Abiquo supports two-factor authentication for the user interface to improve login security.
- The Systems Administrator configures two-factor authentication for the platform (see steps below)
- The Cloud Administrator can configure tenants to force users to work with two-factor authentication
- If two-factor authentication is configured for the platform but not required for a user's tenant, the user can still choose to enable it
For a description of the user functionality, see Configure your user account
Note: When you enable the Abiquo OpenID Connect integration, Abiquo disables two-factor authentication.
Configure authentication system
To configure the authentication system do these steps:- Synchronize system time: two-factor codes are dependent on the system time
For a multi-datacenter configuration, configure Appliance manager for template upload and download as described in Uploading and dowloading templates in multi datacenter
For each enterprise that requires 2FA, migrate automation and integrations to OAuth, see Authentication#OAuthv1.0VersionAAuthentication. To implement two-factor authentication for a portal, see Authentication
For events and event streaming, if the M-user belongs to a tenant that must use 2FA, configure the M-user to use OAuth. Enter the OAuth credentials in the Abiquo properties file. See Abiquo Configuration Properties#m. See Authentication#OAuthv1.0VersionAAuthentication.
Configure Google Authenticator properties. Set the name of the issuer of authentication codes. See Abiquo Configuration Properties#2fa
Configure email authentication properties:
Set the email server configuration, including the sender with the "from" property. See Abiquo Configuration Properties#server
Set the length of time that the email codes will be valid for. See Abiquo Configuration Properties#2fa
For email authentication, you can edit the email message. See Configure Email Templates
Troubleshooting two-factor authentication
- Check server date and time synchronization as part of the user issue troubleshooting process.
Manage two-factor authentication in the Abiquo UI and API
For the platform, enable two-factor authentication in the Configuration view (or using the API).
When an administrator creates or edits an enterprise, they can mark a checkbox to require two-factor authentication of all users in the enterprise.
In the API, this is done by setting the enterprise attribute of twoFactorAuthenticationMandatory to true.
If two-factor authentication is not required, the user can still enable it from the username menu by clicking on the icon or username in the top right-hand corner of the screen and selecting two-factor authentication. Note that you can enable or disable 2fa for your own user only.
Using the API, you enable or disable 2fa by posting the authentication method to the action link of the user.
For information about how users will work with two-factor authentication, see Configure your user account