CUNY upgraded its identity management system (IMS) that controls access to CUNYfirst. This IMS upgrade also provides the opportunity to implement a single set of login credentials, leveraging users’ existing CUNYfirst username and password, to access other CUNY applications and services besides CUNYfirst.

The single set of login credentials is called your CUNY Login. Once an application or service transitions to the CUNY Login, you will enter your login credentials as follows:

Username: CUNYfirst username@login.cuny.edu
Password: CUNYfirst password

The benefits of moving to the CUNY Login include:

  • One set of login credentials—You do not have to remember a separate username and password to access each application and service
  • CUNYfirst inheritance—You can leverage what you already know, the former CUNYfirst login credentials
  • Single sign-on—You only have to log in once for concurrent access to single sign-on enabled applications and services

CUNY applications and services will transition to the CUNY Login over time. The tabbed sections that follow provide answers to frequently asked questions to help users during the transition to the CUNY Login credentials.

Why is there a new CUNY Login page?

CUNY is transitioning to a single set of login credentials, called the “CUNY Login,” for CUNY-wide applications and services. The CUNY Login page has been introduced as an entry point for applications and services that use the CUNY Login credentials (CUNYfirst username@login.cuny.edu and CUNYfirst password) for authentication.

Note that the CUNY Login page appearance may change as new applications, services and features are added.

What CUNY applications use the CUNY Login page?

The CUNY Login page is used to log in to Blackboard, CUNYfirst, CUNYsmart, DegreeWorks, FACTS and the Virtual Bookstore.

The list of applications using the CUNY Login page will grow as applications transition to the CUNY Login.

Why do the CUNY Login credentials incorporate the CUNYfirst login name and password?

The identity management system (IMS) that provides user authentication and access control for CUNYfirst can now provide user authentication and access control to other applications and services as well. Since students, faculty and staff already have CUNYfirst login credentials, CUNY is leveraging the former CUNYfirst username and password as the basis for the CUNY Login credentials.

Why does the CUNY Login require “@login.cuny.edu”?

Adding “@login.cuny.edu” to the CUNYfirst username provides the simplest username format to satisfy the broadest user authentication and access control requirements for University and third-party hosted applications.

To simplify the user experience for the CUNY Login page, “@login.cuny.edu” is prepopulated.

Are CUNY Login credentials only used with the CUNY Login page?

No, some CUNY applications and services, such as Microsoft Office 365 ProPlus and CUNY Virtual Desktop, also use the CUNY Login credentials as part of moving towards a single set of login credentials across CUNY applications and services.

What is single sign-on?

Single sign-on lets you enter a single username and password once to access more than one application concurrently without having to log in (sign in) to each one separately.

For example, if you are already logged in to Blackboard, clicking on a link to DegreeWorks will automatically open DegreeWorks. Likewise, if you are already logged in to DegreeWorks, clicking on a Blackboard link automatically opens Blackboard.

Conversely, when you log out of one single sign-on enabled application, you log out of ALL currently active single sign-on enabled applications. For more information about single sign-on, see CUNY Login – Single Sign-on FAQs.

What applications currently support single sign-on using the CUNY Login credentials?

The CUNY Login credentials currently provide single sign-on access to the following applications:

Blackboard
CUNYfirst
CUNYsmart
DegreeWorks
FACTS

Once you log in to any of these applications, you can access the others without logging in again.

For example, if you are already logged in to Blackboard, clicking on a link to CUNYfirst will automatically open CUNYfirst. Likewise, if you are already logged in to CUNYfirst, clicking on a Blackboard link automatically opens Blackboard.

The Virtual Bookstore is not single sign-on enabled even though it is accessed through the CUNY Login page.

Why can’t I bookmark the new CUNY Login page?

The new CUNY Login page is used to log in to a CUNY application AFTER clicking on a link for that application. If you access the CUNY Login page directly, such as via a bookmark or by manually entering the URL into your browser address bar, you will see an error page because the identity management system (IMS) will not be able to determine what application you are attempting to access.

Although a bookmark to the CUNY Login page will not work, you can bookmark the link used to open the CUNY Login page for a specific application.

How long can an application remain idle before it times out for inactivity?

Inactivity timeouts vary by application as listed below:

Blackboard – 180 minutes (3 hours)
CUNYfirst – 30 minutes
CUNYsmart – 30 minutes
DegreeWorks – 55 minutes
FACTS – 55 minutes
Virtual Bookstore – 60 minutes

If an application times out for inactivity, you are presented with the CUNY Login page to authenticate again to that application.

