MFA management

Multi-factor authentication (MFA) enhances security and provides better control over user access

  2 minute read  

MFA adds an additional layer of authentication using time-based one-time passwords (TOTP), typically via an authenticator app.

Prerequisites

  • SSH access to the Cloud Management Platform (CMP) appliance with sudo/root privileges
  • A TOTP-based authenticator app (for example, Microsoft Authenticator or Google Authenticator)

Enable multi-factor authentication (MFA)

  1. Modify customer_settings.py

    • SSH into the CMP appliance.

    • Open the settings file /var/opt/cloudbolt/proserv/customer_settings.py.

    • Add the following lines to enable MFA:

      from settings import FEATURE_REGISTRY

FEATURE_REGISTRY["authentication::mfa"] = True

  2. Reset the feature list and restart the HTTP service

    • Run the following command to apply changes:

      /opt/cloudbolt/manage.py features --reset && systemctl restart httpd

  3. Verify that MFA is active

    • Check the features list:

      /opt/cloudbolt/manage.py features --list

UI setup and user configuration

  1. Confirm MFA in the Admin UI
    • Log in to CMP.
    • Go to Admin.
    • Confirm that the MFA Management option is now visible.
  2. Enable MFA for users
    • Go to Admin > MFA Management.
    • Select one or more users, select the shield icon (Enable MFA For Select Users), then select Enforce MFA.
  3. User MFA setup
    • When a user with MFA enabled logs in to CMP, they are prompted to set up MFA using an app.
    • Select Set up using an app to display a QR code.
  4. Scan the QR code and authenticate
    • Open a TOTP-based authenticator app.
    • Scan the QR code.
    • Enter the six-digit code generated by the app and select Verify.
    • After validation succeeds, the user is logged in.