How to Log In to WRDS Using Multi-Factor Authentication (MFA)

To better protect your personal data and your WRDS account from unauthorized access, WRDS requires that you use multi-factor authentication when logging in.

Multi-factor authentication (MFA) involves two or more unique forms of authentication. WRDS requires these two sources of authentication:

1. Your WRDS username and password, and
2. A security code or explicit approval confirmed from a trusted external device.

When you log into WRDS for the first time using your WRDS username and password, you are prompted to enroll a second authentication source via Duo. WRDS has chosen Duo as our third-party MFA partner, allowing for secure yet flexible MFA authentication to WRDS for all WRDS users.

Follow the steps below to learn how to use Duo to authenticate to WRDS.

To read more about Duo, please visit the official documentation at Duo Guide.

Top of Section

When you log into the WRDS website for the first time, you will be shown the following screen. Click the Please click here button to request an Email with a setup link and instructions:

Access the Email account that is associated with your WRDS account (usually the Email address given to you by your institution), and check for an Email from WRDS with the subject WRDS Two-Factor Authentication by Duo. Click the link in the Email to enroll your WRDS account in MFA via Duo.

Top of Section

Duo MFA at WRDS supports three options for validating your authentication. Most WRDS users should use the Duo Mobile option.

Generally:

• If you have a supported iPhone or Android smart phone, you should use the Duo Mobile method.
• If your phone does not support Duo Mobile, but you can receive text messages on your phone -- or can receive phone calls on a land line instead -- you should use the Text / Phone call method.
• If you cannot use a smart phone and also cannot use a phone number to receive texts or phone calls, or if you are unable to use either of the above options due to campus or local network restrictions on your device or network connection, contact WRDS Support and ask for help setting up Duo MFA without a phone.

Most WRDS users should use Duo Mobile on their smart phones.

Follow the instructions below to set up your chosen MFA option.

Top of Section

Duo Mobile is the easiest and fastest option to get started with MFA at WRDS, and is the recommended option for all users with a smart phone.

1. Download the Duo Mobile app on your smart device. The app is available for iPhone and Android phones and can be downloaded directly from your device's app store. Duo Mobile does not support Windows Phone.

2. Log in to the WRDS website using your WRDS username and password. The Duo Security welcome screen will appear.

3. Click Get Started.

4. Select Duo Mobile from the list.

5. Enter your phone number, then click Continue.

6. A prompt will appear asking you to download Duo Mobile, if you haven't already. Click Next.

7. A QR code screen will appear. Open the Duo Mobile app on your smartphone. In the app, click Add + and select Use QR Code. Then use your phone's camera to scan the QR code on your screen. Duo Mobile must have permission to use your camera.

8. Duo Mobile app setup is complete! Return to the WRDS website to log in for the first time using MFA with Duo Mobile. Enter your WRDS username and password.

9. Open the Duo Mobile app on your device. The app will ask you to verify your identify by clicking the green Approve checkmark on your device's screen. Once you approve on your device, you will be logged in to WRDS.

Next Steps

You have successfully configured MFA! Now, when you log on to the WRDS website with your username and password, Duo Mobile will prompt you to approve the connection on your device. If you use other WRDS access methods, such as SSH to the WRDS Cloud or Jupyter Notebooks (Python), see Using MFA with Other Access Methods for further instructions on using those methods.

Remembered Devices

If you use the same computer, same browser, and same IP address to log in to WRDS, and you do not clear your cookies, the system can remember you for up to 30 days. After 30 days you will be prompted for re-authentication, and will need to approve your connection via Duo Mobile again.

Top of Section

If you cannot use Duo Mobile because your phone doesn't support it, but you can still receive texts or phone calls, you can use the Text / Phone Call option.

1. Log in to the WRDS website using your WRDS username and password. The Duo Security welcome screen will appear.
2. Click Next.

3. Select Phone number from the list.

4. Enter your phone number. If your device is a landline phone, select the This is a landline phone checkbox. If your device can receive text messages, leave this checkbox unchecked.
5. Click Add phone number.

6. Text / Phone call setup is complete! Return to the WRDS website to log in for the first time using MFA with Duo. Enter your WRDS username and password.
7. Check the phone number you registered with Duo earlier. You will either receive a text message with an SMS passcode, or an automated phone call, depending on whether you checked the This a landline phone checkbox earlier. Enter the code provided into the Duo prompt, and you will be logged into WRDS.

Next Steps

You have successfully configured MFA! Now, when you log on to the WRDS website with your username and password, Duo will send you a text or automated phone call with a passcode which you can enter at the Duo prompt in your browser to approve the connection. If you use other WRDS access methods, such as SSH to the WRDS Cloud or Jupyter Notebooks (Python), see Using MFA with Other Access Methods for further instructions on using those methods.

Remembered Devices

If you use the same computer, same browser, and same IP address to log in to WRDS, and you do not clear your cookies, the system can remember you for up to 30 days. After 30 days you will be prompted for re-authentication, and will need to approve your connection via Text / Phone call again.