To avoid timing out of an application, you can reset its inactivity timer by returning to the application and refreshing a page or clicking on a link before reaching the timeout limit.

What happens to my work if I am logged out my application due to an inactivity timeout?

Once you exceed the application timeout, the login page displays the next time you refresh a page or click on a link in the application. After logging back in, you see the result of the action that triggered the login page—either a refreshed page or the link’s destination.

What are the differences between an inactivity timeout and logging out of an application?

An inactivity timeout logs you out of a specific application.

Logging out of an application that is not single sign-on enabled logs you out of that application only.

Logging out of an application that is single sign-on enabled logs you out of all active single sign-on enabled applications using the same browser.

How many failed login attempts does CUNY Login allow?

The CUNY Login page locks an account after five failed login attempts. Once the account is locked, you are prevented from accessing ALL applications and services using the CUNY Login page. The account lockout period is 60 minutes after which you can attempt to log in again.

Consider using the “Forgot Password” function after the fourth failed attempt to log in.

Why does the CUNY Login page display after clicking the Blackboard link in the CUNY Portal?

Blackboard now uses the CUNY Login credentials. As a result, users are redirected when clicking on the Blackboard link in the CUNY Portal if they are not already logged in to an application using the CUNY Login page..

Why do I get redirected to the CUNY web site after clicking the DegreeWorks or FACTS link in the CUNY Portal?

As part of the DegreeWorks and FACTS upgrade, new DegreeWorks and FACTS web pages were added to the CUNY web site that include login links and supporting application information and frequently asked questions (FAQs). The login links on the new DegreeWorks and FACTS web pages take users to new CUNY Login page if they are not already logged in to another single sign-on enabled application.

Why does the Application Selection page display when I log in to DegreeWorks or FACTS?

The Application Selection page displays if you have affiliations with multiple colleges and the DegreeWorks or FACTS login link used did not specify a college. Select the college from the Application Selection page to finish logging in.

What are the CUNY Login credentials for users without a CUNYfirst account?

Some Blackboard users, as well as students at the Graduate Center and the School of Journalism, do not have a CUNYfirst account from which the CUNY Login credentials are derived.

These users should append “@login.cuny.edu” to their CUNY Portal username and use their CUNY Portal password when presented with the CUNY Login page.

To simplify the user experience for the CUNY Login page, “@login.cuny.edu” is prepopulated for all users.

Are all applications and services that use CUNY Login credentials single sign-on enabled?

No, currently only the following CUNY applications and services that share the CUNY Login page are single sign-on enabled:

Blackboard
CUNYfirst
CUNYsmart
Degree Works
FACTS

The Virtual Bookstore, although accessed through the CUNY Login page, is not single sign-on enabled.

Other applications and services, such as Microsoft Office 365 ProPlus and CUNY Virtual Desktop, also use the CUNY Login credentials as part of moving towards a single set of login credentials across CUNY applications and services. However, these applications and services use a different identity management system (IMS) and login page for user authentication so they do not share single sign-on with applications and services accessed through the CUNY Login page.

What are the differences between an inactivity timeout and logging out for single-sign-on enabled applications?

An application’s inactivity timeout logs you out of that application only—all other active single sign-on enabled applications remain active.

Logging out of an application that is single sign-on enabled logs you out of all active single sign-on enabled applications using the same browser.

How do I log out of one single sign-on enabled application without logging out of all of them?

Single sign-on applies to CUNY applications and services accessed via the CUNY Login page in the same browser application on the same device—if you log out of one of them you log out of all of them. This might pose a problem if you are working in Blackboard and inadvertently log out of CUNYfirst in the same browser.

If you need to independently log in and out of single sign-on enabled applications, open the applications in different browsers or on different devices.

What are the CUNY Login credentials for users without a CUNYfirst account?

Some Blackboard users, as well as students at the Graduate Center and the School of Journalism, do not have a CUNYfirst account from which the CUNY Login credentials are derived.

These users should append “@login.cuny.edu” to their CUNY Portal username and use their CUNY Portal password when presented with the CUNY Login page.

To simplify the user experience for the CUNY Login page, “@login.cuny.edu” is prepopulated for all users.

See the CUNY Login page FAQS for more information on using the CUNY Login page.