Multi-Factor Authentication

Multi-factor authentication (MFA), also known as 2-factor authentication, allows you to add an extra layer of security to your Connectware account. With MFA, you need a one-time code generated by an authentication app in addition to your main Connectware password to sign in.

If you do not have access to your authentication device, you can use backup codes to sign in or ask a Connectware admin to disable your MFA. Connectware admins can disable MFA for each user individually.

Prerequisites for Multi-Factor Authentication

General

• Offline access: Multi-factor authentication can be used even without an internet connection.

• Microsoft Entra ID limitation: Multi-factor authentication is not available when using Microsoft Entra ID for authentication.

For Administrators (MFA Implementation)

To configure multi-factor authentication, administrators need to modify the Connectware configuration file:

• Kubernetes: Modify the values.yaml file.

• Docker: Modify the .env file.

For Users (MFA Usage)

• MFA enabled: Your organization has enabled multi-factor authentication for your Connectware account.

• Usage: Multi-factor authentication can be optional or mandatory depending on your organization's settings.

• Authentication apps: You have installed a time-based one-time password (TOTP) authentication app such as:

  • Google Authenticator

  • Microsoft Authenticator

  • Authy

  • FreeOTP

Configuration Parameters (Multi-Factor Authentication)

Configure the following environment variables to enable multi-factor authentication.

Helm Values

Helm Values (Multi-Factor Authentication)

Helm value	Description	Status
global.authentication.mfa.enabled	If set to true, multi-factor authentication is enabled. If set to false, multi-factor authentication is disabled.	Required
global.authentication.mfa.encryptionSecret	Primary encryption key that secures MFA.	Required*
global.authentication.mfa.encryptionSalt	Random value added to strengthen the encryption process.	Required*
global.authentication.mfa.existingSecret	The name of your existing Kubernetes secret that contains the encryptionSecret and encryptionSalt values.	Required*

* You must provide either encryptionSecret and encryptionSalt or provide the existingSecret. For enhanced security, use existingSecret. For more information, see Using Kubernetes Secrets (Recommended).

Environment Variables

Environment Variables (Multi-Factor Authentication)

Environment variable	Description	Status
CYBUS_MFA_ENABLED	If set to true, multi-factor authentication is enabled. If set to false, multi-factor authentication is disabled.	Required
CYBUS_MFA_ENCRYPTION_SECRET	Primary encryption key that secures MFA.	Required
CYBUS_MFA_ENCRYPTION_SALT	Random value added to strengthen the encryption process.	Required
CYBUS_MFA_MAX_INVALID_OTPS_PER_USER	Sets how many times a user can enter an incorrect one-time password when logging in with multi-factor authentication before their account is temporarily locked.	Optional
CYBUS_MFA_BAN_DURATION_MINUTES	Sets the lockout period (in minutes) after too many failed one-time password attempts when logging in with multi-factor authentication.	Optional

Encryption Secrets and Salt

The multi-factor authentication system uses two critical security components:

• Secret: An encryption key for securing MFA tokens.

• Salt: A random value that enhances encryption strength.

Changing the encryption secret or salt will invalidate all existing MFA configurations, requiring users to reconfigure their MFA settings. Keep these values secure. If compromised, an attacker could potentially bypass authentication.

Configuring Connectware to Support Multi-Factor Authentication

To use multi-factor authentication with a new Connectware installation or with your existing Connectware setup, you must update your Connectware configuration file. The update procedure depends on your current installation method.

• Kubernetes: Modify the values.yaml file.

• Docker: Modify the .env file.

Kubernetes Configuration

Multi-Factor Authentication Configuration for Kubernetes

There are two ways to configure multi-factor authentication encryption settings in your Kubernetes deployment. You must choose one of these methods:

• Kubernetes secrets (recommended): Use Kubernetes secrets to store your encryption values.

• Clear text values: Write the encryption values directly in your values.yaml file in clear text.

