ARTIFACTORY: Enabling MFA using Access Yaml Configuration

Multi-Factor Authentication

The use of Multi-factor authentication (MFA) increases the security of accessing JFrog applications. As soon as the Google Authenticator application is enabled, you will also be required to authenticate with a one-time password (OTP) generated by this additional authentication factor. By using a multi-factor authentication method, malicious users will not be able to gain access to JFrog applications if a user's credentials have been compromised.

Enabling MFA authentication through GUI:

We could enable the Multi-Factor authentication using JFrog platform UI by following the suggested method as mentioned in the link. Further, if you would like to achieve the same through the Access configuration files directly from backend, using the access.config.latest.yml file, you may need to follow the below instructions (Access YAML Configuration).

Steps:

1. Create a file access.config.patch.yml under $JFROG_HOME/artifactory/var/etc/access directory.
2. Take a backup of the access.config.latest.yml file.

   cp access.config.latest.yml access.config.latest.yml_bkp

3. Add the below configuration to the access.config.patch.yml file.

security:
    multi-factor-authentication:
        authenticators:
         - "google"

4. Provide the ownership of the Artifactory to the access.config.patch.yml file using the below command.

 chown artifactory:artifactory access.config.patch.yml

5. Restart Artifactory for the new configuration to take effect.

The MFA enablement can be confirmed on Artifactory UI by navigating to

Administration -> User Management -> Settings -> Multi-Factor Authentication Methods

as mentioned in the below image



For the authentication to be performed, by navigating to the login page please follow the below steps.

Step1:

Provide user credentials.

Step 2:

Scan the QR code though the google authenticator app installed on user phone.
 

Step 3:

Provide the code from the google authenticator app installed on user phone.
 

Step 4:

Observe that the authentication is accepted and the instance is proceeding to redirect to the GUI from the browser.