Skip to main content

Cornell University

Log in with Append Mode or Second Password Authentication for Two-Step Login

How to use append mode or a second password to authenticate with Two-Step Login for services that don't support CUWebLogin

This article applies to: Two-Step Login

In This Article

Use Append Mode Authentication

Some campus IT services, such as Desktop Everywhere using the VMware Horizon View client, do not support a web interface to specify how to complete the second step of authentication. 

If you enter just your NetID and password with these non-web apps, Two-Step Login will check the enrolled devices in your account in the following order:

  1. The first device with the Duo Mobile app activated.  Duo will send a Push to that device.
  2. The first phone number listed on your account.  Duo will call that phone number.

To manually select a different device or enter a passcode, use append mode authentication. in the Password field of the application, enter your password, then a comma, then the command word (push, phone, sms, or a passcode) as shown below. 

  • To receive a push on your Duo Mobile App, type: your_NetID_password,push
  • To receive a phone callback, type: your_NetID_password,phone 
  • To enter a passcode, type: your_NetID_password,your_passcode 
  • To get a new batch of SMS passcodes, type: your_NetID_password,sms Your login attempt will fail — log in again with one of your new passcodes.

You can also add a number to the end of each authentication method to select which device you want to use. For example, push2 will send a push to your second device with the Duo Mobile app installed, phone3 will call your third phone, etc.

You can view the order of your enrolled devices and the device numbers needed for append mode in your My Two-Step Login Devices window. For more information, follow the instructions in Duo Security's Guide to Two-Factor Authentication.

Use the Second Password Field

Some services don't support a web interface for authentication but do include a second password field to enter the required information to complete the second step to authenticate and log in.

In the second password field you can

  • enter a passcode,
  • enter the word push to ask for a Duo Push, or
  • enter the word phone to ask for a phone callback.

Duo Security provides documentation on how to use the second password field for some products, like the Cisco AnyConnect client used with Cornell's VPN service. For more information, see Duo's Guide to Two-Factor Authentication and the list of products in the Authenticating section (in the column on the left).

Support Contact:

Cornell IT Service Desk

Normal Business Hours: Monday-Friday, 8am-6pm (Eastern Time)
Emergency Service Disruptions: After Hours Support


To share feedback about this page or request support, log in with your NetID

At Cornell we value your privacy. To view
our university's privacy practices, including
information use and third parties, visit University Privacy.