Using Kubernetes Secrets (Recommended)

1. Create a Kubernetes secret. The values in Kubernetes secrets must be base64-encoded strings.

kubectl create secret generic my-mfa-secret --from-literal=encryptionSecret=$(echo -n "18473274-5073-11ee-be56-0242ac120002" | base64)  --from-literal=encryptionSalt=$(echo -n "229c75c2-5073-11ee-be56-0242ac120002" | base64)

1. Open the values.yaml file.

   • Now you must configure the helm file to enable multi-factor authentication.

2. Configure the following helm values to enable and configure multi-factor authentication.

global:
    authentication:
        mfa:
            # Enable multi-factor authentication
            enabled: true
            # The name of your existing Kubernetes secret that contains the encryptionSecret and encryptionSalt values
            existingSecret: my-mfa-secret

1. Optional: Specify the allowed number of invalid one-time password attempts and the lockout period after too many failed one-time password attempts.

global:
    authServer:
        env:
            # Specify the allowed number of invalid one-time password attempts
            - name: CYBUS_MFA_MAX_INVALID_OTPS_PER_USER
              value: '5'
            # Specify the lockout period after too many failed one-time password attempts in minutes
            - name: CYBUS_MFA_BAN_DURATION_MINUTES
              value: '10'

1. After configuring your values.yaml file, deploy or update Connectware by running the following Helm command:

Make sure to adjust the command parameters based on your specific setup:

• Installation name (currently set to connectware)

• Namespace (currently set to cybus)

• Repository name (currently set to cybus/connectware)

• Path and filename of your values file (currently set to values.yaml)

helm upgrade --install connectware -n cybus cybus/connectware -f values.yaml

Using Clear Text Values

Storing encryption secrets and salt values in clear text within your values.yaml file is not recommended for production environments. Instead, use Kubernetes secrets to manage these sensitive values securely. The clear text configuration shown below should only be used for development or testing purposes.

1. Open the values.yaml file.

   • Now you must configure the helm file to enable multi-factor authentication.

2. Configure the following helm values to enable and configure multi-factor authentication.

global:
    authentication:
        mfa:
            # Enable multi-factor authentication
            enabled: true
            # Clear text secret key for encrypting MFA secrets
            encryptionSecret: '18473274-5073-11ee-be56-0242ac120002'
            # Clear text salt value for encrypting MFA secrets
            encryptionSalt: '229c75c2-5073-11ee-be56-0242ac120002'

1. Optional: Specify the allowed number of invalid one-time password attempts and the lockout period after too many failed one-time password attempts.

global:
    authServer:
        env:
            # Specify the allowed number of invalid one-time password attempts
            - name: CYBUS_MFA_MAX_INVALID_OTPS_PER_USER
              value: '5'
            # Specify the lockout period after too many failed one-time password attempts in minutes
            - name: CYBUS_MFA_BAN_DURATION_MINUTES
              value: '10'

1. After configuring your values.yaml file, deploy or update Connectware by running the following Helm command:

Make sure to adjust the command parameters based on your specific setup:

• Installation name (currently set to connectware)

• Namespace (currently set to cybus)

• Repository name (currently set to cybus/connectware)

• Path and filename of your values file (currently set to values.yaml)

helm upgrade --install connectware <repository>/connectware -f values.yaml

Docker Configuration

Multi-Factor Authentication Configuration for Docker

1. Navigate to your Connectware installation directory. If you have used the default values during installation, this is the installation folder: /opt/connectware. The directory contains an .env file that is loaded when starting Connectware.

2. Open the .env file.

   • Now you must configure the .env file to enable multi-factor authentication.

