Enforce two-factor authentication
Require members to sign in with an authenticator app, see who has two-factor authentication, and manage recovery codes and step-up checks.
Two-factor authentication (2FA) adds a second step to signing in: after the password, a member enters a 6-digit code from an authenticator app, such as Google Authenticator, 1Password, or Authy. The code changes every 30 seconds. Each member can turn on 2FA for their own account, and an owner can require it for the members of the organization.
Before you begin
- To require 2FA, you need the Owner role granted on the subscription. An owner of a project, or a member with a custom role, can't change the setting; they see it as read-only.
- Turn on 2FA for your own account first, so that you aren't asked to set it up at your next sign-in. See Set up two-factor authentication.
Require two-factor authentication
In the console, go to Identity & AccessAuthentication.
Under Organization policy, turn on Enforce 2FA for all members.
The setting is saved at once, without a confirmation. When you turn it on:
- Members without 2FA set it up at their next sign-in. This includes people who accept an invitation while the setting is on: they set up 2FA the first time they sign in. After entering their password, they must set up an authenticator before they can finish signing in. See What members see at sign-in.
- Open sessions continue. Sessions that are already open aren't ended. To end a member's sessions, see Manage sessions.
- API tokens and service accounts aren't affected. They don't sign in.
To stop requiring 2FA, turn off Enforce 2FA for all members. Members who set up 2FA keep it.
What members see at sign-in
When a member must set up 2FA, the sign-in continues like this after the password:
The console shows a QR code and a manual entry key, with the message: Your organization requires two-factor authentication. Set up an authenticator app to finish signing in.
The member scans the QR code with their authenticator app, or types in the key.
The member enters the 6-digit code from the app in Verification code, and selects Verify and finish.
The console shows the member's recovery codes once. The member saves them, confirms that they've saved them, and selects Continue to console.
The member has 5 minutes and 5 attempts to enter a correct code. After that, they start again with their password. From then on, the member enters a code from the app every time they sign in.
See who has 2FA
- In Identity & AccessUsers, the MFA column shows On or Off for each member.
- On a member's page, MFA on the Overview tab shows Enabled or Not configured.
A member counts as having 2FA only after they've confirmed their authenticator with a code. A setup that was started but not confirmed shows as off.
Recovery codes
Recovery codes let a member sign in without their authenticator app. To use them or to generate a new set, see Recovery codes.
Turn off 2FA for your account
Go to Identity & AccessAuthentication, and select Disable two-factor authentication.
Enter a current Authenticator code or your Account password.
Select Disable 2FA.
Your authenticator and your recovery codes are removed. If 2FA is required for you, you set it up again at your next sign-in.
If a member loses their authenticator
- With a recovery code. The member signs in with a recovery code, turns off 2FA, and sets it up again with the new device.
- Without recovery codes. A member with the Owner role, or a custom role with Manage access to Identity & Access, can remove the member's second factor through the API, with the POST
/scopes/{scopeId}/iam/users/{userId}/actions/revokeoperation and the targetmfa_device. There's no console action for this. You can't remove the second factor of a member who ranks above you at any scope. If 2FA is required for the member, they set up a new authenticator at their next sign-in.
Step-up verification
Some actions need a recent 2FA verification on the console session that you're using, even when you're already signed in:
| Action | What's asked | Valid for |
|---|---|---|
| Create an OpenStack application credential, for yourself or a service account | A 6-digit code from your authenticator app | 5 minutes |
| Rotate an OpenStack application credential | A 6-digit code from your authenticator app | 5 minutes |
| Switch your organization's OpenStack API access on or off | A 6-digit code from your authenticator app | 5 minutes |
When you start one of these actions without a recent verification, the console shows Confirm it's you. Enter the code in Authenticator code, and select Verify code. The action then continues.
- A verification counts for 5 minutes on the session where you entered it. Signing in with a code from your authenticator app also counts, for 5 minutes after you sign in.
- Recovery codes aren't accepted for a step-up, and a sign-in with a recovery code doesn't count as one.
- Revoking an OpenStack application credential doesn't need a step-up.
If you haven't set up 2FA, the console shows Set up two-factor authentication first instead, and the action doesn't run. Select Set up two-factor authentication, set up 2FA, and start the action again.
API tokens and service account keys can't perform these actions, because they can't complete a step-up.