Logging in to the AImageLab-HPC web services (including ColdFront) requires two-factor authentication: in addition to your password, you must enter a one-time password (OTP) generated by an authenticator application on your phone. This page explains how the OTP is set up, how to move it to a new phone, and what to do if you lose your phone.

First Setup

The OTP is configured the first time you log in to the web interface via ColdFront. After entering your username and password, you will be shown a QR code (and the corresponding secret key in text form) to scan with an authenticator application, such as Google Authenticator, Microsoft Authenticator, FreeOTP, or Aegis.

Enter the 6-digit code shown by the application to confirm the setup. You can also give the device a name (e.g. My phone) so you can recognise it later.

Please Note: for security reasons, the QR code and secret key are shown only once, during setup. Anyone who knows the secret key effectively owns your second factor, so it is never displayed again - not even to administrators. To move the OTP to a new phone, follow the procedure below instead of trying to recover the original QR code.

Changing Phone

When you replace your phone, keep the old one at hand until the procedure is complete: you will briefly have two registered devices, then remove the old one.

1. Install an authenticator application on the new phone.
2. Go to the Account Console and log in with your password and the OTP from the old phone.
3. Open Account security → Signing in.
4. In the Two-factor authentication section, click Set up authenticator application.
5. Scan the QR code with the new phone, enter the generated code, and give the device a name (e.g. New phone).
6. Log out and log in again using the OTP from the new phone, to check that it works.
7. Back in Account security → Signing in, remove the old device from the list.

After the last step, only the new phone can generate valid codes for your account. Some authenticator applications (e.g. Google Authenticator, Aegis) can also export their accounts directly to a new phone; this works too, but please remember to delete the codes from the old phone afterwards.

Lost Phone

If you lose your phone, or it stops working before you could complete the procedure above, open a request on the HPC Helpdesk asking for an OTP reset. To protect your account, the request must be sent from the institutional email address associated with your AImageLab-HPC account. Once the reset is done, you will be asked to register a new authenticator at your next login.