Mobile prompt to complete the log in process.
Duo Mobile method supports all WRDS access methods.
Set up Duo Mobile
To set up and start using Duo Mobile, follow the instructions below:
- If you haven't already, download the Duo Mobile app on your smart device. The app is available for iPhone and Android phones and can be downloaded directly from your device's app store. Duo Mobile does not support Windows Phone.
- If you haven't already, follow the instructions to Enroll Your WRDS Email.
- Log in to the WRDS website using your WRDS username and password. The Duo Security welcome screen will appear.
- Click Get Started.
4. Select Duo Mobile from the list.
5. Enter your phone number, then click Continue.
6. A prompt will appear asking you to download Duo Mobile, if you haven't already. Click Next.
7. A QR code screen will appear. Open the Duo Mobile app on your smartphone. In the app, click Add + and select Use QR Code. Then use your phone's camera to scan the QR code on your screen. Duo Mobile must have permission to use your camera.
8. Verify the configuration by returning to the WRDS website and entering your WRDS username and password when prompted. Within a few seconds, you should receive a Duo Mobile prompt on your smartphone, asking you to verify your identify. Click the green Approve checkmark on your device's screen to complete your log in.
Using Duo Mobile
Now that you have completed set up, you can use Duo Mobile as needed to complete your log in to WRDS.
You can use Duo Mobile with all WRDS access methods. For detailed instructions on using MFA with each WRDS access method (including SSH, PostgreSQL, SAS, etc), see Using MFA with Other Access Methods.
Be sure your phone is nearby and ready when you go to log in to WRDS! The login prompt will time out after a period of inactivity. If you do not approve the connection via the Duo Mobile prompt within a few minutes the attempt will time out and you will need to restart it with a fresh login.
Important: If you let the login prompt timeout too many times in a row, your account may be automatically locked. If you encounter an error message indicating that your account as been locked for too many timeouts or authorization retries, please contact WRDS Support to request an account unlock.
Remembered Devices
If you use the same computer, same browser, and same IP address to log in to WRDS, and you do not clear your cookies, the system can remember your MFA session for up to 30 days. After 30 days, you will be prompted to validate MFA again.
Using MFA with Other Access Methods
Once you have set up MFA with your WRDS account, you can use that MFA configuration across all WRDS access methods. See the sections below for examples of using MFA with each supported WRDS access methods.
SSH (Secure Shell)
- From your terminal client, connect to the WRDS Cloud via SSH.
- If you use a username/password to connect, use the hostname: wrds-cloud.wharton.upenn.edu
- If you use SSH keys to connect, use the hostname: wrds-cloud-sshkey.wharton.upenn.edu
- After making your connection, you will be prompted to choose a MFA method, from the options you configured when you registered earlier. Follow the instructions on the screen:
At this prompt, you can either:
- Enter a passcode if one has already been sent to your device to finish logging in to the WRDS Cloud.
- Enter 1 to receive a Duo Push alert to your device. An alert is sent to your device, asking if you are logging in to a UNIX application. Open the Duo Mobile app on your device and acknowledge the message to finish logging in to the WRDS Cloud.
- Enter 2 to have a passcode sent to your device. You will receive a text message with the SMS passcode. Enter the passcode to finish logging in to the WRDS Cloud.
You will only be shown the options you configured earlier. If you are having trouble receiving the Duo push, check the settings on your device to ensure that the Duo Mobile app has notifications enabled. In addition, verify that your device is connected to a reliable Wi-Fi or cellular connection.
Details:
- If you do not accept the connection request, your SSH connection to WRDS will timeout and fail.
- Your MFA session can be retained for up to 30 days as long as your IP address doesn't change.
- If your IP address changes, you will need to re-authenticate to WRDS using MFA.
- For more information, see SSH to the WRDS Cloud.
SFTP / SCP
Initiate your SFTP / SCP connection to WRDS and authenticate (either via prompt or saved credentials). Approve the connection request that appears via your chosen MFA method, and your SFTP / SCP connection to WRDS will complete.
Details:
- If you do not accept the connection request, your SFTP or SCP connection to WRDS will timeout and fail.
- Your MFA session can be retained for up to 30 days as long as your IP address doesn't change.
- If your IP address changes, you will need to re-authenticate to WRDS using MFA.
- For more information see Transferring Files using SFTP or Transferring Files using SCP.
SAS/Connect and SAS/Studio
Important: SAS/Connect and SAS/Studio only support Duo Mobile.
SAS/Connect: Issue your signon statement and provide your WRDS credentials, then approve the Duo Mobile push notification on your device to complete your login to SAS/Connect.
SAS/Studio: Access SAS/Studio at WRDS and provide your WRDS credentials at the log in screen, then approve the Duo Mobile push notification on your device to complete your login to SAS/Studio.
Details:
- If you do not accept the connection request, your log in attempt to SAS/Connect or SAS/Studio will timeout and fail.
- Your MFA session is valid for up to 12 hours, after which you must pass MFA again.
- You must use the Duo Mobile method for MFA with SAS/Connect and SAS/Studio, set to use Push Notifications. Text / Phone Call is not supported.
- For more information, see SAS/Connect at WRDS or SAS/Studio at WRDS.
RStudio Server
Important: RStudio Server only support Duo Mobile.
Access RStudio Server at WRDS and log in with your WRDS username and password, then approve the Duo Mobile push notification on your device to complete your login to RStudio Server.
Details:
- If you do not accept the connection request, your log in attempt to RStudio Server at WRDS will timeout and fail.
- RStudio is unable to support MFA session retention, so you must provide MFA each time you log in to RStudio Server at WRDS.
- You must use the Duo Mobile method for MFA with RStudio Server, set to use Push Notifications. Text / Phone Call is not supported.