Top of Section

Contact WRDS Support

If you cannot use a smart phone and also cannot use a phone number to receive texts or phone calls, or if you are unable to use either of the above options due to campus or local network restrictions on your device or network connection, contact WRDS Support and ask for help setting up Duo MFA without a phone.

IMPORTANT: When opening your support ticket you must use the email associated with your WRDS account.

When to Consider this Option

This option for MFA to WRDS is appropriate for users that cannot use a smart phone and don't have access to a reliable phone number or cellular network connection. Generally, this includes users in the government or corporate space, or users in geographic locations where local government blocks or interferes with network communications. You should only request this option if you cannot use Duo Mobile AND cannot use the Text / Phone Call option.

Top of Section

Once you have set up MFA with your WRDS account, you will use that MFA configuration with most WRDS access methods, including SSH to the WRDS Cloud, Python, etc.

SSH (Secure Shell)

1. From your terminal client, connect to the WRDS Cloud via SSH.
   1. If you use a username/password to connect, use the hostname: wrds-cloud.wharton.upenn.edu
   2. If you use SSH keys to connect, use the hostname: wrds-cloud-sshkey.wharton.upenn.edu
2. After making your connection, you will be prompted to choose a MFA method, from the options you configured when you registered earlier. Follow the instructions on the screen:

At this prompt, you can either:

1. Enter a passcode if one has already been sent to your device to finish logging in to the WRDS Cloud.
2. Enter 1 to receive a Duo Push alert to your device. An alert is sent to your device, asking if you are logging in to a UNIX application. Open the Duo Mobile app on your device and acknowledge the message to finish logging in to the WRDS Cloud.
3. Enter 2 to have a passcode sent to your device. You will receive a text message with the SMS passcode. Enter the passcode to finish logging in to the WRDS Cloud.

You will only be shown the options you configured earlier. If you are having trouble receiving the Duo push, check the settings on your device to ensure that the Duo Mobile app has notifications enabled. In addition, verify that your device is connected to a reliable Wi-Fi or cellular connection.

Details:

• If you do not accept the connection request, your SSH connection to WRDS will timeout and fail.
• Your MFA session can be retained for up to 30 days as long as your IP address doesn't change.
• If your IP address changes, you will need to re-authenticate to WRDS using MFA.
• For more information, see SSH to the WRDS Cloud.

SFTP / SCP

Initiate your SFTP / SCP connection to WRDS and authenticate (either via prompt or saved credentials). Approve the connection request that appears via your chosen MFA method, and your SFTP / SCP connection to WRDS will complete.

Details:

• If you do not accept the connection request, your SFTP or SCP connection to WRDS will timeout and fail.
• Your MFA session can be retained for up to 30 days as long as your IP address doesn't change.
• If your IP address changes, you will need to re-authenticate to WRDS using MFA.
• For more information see Transferring Files using SFTP or Transferring Files using SCP.

SAS/Connect and SAS/Studio

Use the Duo Mobile option for MFA.

SAS/Connect: Issue your signon statement and provide your WRDS credentials, then approve the Duo Mobile push notification on your device to complete your login to SAS/Connect.

SAS/Studio: Access SAS/Studio at WRDS and provide your WRDS credentials at the log in screen, then approve the Duo Mobile push notification on your device to complete your login to SAS/Studio.

Details:

• If you do not accept the connection request, your log in attempt to SAS/Connect or SAS/Studio will timeout and fail.
• Your MFA session is valid for up to 12 hours, after which you must pass MFA again.
• You must use the Duo Mobile option for MFA with SAS/Connect and SAS/Studio, set to use Push Notifications. Text / Phone Call is not supported.
• For more information, see SAS/Connect at WRDS or SAS/Studio at WRDS.

RStudio Server

Use the Duo Mobile option for MFA.

Access RStudio Server at WRDS and log in with your WRDS username and password, then approve the Duo Mobile push notification on your device to complete your login to RStudio Server.

Details:

• If you do not accept the connection request, your log in attempt to RStudio Server at WRDS will timeout and fail.
• RStudio is unable to support MFA session retention, so you must provide MFA each time you log in to RStudio Server at WRDS.
• You must use the Duo Mobile option for MFA with RStudio Server, set to use Push Notifications. Text / Phone Call is not supported.
• For more information, see RStudio at WRDS.

Programmatic Access (PostgreSQL)

Use the Duo Mobile option for MFA.

Initiate a connection to the WRDS PostgreSQL database backend from within your programming environment, such as via wrds.Connection() in Python, then approve the Duo Mobile push notification on your device to complete your connection.

If you are having trouble receiving the Duo push, check the settings on your device to ensure that the Duo Mobile app has notifications enabled. In addition, verify that your device is connected to a reliable Wi-Fi or cellular connection.

