Weblogin Help
Weblogin provides a single sign on to LANL web based services. A single authentication creates a login session that lets you access services and information from many web sites. A session lasts for up to 2 hours for users outside the lab firewall.
Logging In
Web servers with protected pages will automatically redirect you to weblogin.lanl.gov if you are not currently logged in. You may also go to https://weblogin.lanl.gov directly. Enter your Z number, CRYPTOCard or YubiKey password, and click Log In. Tip: most browsers will let you type the Z number, tab, type the password, tab, and then press enter.
Logging Out
A weblogin session gives you access to many LANL web services from your browser. Therefore it is very important to either logout your web session or to use a screen lock application on your desktop. You can logout by either exiting your browser or going to https://weblogin.lanl.gov/logout
To further protect against unauthorized access, inactive sessions are automatically closed. On site sessions are closed if they are idle for 2 hours, 15 minutes for sessions outside the lab firewall.
New Accounts
LANL employees can request a CRYPTOCard or YubiKey from the ICN Accounts Office (+1 505 665 4444 ext 854). Contractors, visitors, and other non-employees should contact their LANL group office or sponsor.
Account Security
You can protect your account, and the LANL network, by taking a few simple precautions when using the web. These are especially important when using public systems at kiosks, cyber cafes, and conferences.
- Do not leave an active web session unattended; exit the browser, logout, or lock the screen.
- Contact the ICN Accounts Office (+1 505 665 4444 ext 854) immediately if you lose your CRYTPOCard.
- Contact the ICN Accounts Office (+1 505 665 4444 ext 854) if you get repeated, unexplained "Invalid passcode" errors. Your account may have been compromised.
- Do not enter your password into an unfamiliar web site; you could be giving someone you don't know the information needed to login as you.
- Only send your login information over a secure connection. You can verify this by looking for https: in the location. For example, https://weblogin.lanl.gov/
- Contact the ICN Accounts Office (+1 505 665 4444 ext 854) if you get warning screens about "certificates". You may be about to send your login information to an adversary's system.
Frequently Asked Questions
Q: I'm getting
A: The next step depends on the type of error.
-
Missing Z number
'...' is not a valid Z number
- A Z number is exactly 6 digits. Try again.
-
Missing password
Invalid passcode
- A CRYPTOCard password is 8 characters long. The obvious error is that is was typed in wrong. Try again.
- Some browsers will remember the password for a site. This never works for weblogin.lanl.gov. Reset this browser option if you set it by accident.
- Older model CRYPTOCards can get out of sync with the server if you press the wrong buttons. To resynchronize your CRYPTOCard, go to https://cryptocard.lanl.gov if you think that is the problem.
- Your account may have been blacklisted or disabled. Contact the ICN Accounts Office (+1 505 665 4444 ext 854)
-
wwwauth service is not available, try later
TACACS System error, try later
- Both of these indicate a temporary system outage. Try again in a few minutes. If the problem persists, contact the Network Operations Center (+1 505 667 7423).
-
Missing form POST data
- This error is rare and is usually the result of an incompatibility between your browser and weblogin.lanl.gov. Contact the Network Operations Center (+1 505 667 7423).
Q: I'm getting a "Page cannot be displayed" error after I login. What do I do now?
A: Try accessing the original page that redirected you to weblogin.lanl.gov. Chances are that your authentication actually worked. There is a known problem with Internet Explorer version 5 that might be causing this error. If you are running IE v5, we recommend that you upgrade to a newer version.
Q: I keep coming back to Weblogin after entering my Z number and password. What's up?
A: If there is a
- Your browser may not be sending the session cookie to the web server. Make sure your browser accepts cookies.
- Session cookies only get sent to sites. They will not work with URLs without in the host name; they will not work with URLs with IP addresses.
- Even though you authenticated correctly, you may not be authorized to access the desired page. Try going to weblogin.lanl.gov directly. If you can login successfully, contact the administrator of the web site you originally tried to access.
Q: What do I do if my CRYPTOCard or YubiKey isn't working?
A: Contact the ICN Accounts Office (+1 505 665 4444 ext 854).