Two-Step Information for LSPs

See below for Two-Step information for LSPs:

Users are encouraged to consult the Two-Step Verification FAQ and also the Two-Step Verification: Enrollment Instructions, which provide step-by-step instructions. Users can also contact PennKey Live Support for help.

If a user is unable to log in, questions to ask include:

Has the user selected "Yes, this is my device" (browser trust)?
If the user selects "Yes, this is my device" during the Two-Step process, their browser will be trusted for 60 days. In addition, their Login Options depend on what they set up at the time they enrolled.

Did the user designate an additional device?
If so, they can use one of the Login Options they previously enabled.

If users require support beyond the self-support mechanisms, such support follows the standard LSP model. Local Support Providers provide first-tier support to users, giving assistance with enrollment and use as necessary as well as troubleshooting prior to escalation. If issues persist, LSPs can escalate to ISC Client Care. Client Care staff can troubleshoot further, escalating to the Two-Step developers and WebLogin team as necessary for fixes or change requests.

Common issues include:

• New or replacement phone
  • Refer end user to the Two-Step Verification: Configuring a Replacement Phone page.
• Verification code not being accepted
  • App: Ensure device is synched to the local time zone.
  • Duo fob or Duo Mobile passcode: Enter three consecutive and correct passcodes from the HMAC-based one-time password (HOTP) hardware token or the Duo Mobile account in three successive authentication attempts within five minutes. The first two authentications will fail. However, the HOTP passcodes will resynchronize and the third authentication should succeed. For more information, see the Duo article on resynching HOTP passcodes for Duo Mobile or a hardware token.
  • SafeID fob (previously issued only): A token can get "out of sync" if the button is pressed too many times in a row and the generated passcodes aren't used for login. In some cases, this can happen by accident if the token is stored next to other objects in a pocket, backpack, etc. Generate three passcodes in a row to attempt to resynchronize the token.

LSPs should be aware of other possible issues, such as:

• Users believing they're finished after installing the Duo Mobile app and not completing enrollment
• Users not knowing how to scan QR codes with the Duo Mobile app
• Users not understanding the concept of entering a second factor
• Users not having their App Store/Google Play password to install apps
• Users not knowing how to install apps on their mobile device
• Users not knowing how to manage notifications (iOS, Android) on the Duo Mobile app
• For new PennKey recipients – Two-Step registration timeframe expired
  • Users must register for Two-Step Verification within 30 days of receiving PennKey setup information. After this they will require assistance from a PennKey administrator and ID proofing. 

In case of an issue that an LSP cannot resolve, the LSP should contact ISC Client Care. To help ensure the issue is resolved as quickly as possible, please include the user's PennName and troubleshooting steps already performed.

Prior to contacting Client Care, it is the LSP's responsibility to identity proof the user. See the ID Proofing Guidance for PennKey Administrators document for more information.

Users can also contact PennKey Live Support for help.