Purdue Login

Purdue's new login screen will require users to enter their career account username and password.

Purdue's new login screen will require users to enter their career account username and password.

Purdue Login is the gateway to protected tools and services such as Brightspace, SAP, MyPurdue, Qualtrics and more. 

On June 27, 2023, Purdue Login replaced BoilerKey with a new two-factor authentication system.

Instead of the "pin,push" login that BoilerKey users are familiar with, the new login system will require you to submit your Purdue career account username and password. You'll then be asked to authenticate via the Duo Mobile app that you are likely already using for BoilerKey. 

Frequently Asked Questions

Are we still using the Duo Mobile App?
Yes, we are still using Duo, just in a more standardized wayIf you already have Duo installed, you do not need to reinstall anything on your phone. 
How do I use Duo Mobile for authentication on my phone?
See the knowledge base article: How to use Duo authentication with Purdue Login
How will new students and employees enroll a new device?
If they don’t already have one set up, new Purdue constituents will be prompted to enroll a device when they first log into any web-based serviceThey do not need to know a special address to onboard. 
Is anything changing with two-factor in Microsoft 365?
Not at this point but it is being investigated. 
How can I request access to a ZoneVPN?
Submit a request to security@purdue.edu that includes the profile and a brief justification for needing the access.
How do I manage my Duo enrolled devices?

You can manage your devices through the self-service portal.  To access the portal, navigate to an application protected by Purdue SSO. Enter your username and password to log in.  

After passing primary authentication, click the Other Options link shown on the Duo authentication screen to return to the device list. Select the Manage devices option from the devices list. Select a method and verify your identity, and you will be redirected to the device management portal.   

Here, you can add, remove, and rename your devices.  You will not have the ability to remove all devices because you must always have at least one device registered. 

You cannot add a hardware token in the portal. This must be done by the service desk. 

See Duo’s documentation for more information: https://duo.com/docs/self-service-portal#universal-prompt 

I previously registered two devices with BoilerKey and used Push2 to log in. How will I log in to the new Login screen?

You will no longer use Push2 to log into the Purdue Login screens. First, you will enter your username and password.  You will then be redirected to the Duo Prompt.  If you have two phones enrolled, Duo will select the first phone by default the first time and send a push notification to that device.  Select “Other Options” to view the methods available to you.  Your other phone should be listed, and you can select it to receive a push. 

You may remove the old device from your list of methods. See question “How do I manage my Duo enrolled devices?” to details. 

Alternatively, if you want to keep both phones enrolled in Duo, contact your service desk for assistance with setting your new phone as the primary device. You may also navigate to the device management portal, remove the first phone and add it back to set it as the secondary device. 

I have multiple devices enrolled in Duo. Will I have to select the Duo method I want to use each time I log in?

If you use the same device and browser to log in each time, Duo will remember the last method you selected and prompt you with that device again.  If you clear your browsing history/cache/cookies, this will be reset and Duo will select the method they consider the most secure. 

I generated backup codes. Will those still work?

Users will no longer be able to generate new backup codes, but the existing codes will continue to work in the short-term. After logging in with your username and password,  select “Other Options” > Bypass Code to use your backup codes. 

A user must have a valid Duo authentication device enrolled (like a phone or hardware token) in order to use a bypass code to authenticate. Bypass codes are not intended as a user's only 2FA method. 

I use a hardware token to log in. Will that still work?

Yes. To use a hardware token to log in, enter your username and password. The Duo prompt will appear. Ithe Duo prompt, enter the code generated by your hardware token.

I can't access my device/phone. How can I log in without it?

Use the BoilerBot or contact your service desk to have a temporary bypass code generated for login. You must have a valid Duo authentication device enrolled (like a phone or hardware token) in order to use a bypass code to authenticate. Bypass codes are not intended as your only 2FA method. 

Bypass codes generated for you will expire after 24 hours or 30 uses.  

Can I use a bypass code to log in if I have not enrolled a device in Duo?

No.  You must enroll at least one device to use a bypass code to log in.  

Contact your service desk if you need assistance enrolling a device. 

How do I request to have a hardware token shipped to me?

To request the shipment of a hardware token, click here to fill out the Hardware Token request form

We do not ship internationally at this time. 

How will this change impact RADIUS and VPN authentication?

Changes will not affect RADIUS and VPN authentication in this phase.  We currently support using pins* or passwords. If you already have a pin, you may continue to use it to log in for now. 

 To log in: 

In the username field, you will enter your username. 

In the password field, you may enter any of the following options: 

  •  <Password>,push 
  • <Password>,<passcode> 
  • * <PIN>,push 
  • * <PIN>,<passcode> 

To generate a passcode, open the Duo Mobile app and tap the Purdue account to display a six-digit temporary passcode. 

* Please note that the legacy and deprecated password field values (pins) have not yet been invalidated for VPN use to minimize possible user disruption as we make this transition. They will be removed in the future.