- For more information, see RStudio at WRDS.
Programmatic Access (PostgreSQL)
Important: PostgreSQL connections only support Duo Mobile using the push prompt; Duo Mobile passcodes are not supported.
Initiate a connection to the WRDS PostgreSQL database backend from within your programming environment, such as via wrds.Connection() in Python, then approve the Duo Mobile push notification on your device to complete your connection.
If you are having trouble receiving the Duo push, check the settings on your device to ensure that the Duo Mobile app has notifications enabled. In addition, verify that your device is connected to a reliable Wi-Fi or cellular connection.
Details:
- If you do not accept the connection request, your connection to the WRDS PostgreSQL database will timeout and fail.
- Your MFA session can be retained for up to 30 days as long as your IP address doesn't change.
- If your IP address changes, you will need to re-authenticate to WRDS using MFA.
- You must use the Duo Mobile method for MFA with all connections to the WRDS PostgreSQL database, set to use Push Notifications. Text / SMS and Phone Call / Landline are not supported.
- Duo Mobile push prompts are supported by PostgreSQL, but Duo Mobile passcodes are not supported! You must use Duo Mobile push prompts with PostgreSQL connections to WRDS.
- For more information, see our documentation for remote access from: Python, R, MATLAB, or Stata.
WRDS Cloud
Once you have successfully authenticated to the WRDS Cloud via SSH, no further MFA is necessary to make use of the programmatic options available to you on the WRDS Cloud, such as Python on the WRDS Cloud or R on the WRDS Cloud.
- For more information, see WRDS Cloud: Programming Languages.
Managing Your Devices
If you have multiple devices enrolled, you can manage them from the Manage Devices screen.
To manage enrollment of your Duo devices, please log in from an unremembered device and select Other Options instead of continuing to log in. Then select Manage Devices.
You can also do this to select from multiple MFA methods if you have configured more than one.
If you do not have an unremembered device, you may try using incognito mode on your browser. If you cannot do either of these, please contact WRDS support for further assistance, and mention that you want to manage your devices / MFA methods, but don't have access to an unremembered device.
Troubleshooting
Having trouble? Verify that you are connected to a reliable WiFi or cellular connection and try again.
What if I'm not receiving text messages and phone calls?
Some users, who are generally located in Asia, do not always receive text messages or phone calls. Duo is aware of the issue and working on a solution. Until the issue is resolved, use the Duo Mobile App which is available for Android in the Google Play Store and Apple users in the Apple App Store.
If your country blocks the Google Play Store, see Duo's documentation: Does Duo Mobile work in China.
If you previously registered Duo with the Text / Phone call options but now you're having trouble receiving texts or calls, please contact WRDS Support.
What if I lose my phone?
Please contact WRDS Support.
IMPORTANT: When opening your support ticket you must use the email associated with your WRDS account.
What should I do if I'm not receiving the verification on my phone?
Check your smartphone's settings to make sure that the Duo Mobile app has the ability to send notifications. Duo Mobile cannot perform its function without notifications enabled.
Verify that you are connected to a reliable WiFi or cellular connection, as a weak connection can delay a push or can cause you to not receive a push notification.
How long does it take for a verification to appear after authenticating?
With Duo Mobile, you should receive an approval prompt shortly after authenticating to WRDS: likely within 10-15 seconds. Most verifications are repeated up to three times before timing out.
How do I log in to other WRDS access methods with MFA?
You can use Duo Mobile with all WRDS access methods, including SSH to the WRDS Cloud, SAS/Connect, RStudio Server, JupyterHub, etc. See Using MFA with Other Access Methods for more information on each.
How can I provide MFA for my script or program?
In most cases, the easiest path is to pass MFA first via the WRDS website or through SSH to the WRDS Cloud, either of which creates a secure session token at WRDS that expires after 30 days. If your connection retains the same IP address as when you passed MFA, that session token also allows you to issue remote programmatic calls from a program or script without having to pass MFA for each remote connection made within your code. If your IP address changes, you will need to re-authenticate using MFA. See Using MFA with Other Access Methods for more information.
Important: PostgreSQL connections to WRDS only support Duo Mobile. This includes whether you connect directly to PostgreSQL using psql or similar, or whether you connect from within a programming language like Python or R. You cannot use any other MFA method to access PostgreSQL outside of Duo Mobile.
What if I cannot use a personal cell phone at work?
If you cannot use a personal cell phone at work, please contact WRDS Support and request assistance with other MFA method at WRDS. Please include the following when you write in:
- Your WRDS username
- The Email address associated with your WRDS account. Please use the Email address associated with your WRDS account when you write in: please do not write in from a personal Email!
- Why you are unable to use Duo Mobile
Can I use Okta (or another MFA provider) for the two-step verification process?
No. You must use Duo MFA to complete the verification process and log in to WRDS.
How Do I Add Another Device for Authentication?
In order to add another device you must still have access to a device registered with Duo. If you still have access to a device enrolled with Duo, you can add your new device, such as a smartphone, to your Duo account. See the instructions in the section above, entitled Managing Your Devices. If you no longer have a device registered with Duo, contact WRDS Support.
Does Duo Mobile support my phone?
Duo Mobile supports these iPhone and Android versions, as well as the Apple Watch. Duo Mobile is no longer available for the Windows Phone: If you use a Windows Phone, please use the Text / Phone Call MFA method instead.
Does Duo support my browser?
Duo supports these versions of popular browsers. Please update your browser to the listed version in order to use Duo with your browser. If you are still experiencing issues with your browser and Duo, try using the Firefox browser instead.
Still Need Help?
Check the Frequently Asked Questions (FAQ) on Using Duo MFA at WRDS.