Frequently Asked
Questions

Getting Started

How can I create an ACCESS account?

To create an ACCESS account you must firstregister for an ACCESS ID. Do not create more than one ACCESS ID. If you have trouble registering, pleaseopen a ticket.

Can I use my existing XSEDE account with ACCESS?

Yes, your ACCESS ID is the same as your XSEDE Portal account username. Please do not create a new ACCESS ID. See below if you need to reset your password.

Logging In & Authentication

Which identity provider should I choose when logging in to ACCESS?

Select the same identity provider you used when you registered for your ACCESS account. If you usually log in with your university user name and password, select your university as the identity provider. If you usually log in with your ACCESS ID and password, select "ACCESS CI (XSEDE)".

Why doesn’t my university appear in the list of identity providers?

ACCESS uses identity providers fromCILogon. If your university is not listed, simply choose “ACCESS CI (XSEDE)”.

How can I request a reminder of my ACCESS ID?

Please visitACCESS Registrationand enter your email address. If there is an existing ACCESS account associated with your email address, you will be shown your ACCESS ID after verifying your email.

How can I reset my ACCESS password?

Please visitChange ACCESS Passwordto reset your password.

How can I manage ACCESS Multi-Factor Authentication (MFA)?

If you are using “ACCESS CI (XSEDE)” to login you will be using Duo for MFA. If you login with your university account you will use your university MFA.

How do I update my Duo configuration?

ACCESS uses Duo for MFA. Learn how tomanage your Duo configuration.

I’m having trouble logging into an ACCESS Resource. How can I get assistance?

Please reviewACCESS RP Documentationfor login details and support contacts for each resource provider.

If you’re not able to get assistance directly from the resource provider, pleaseopen a ticket with ACCESS.

Account Management

How do I update my profile information (name, email, organization)?

You can view and update your profile by logging intoMy ACCESS Accountand choosing "Profile".

How can I link or unlink external accounts (e.g., GitHub, Google, Microsoft, ORCID, or University account)?

Linked accounts allow you to log into ACCESS using an external account. To manage your linked accounts or link a new account, log intoMy ACCESS Accountand choose "Linked Accounts".

I accidentally created multiple ACCESS IDs. Can I merge them?

Yes, pleaseopen a help ticketindicating which ACCESS ID you want to continue using and which one(s) you want marked as duplicate.

How do I manage my SSH keys?

You can view and update your SSH keys by logging intoMy ACCESS Accountand choosing "SSH Keys".

Ticketing System

How do I submit a ticket?

You may submit a ticket to the ACCESS ticketing system by following the directions on oursupport page.

Support & Troubleshooting

How can I request support with my account?

Pleaseopen a help ticket. Include detailed information about your issue to help the team respond quickly and effectively.

For Resource Providers Only (including identity management developers)

Can I configure my web application to require authentication using the ACCESS CI Identity Provider (IdP)?

When youregister your web application, ACCESS users will be able to log in using any identity provider supported by CILogon that is linked to their ACCESS ID, and the resulting id_token will contain the user’s ACCESS ID (i.e., “sub”: “username@access-ci.org”). This is the recommended configuration, because it allows users to log in without needing an ACCESS-specific username and password.

If you want to restrict authentication of the ACCESS CI IdP (to require ACCESS multi-factor authentication), please contacthelp@cilogon.orgto request this configuration to be applied to your client. Include your registered client_id in your request.

What is the ACCESS “Named Configuration”?

When you register an OIDC client with the ACCESS COmanage Registry, is it recommended you use a Named Configuration for “ACCESS OIDC client configuration v1”. This configuration does the following:
Registers the followingscopes: openid, email, profile, org.cilogon.userinfo
Verifies that OIDC client transactions request the org.cilogon.userinfo scope
Checks that the user has an ACCESS account. If so, asserts “username@access-ci.org” in the “sub” claim. If not, redirects the user to an appropriate error page.
Checks if the user is in the “AccessDenied” group. If so, redirects the user to an appropriate error page.

Why does my OIDC Client not show the ACCESS “skin” (i.e. CSS) when authenticating?

There is a server-side configuration which automatically applies theACCESS skinfor OIDC clients with a redirect_uri in the access-ci.org domain. This skin changes the CSS for the “Select an Identity Provider” page, and also selects “ACCESS CI” as the initial IdP for new visitors to the site. However, your OIDC client might have a redirect_uri in some other domain. In this case, the ACCESS “skin” would not be applied. To fix this, please contacthelp@cilogon.orgwith your registered client_id and request that the ACCESS “skin” be applied to your client.

Can I get a mapping from CILogon DNs to ePPN values to help with the GCSv4 to GCSv5 transition?

Yes, please send a list of DNs tohelp@cilogon.org, and the CILogon team can provide the mapping.

Why does my OIDC client require users to re-authenticate so frequently?

If you are usingmod_auth_openidc, please be sure to configure OIDCSessionInactivityTimeout. Visithttps://www.cilogon.org/oidc#h.p_1_IG_eaP90Ty for details.

You may also need to enable Refresh Tokens in your web app registration.

Frequently Asked Questions

Account Setup & Management