3. Configure the following environment variables to enable and configure multi-factor authentication.

environment:
    # Enable multi-factor authentication
    CYBUS_MFA_ENABLED=true

    # Multi-factor authentication encryption credentials
    CYBUS_MFA_ENCRYPTION_SECRET=18473274-5073-11ee-be56-0242ac120002
    CYBUS_MFA_ENCRYPTION_SALT=229c75c2-5073-11ee-be56-0242ac120002

1. Optional: Specify the allowed number of invalid one-time password attempts and the lockout period after too many failed one-time password attempts.

environment:
    # Specify the allowed number of invalid one-time password attempts
    CYBUS_MFA_MAX_INVALID_OTPS_PER_USER=5

    # Specify the lockout period after too many failed one-time password attempts in minutes
    CYBUS_MFA_BAN_DURATION_MINUTES=10

1. After configuring the environment variables, restart Connectware by running docker compose up -d in your installation directory.

For a list of all environment variables for Docker Compose, see Docker Compose.

Setting up Multi-Factor Authentication

1. On the navigation panel, click Settings.

2. Click Enable Multi-Factor Authentication.

3. Open your authentication app and do one of the following:

• Scan the QR code.

• Enter your secret key.

The authentication app generates a one-time 6-digit code.

1. Enter the one-time 6-digit code in the Register Device fields and click Enable Multi-Factor Authentication. Connectware displays a list of backup codes. If you do not have access to your authentication device, you can use a backup code instead of a one-time 6-digit code. You can use each backup code only once. Alternatively, you can ask a Connectware admin to disable your MFA.

2. Copy and paste the backup codes to a safe location.

Signing in with Multi-Factor Authentication

1. On the Connectware login screen, enter your Username and Password.

2. Click Sign In.

3. Open the authentication app and select your Connectware account.

4. Enter the one-time 6-digit code displayed on the authentication app.

Signing in with Multi-Factor Authentication Backup Codes

If you have no access to your multi-factor authentication app, you can use backup codes instead of a one-time 6-digit code to sign in to Connectware. Backup codes are displayed when you set up multi-factor authentication.

This gives you access to Connectware in case you have misplaced your authentication device, uninstalled your authentication app or removed Connectware from your authentication app.

You can use each backup code only once.

1. On the Connectware login screen, enter your Username and Password.

2. Click Sign In.

3. Click Use backup code.

4. In the Backup Code field, enter your backup code and click Sign In.

Disabling Multi-Factor Authentication (User)

You must have access to your authentication app to disable multi-factor authentication.

If you do not have access to your authentication app, ask a Connectware admin to disable your multi-factor authentication.

1. On the navigation panel, click Settings.

2. In the Multi-Factor Authentication section, click Disable Multi-Factor Authentication.

3. Open the authentication app and select your Connectware account.

4. Enter the one-time 6-digit code displayed on the authentication app.

5. Click Disable Multi-Factor Authentication.

Disabling Multi-Factor Authentication (Admin)

As a Connectware admin, you can disable multi-factor authentication for each user individually.

1. On the navigation panel, select User Management > Users and Roles.

2. Click the user for which you want to disable the multi-factor authentication.

3. In the MFA row, click Disable.

4. Click Update.

Regenerate Backup Codes

You must have access to your authentication app to regenerate multi-factor authentication backup codes.

1. On the navigation panel, click Settings.

2. In the Multi-Factor Authentication section, click Regenerate Backup Codes.

3. Open the authentication app and select your Connectware account.

4. Enter the one-time 6-digit code displayed on the authentication app in the text field.

5. Click Regenerate Backup Codes.

Making Multi-Factor Authentication Mandatory for Individual Users (Admin)

As a Connectware admin, you can set multi-factor authentication to be the mandatory login method for individual users.

For LDAP users, you can set CYBUS_LDAP_AUTO_ENFORCE_MFA to true to make multi-factor authentication the mandatory login method for all new LDAP users. For more information, see Connectware LDAP Parameters.

1. On the navigation panel, select User Management > Users and Roles.

2. Click the user for which you want to make multi-factor authentication mandatory.

3. In the MFA (Required) row, click Enable.

4. Click Update.