{"id":10748,"date":"2021-02-23T01:45:12","date_gmt":"2021-02-23T09:45:12","guid":{"rendered":"https:\/\/www.couchbase.com\/blog\/?p=10748"},"modified":"2025-06-13T19:27:57","modified_gmt":"2025-06-14T02:27:57","slug":"multi-factor-authentication-mfa-2fa","status":"publish","type":"post","link":"https:\/\/www.couchbase.com\/blog\/multi-factor-authentication-mfa-2fa\/","title":{"rendered":"Deep Dive on Multi-Factor Authentication"},"content":{"rendered":"

In this article I will explain what multi-factor authentication is, why you should be using it and how to easily implement it with Couchbase Server.\u00a0 We\u2019ll look at using both software and hardware implementations, which offer a tradeoff between cost, convenience and security.<\/span><\/p>\n

What is
\nMulti-Factor Authentication ?\u00a0<\/span><\/h2>\n

Authentication on a Couchbase cluster is secured with a combination of user passwords, Role Based Access Control (RBAC) and, optionally, x.509 certificates.\u00a0 Passwords have been around a long time and have served their purpose well but using them alone leaves you open to various hacking techniques.\u00a0 The good news is that passwords can be augmented with additional user information for higher levels of security in what is known as Multi-factor authentication (MFA).\u00a0 You may sometimes also see this referred to as 2nd factor authentication (2FA), though 2FA is really just a subset of the wider capabilities of MFA, which can combine not just two factors, but many varied forms.\u00a0\u00a0<\/span><\/p>\n

The basics of Multi-factor authentication is authenticating a user by validating two or more claims presented by the user, each from a different category of factors. Let\u2019s look at an example that you\u2019ve been using for years and probably never even realised; using an Automated Teller Machine (ATM) to withdraw money.\u00a0 <\/span><\/p>\n

\"MFA<\/a>

ATM multi-factor authentication<\/p><\/div>\n

Your bank will require you to insert your smart chip equipped bank card into the machine and input a pin code.\u00a0 You are going to be recorded on video, which could be used for facial recognition and they will have limits on how much you can withdraw per day.\u00a0 The bank will also use fraud detection algorithms which will block your transaction if you are located somewhere physically different to where your last transaction was recorded, if it\u2019s impractical to travel that distance in the intervening time period.\u00a0 If the transaction is from a location that is highly suspect, where you aren\u2019t normally located, you might even get a phone call from the bank to confirm.\u00a0 Let\u2019s review the different authentication factors that are available.<\/span><\/p>\n\n\n\n\n\n\n\n
Something you Know<\/span>
\n<\/span>(Knowledge factors)<\/span><\/td>\n		\n
    \n
  • ATM Pin<\/span><\/li>\n
  • Password<\/span><\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Something you have<\/span>
\n<\/span>(Possession factors)<\/span><\/td>\n		\n
    \n
  • EMV Bank Card with a chip<\/span><\/li>\n
  • Mobile Phone push notification<\/span><\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Something you are<\/span>
\n<\/span>(Inherence factors)<\/span><\/td>\n		\n
    \n
  • Facial Identification<\/span><\/li>\n
  • Fingerprint<\/span><\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Somewhere you are<\/span>
\n<\/span>(Location factors)<\/span><\/td>\n		\n
    \n
  • GPS location<\/span><\/li>\n
  • IP Address<\/span><\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
When you act<\/span>
\n<\/span>(Time factors)<\/span><\/td>\n		\n