Details:

• If you do not accept the connection request, your connection to the WRDS PostgreSQL database will timeout and fail.
• Your MFA session can be retained for up to 30 days as long as your IP address doesn't change.
• If your IP address changes, you will need to re-authenticate to WRDS using MFA.
• You must use the Duo Mobile option for MFA with all connections to the WRDS PostgreSQL database, set to use Push Notifications. Text / Phone Call is not supported.
• For more information, see our documentation for remote access from: Python, R, MATLAB, or Stata.

WRDS Cloud

Once you have successfully authenticated to the WRDS Cloud via SSH, no further MFA is necessary to make use of the programmatic options available to you on the WRDS Cloud, such as Python on the WRDS Cloud or R on the WRDS Cloud.

• For more information, see WRDS Cloud: Programming Languages.

Top of Section

If you have multiple devices enrolled, you can manage them from the Manage Devices screen.

To manage enrollment of your Duo devices, please log in from an unremembered device and select Other Options instead of continuing to log in. Then select Manage Devices.

If you do not have an unremembered device, you may try using incognito mode on your browser. If you cannot do either of these, please contact WRDS support.

Change Your Smartphone's Verification Method

If you wish to change which configured MFA verification method you use, you can also switch between the MFA options you've configured from the Other Options screen.

Top of Section

Having trouble? Verify that you are connected to a reliable WiFi or cellular connection and try again.

What if I'm not receiving text messages and phone calls?

Some users, who are generally located in Asia, do not always receive text messages or phone calls. Duo is aware of the issue and working on a solution. Until the issue is resolved, use the Duo Mobile App which is available for Android in the Google Play Store and Apple users in the Apple App Store.

If your country blocks the Google Play Store, see Duo's documentation: Does Duo Mobile work in China.

If you previously registered Duo with the Text / Phone call options but now you're having trouble receiving texts or calls, please contact WRDS Support.

What if I lose my phone?

Please contact WRDS Support.

IMPORTANT: When opening your support ticket you must use the email associated with your WRDS account.

What should I do if I'm not receiving the verification on my phone?

Check your smartphone's settings to make sure that the Duo Mobile app has the ability to send notifications.

Verify that you are connected to a reliable WiFi or cellular connection, as a weak connection can delay a push or can cause you to not receive a push notification.

How long does it take for a verification to appear after authenticating?

If you are using Duo Mobile, you should receive an approval prompt shortly after authenticating to WRDS: likely within 10-15 seconds. If you are using the Text / Phone Call MFA option, the passcode text or automated call could take longer to reach you: perhaps up to a minute. Most verifications are repeated up to three times before timing out.

How do I log in to other WRDS access methods with MFA?

You can use Duo with most WRDS access methods, including SSH to the WRDS Cloud, SAS/Connect, RStudio Server, JupyterHub, etc. See Using MFA with Other Access Methods for more information.

How can I provide MFA for my script or program?

In most cases, the easiest path is to pass MFA first via the WRDS website or through SSH to the WRDS Cloud, either of which creates a secure session token at WRDS that expires after 30 days. If your connection retains the same IP address as when you passed MFA, that session token also allows you to issue remote programmatic calls from a program or script without having to pass MFA for each remote connection made within your code. If your IP address changes, you will need to re-authenticate using MFA. See Using MFA with Other Access Methods for more information.

What if I need a bypass code?

Bypass codes will be used sparingly and only in extreme cases. If you need a bypass code, please contact WRDS support. Bypass codes are not provided by your IT helpdesk, but by WRDS support.

IMPORTANT: When opening your support ticket you must use the email associated with your WRDS account.

What if I cannot use a personal cell phone at work?

You can use a landline telephone to both register for Duo and use it to log in to WRDS. See the instructions above on using the Text / Phone Call MFA option. If you cannot use that option either, contact WRDS support and ask for help setting up Duo MFA without a phone.

IMPORTANT: When opening your support ticket you must use the email associated with your WRDS account.

Can I use Okta (or another MFA provider) for the two-step verification process?

No. You must use Duo with one of the options discussed above to complete the verification process and log in to WRDS.

How Do I Add Another Device for Authentication?

In order to add another device you must still have access to a device registered with Duo. If you still have access to a device enrolled with Duo, you can add your new device, such as a smartphone, to your Duo account. See the instructions in the section above, entitled Managing Your Devices. If you no longer have a device registered with Duo, contact WRDS Support.

Does Duo Mobile support my phone?

Duo Mobile supports these iPhone and Android versions, as well as the Apple Watch. Duo Mobile is no longer available for the Windows Phone: If you use a Windows Phone, please use the Text / Phone Call MFA method instead.

Does Duo support my browser?

Duo supports these versions of popular browsers. Please update your browser to the listed version in order to use Duo with your browser. If you are still experiencing issues with your browser and Duo, try using the Firefox browser instead.

Still Need Help?

Check the Frequently Asked Questions (FAQ) on Using Duo MFA at WRDS.

Top of Section