Multi-Factor Authentication (2FA/MFA) for ownCloud

Last updated on July 1, 2026

ownCloud is a versatile file synchronization and sharing platform that allows users to store, access, and collaborate on files across different devices.

Multi-Factor Authentication (MFA) for ownCloud adds an extra layer of security to ownCloud logins. Users must complete both primary (login/password) and secondary (Mobile Push) authentication. Even if a cybercriminal knows a user’s password, they won’t gain VPN access without completing the second step.

Overview of MFA for ownCloud

This documentation describes how to integrate Rublon MFA with ownCloud using the LDAP(S) protocol to enable multi-factor authentication for VPN connections.

Rublon MFA for ownCloud integrates via the Rublon Authentication Proxy, supporting the LDAP protocol. It ensures that only authorized users proceed to the secondary authentication method, denying access to potential intruders.

Enable Entra ID logins to ownCloud using Rublon MFA

If ownCloud authenticates users through LDAP or RADIUS, you can use Rublon Authentication Proxy to validate primary credentials against Microsoft Entra ID and then enforce Rublon MFA. This allows users to sign in to ownCloud with Microsoft Entra ID credentials, even when ownCloud does not support Microsoft Entra ID, SAML, OAuth 2.0, or OpenID Connect natively.

See how to authenticate LDAP and RADIUS with Microsoft Entra ID credentials and MFA, or explore the related use case: Microsoft Entra ID logins for LDAP and RADIUS applications with MFA.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
FIDO	–	N/A
Passcode	✔	N/A
SMS Passcode	–	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	–	N/A
Email Link	✔	N/A
YubiKey OTP	✔	N/A
RFID	–	N/A

Before You Start Configuring MFA for ownCloud

Before configuring Rublon MFA for ownCloud:

Ensure you have prepared all required components.
Create an application in the Rublon Admin Console.
Install the Rublon Authenticator mobile app.

Required Components

1. User Identity Provider (IdP) – You need an external Identity Provider, such as Microsoft Active Directory, OpenLDAP, or FreeRADIUS.

2. Rublon Authentication Proxy – