Skip to main content

Two-factor authentication in the public cloud

Last update:

VMware Cloud Director® supports two authentication methods: local user database and Single Sign-On (SSO) via the SAML protocol.

You can enable two-factor authentication using any service. Using the Multifactor solution, you can enable two-factor authentication via SSO for individual users. Local authentication will work in parallel. In Cloud Director, the user base with local access and access via SSO will be shared.

Enable two-factor authentication via Multifactor

  1. Order and set up Multifactor two-factor authentication.
  2. Create a SAML application.
  3. Configure the SAML application.
  4. Add users.

1. Order and set up Multifactor two-factor authentication

Use the Order and set up Multifactor two-factor authentication guide.

2. Create a SAML application

  1. In the Multifactor control panel, go to the Resources section.
  2. Click Add resource.
  3. In the Site block, select SAML application.
  4. Enter the resource name.
  5. Select an identity provider.
  6. If you selected Active Directory, enter the portal address.
  7. Optional: to ensure that a user is automatically created in Multifactor upon their first authorization in Cloud Director, enable the Register new users toggle.
  8. Optional: to require the user to self-configure 2FA and prevent authorization in Cloud Director without it, select the Enable self-configuration/Deny access checkbox.
  9. Click Save.
  10. On the SAML application page, in the Multifactor Metadata block, download the SAML application metadata file.

3. Configure the SAML application

  1. From the control panel, open the Cloud Director panel: Cloud powered by VMware → Cloud Director.

  2. Open the Administration tab.

  3. Go to Identity Providers → SAML.

  4. Click Configure.

  5. Open the Service Provider tab.

  6. In the Entity ID field, paste your cloud address:

    • Moscow — https://vcd-msk.selectel.ru/tenant/<s-xxxx>/
    • Saint Petersburg — https://vcd.selectel.ru/tenant/<s-xxxx>/

    Specify <s-xxxx> — the organization name; you can view it in the Cloud Director address bar or in the control panel under Cloud powered by VMware in the list of organizations.

  7. Open the Identity Provider tab.

  8. Enable the Use SAML Identity Provider toggle.

  9. Upload the SAML application metadata file.

  10. Click Save.

  11. Open the Service Provider tab.

  12. In the Service Provider Metadata field, click Retrieve Metadata. The metadata file will be downloaded to your device.

  13. In the Multifactor control panel, go to the Resources section.

  14. In the SAML application row, click Settings.

  15. In the Service Provider block, click Upload metadata and upload the file.

4. Add users

  1. From the control panel, open the Cloud Director panel: Cloud powered by VMware → Cloud Director.
  2. Open the Administration tab.
  3. Go to Access Control → Users.
  4. Click Import Users.
  5. Enter the logins of the users who will be able to connect via SSO.
  6. Select the role to be assigned to the users.
  7. Click Save.

Log in with two-factor authentication

  1. From the control panel, open the Cloud Director panel: Cloud powered by VMware → Cloud Director.
  2. In the top right corner, in the menu, select Log out.
  3. The Selectel vCloud Director Logout Page will open.
  4. Click Login with Single Sign On.
  5. Sign in with your provider account.
  6. A one-time code will be sent to the Multifactor application.
  7. Enter the code.