Frequently Asked 
Questions

Getting Started

  • Yes, your ACCESS ID is the same as your XSEDE Portal account username. Please do not create a new ACCESS ID. See below if you need to reset your password.

Logging In & Authentication

  • Select the same identity provider you used when you registered for your ACCESS account. If you usually log in with your university user name and password, select your university as the identity provider. If you usually log in with your ACCESS ID and password, select "ACCESS CI (XSEDE)".
  • ACCESS uses identity providers fromCILogon. If your university is not listed, simply choose “ACCESS CI (XSEDE)”.
  • Please visitACCESS Registrationand enter your email address. If there is an existing ACCESS account associated with your email address, you will be shown your ACCESS ID after verifying your email.
  • If you are using “ACCESS CI (XSEDE)” to login you will be using Duo for MFA. If you login with your university account you will use your university MFA.
  • Please reviewACCESS RP Documentationfor login details and support contacts for each resource provider.
  • If you’re not able to get assistance directly from the resource provider, pleaseopen a ticket with ACCESS.

Account Management

To modify the name or email associated with your ACCESS ID:
  1. Log on to your ACCESS Account with the same identity you used to register for ACCESS (your ACCESS ID or university account).
  2. Click the “Profile” tile.
  3. After updating the information, click the "Save Profile" button.
  4. Working with email addresses:
    1. You can add one primary and multiple recovery email addresses.
    2. Your primary email must match your institution.
    3. Your recovery email addresses can be used to change your password if you lose access to your primary email address.
    4. Changing your email address does not affect your current allocations.
To modify the organization associated with your ACCESS ID:

Edit your profile, change the value of the Institution field, and click Save Profile. You will only see organizations that match your primary email address.

If you cannot find your organization in the list, you can request it be added

Identity linking is the process required to link a University account with an ACCESS ID so that you can log on to ACCESS services using the linked account. Please review the instructions below to link or unlink an account.

Link
To link an account:
  1. Log in to your ACCESS Account.
  2. Click the Linked Accounts tile.
  3. Click the Link an Account button.
  4. In the "Select an Identity Provider" box, choose the identity provider for your university that you want to link to your ACCESS ID. DO NOT choose "ACCESS CI (XSEDE)".
  5. Log in with your chosen Identity Provider as you typically would.
  6. Follow the prompts to complete the linking process.
Unlink
To unlink an account:
  1. Log in to your ACCESS Account.
  2. Click the Linked Accounts tile.
  3. Click the Delete button next to the account you want to unlink.
  • Yes, pleaseopen a help ticketindicating which ACCESS ID you want to continue using and which one(s) you want marked as duplicate.
  • You can view and update your SSH keys by logging intoMy ACCESS Accountand choosing "SSH Keys".

Ticketing System

  • You may submit a ticket to the ACCESS ticketing system by following the directions on oursupport page.

Support & Troubleshooting

  • Pleaseopen a help ticket. Include detailed information about your issue to help the team respond quickly and effectively.

For Resource Providers Only (including identity management developers)

  • When youregister your web application, ACCESS users will be able to log in using any identity provider supported by CILogon that is linked to their ACCESS ID, and the resulting id_token will contain the user’s ACCESS ID (i.e., “sub”: “username@access-ci.org”). This is the recommended configuration, because it allows users to log in without needing an ACCESS-specific username and password.
  • If you want to restrict authentication of the ACCESS CI IdP (to require ACCESS multi-factor authentication), please contacthelp@cilogon.orgto request this configuration to be applied to your client. Include your registered client_id in your request.
  • When you register an OIDC client with the ACCESS COmanage Registry, is it recommended you use a Named Configuration for “ACCESS OIDC client configuration v1”. This configuration does the following:
  • Registers the followingscopes: openid, email, profile, org.cilogon.userinfo
  • Verifies that OIDC client transactions request the org.cilogon.userinfo scope
  • Checks that the user has an ACCESS account. If so, asserts “username@access-ci.org” in the “sub” claim. If not, redirects the user to an appropriate error page.
  • Checks if the user is in the “AccessDenied” group. If so, redirects the user to an appropriate error page.
  • There is a server-side configuration which automatically applies theACCESS skinfor OIDC clients with a redirect_uri in the access-ci.org domain. This skin changes the CSS for the “Select an Identity Provider” page, and also selects “ACCESS CI” as the initial IdP for new visitors to the site. However, your OIDC client might have a redirect_uri in some other domain. In this case, the ACCESS “skin” would not be applied. To fix this, please contacthelp@cilogon.orgwith your registered client_id and request that the ACCESS “skin” be applied to your client.
  • Yes, please send a list of DNs tohelp@cilogon.org, and the CILogon team can provide the mapping.