---
title: "Two-factor authentication in the public cloud"
sidebar_label: "Two-factor authentication"
sidebar_position: 14
description: "How to set up two-factor authentication using the Multifactor service"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'

# Two-factor authentication in the public cloud

VMware Cloud Director® supports two authentication methods: local user database and Single Sign-On (SSO) via the SAML protocol.

You can enable two-factor authentication using any service. Using the [Multifactor](/2fa/) solution, you can enable two-factor authentication via SSO for individual users. Local authentication will work in parallel. In Cloud Director, the user base with local access and access via SSO will be shared.

## Enable two-factor authentication via Multifactor \{#enable-2fa-via-multifactor}

1. [Order and set up Multifactor two-factor authentication](#order-service).
2. [Create a SAML application](#create-saml-app).
3. [Configure the SAML application](#configure-saml-app).
4. [Add users](#add-users).

### 1. Order and set up Multifactor two-factor authentication \{#order-service}

Use the [Order and set up Multifactor two-factor authentication](/2fa/order-2fa.mdx) guide.

### 2. Create a SAML application \{#create-saml-app}

1. In the [Multifactor control panel](https://admin.multifactor.ru/resources), go to the **Resources** section.
2. Click **Add resource**.
3. In the **Site** block, select **SAML application**.
4. Enter the resource name.
5. Select an identity provider.
6. If you selected **Active Directory**, enter the portal address.
7. Optional: to ensure that a user is automatically created in Multifactor upon their first authorization in Cloud Director, enable the **Register new users** toggle.
8. Optional: to require the user to self-configure 2FA and prevent authorization in Cloud Director without it, select the **Enable self-configuration/Deny access** checkbox.
9. Click **Save**.
10. On the SAML application page, in the **Multifactor Metadata** block, download the SAML application metadata file.

### 3. Configure the SAML application \{#configure-saml-app}

1. From the [control panel](https://my.selectel.ru/), open the Cloud Director panel: **Cloud powered by VMware** → **Cloud Director**.

2. Open the **Administration** tab.

3. Go to **Identity Providers** → **SAML**.

4. Click **Configure**.

5. Open the **Service Provider** tab.

6. In the **Entity ID** field, paste your cloud address:

   * Moscow — `https://vcd-msk.selectel.ru/tenant/<s-xxxx>/`
   * Saint Petersburg — `https://vcd.selectel.ru/tenant/<s-xxxx>/`

   Specify `<s-xxxx>` — the organization name; you can view it in the Cloud Director address bar or in the [control panel](https://my.selectel.ru/) under **Cloud powered by VMware** in the list of organizations.

7. Open the **Identity Provider** tab.

8. Enable the **Use SAML Identity Provider** toggle.

9. Upload the [SAML application metadata file](#create-saml-app).

10. Click **Save**.

11. Open the **Service Provider** tab.

12. In the **Service Provider Metadata** field, click **Retrieve Metadata**. The metadata file will be downloaded to your device.

13. In the [Multifactor control panel](https://admin.multifactor.ru/resources), go to the **Resources** section.

14. In the SAML application row, click **Settings**.

15. In the **Service Provider** block, click **Upload metadata** and upload the file.

### 4. Add users \{#add-users}

1. From the [control panel](https://my.selectel.ru/), open the Cloud Director panel: **Cloud powered by VMware** → **Cloud Director**.
2. Open the **Administration** tab.
3. Go to **Access Control** → **Users**.
4. Click **Import Users**.
5. Enter the logins of the users who will be able to connect via SSO.
6. Select the role to be assigned to the users.
7. Click **Save**.

## Log in with two-factor authentication \{#log-in-with-2fa}

1. From the [control panel](https://my.selectel.ru/), open the Cloud Director panel: **Cloud powered by VMware** → **Cloud Director**.
2. In the top-right corner of the menu,  select **Log out**.<MoreVerticalIcon />
3. The **Selectel vCloud Director Logout Page** will open.
4. Click **Login with Single Sign On**.
5. Sign in with your provider account.
6. A one-time code will be sent to the Multifactor application.
7. Enter the code.

<Formbricks />