Two Factor Authentication

Zergaw CloudStack significantly enhances security by integrating robust Two-Factor Authentication (2FA) capabilities. This critical feature mandates that users provide an additional layer of verification beyond their standard username and password credentials. After successfully entering their initial login details, users are prompted to supply a unique, time-sensitive 2FA code, dramatically reducing the risk of unauthorized access. Even if an attacker manages to compromise a user's password, they would still require physical access to the user's registered 2FA device to gain entry.

Zergaw CloudStack offers flexibility and broad compatibility in its 2FA implementation, currently supporting widely adopted and trusted providers such as Google Authenticator. This means users can leverage any TOTP (Time-based One-Time Password) compliant authenticator application available on their smartphones or other devices, generating a new, unique code every few seconds. This standard ensures a strong, constantly refreshing security token. Furthermore, for specific operational needs or simpler use cases, Zergaw CloudStack also supports static PINs as a 2FA provider, offering an alternative method where a predefined, secure PIN serves as the second factor. This comprehensive approach to 2FA empowers organizations to bolster their security posture, protect sensitive cloud resources, and meet compliance requirements by providing diverse, reliable, and user-friendly options for multi-factor verification.

2FA is applicable to authentication mechanisms using username/password, LDAP, SAML. While using apikey/secretkey 2FA checks will be bypassed.

If 2FA is configured for the User, the 2FA verification page looks like below after the login.

Users can configure 2FA using the action button in User form.

In the 2FA setup form, the User needs to select one of the providers. Zergaw CloudStack currently supports Google Authenticator or other TOTP Authenticators and static PIN as the 2FA providers.

When the Google Authenticator or other TOTP 2FA provider is selected, the User must setup the Account in the respective application in their device by either scanning the QR code or using the setup key provided by Zergaw CloudStack. Once this is set up in the authenticator application, the User must always use the provided 2FA codes to log in.

When the static PIN 2FA provider is selected, the User must use the static PIN as the code to verify 2FA with Zergaw CloudStack. The User must input this static PIN as a 2FA code every time they need to login.

2FA Recovery process : If the User loses the authenticator
application or forgets the static PIN, then the User must contact admin
to disable 2FA.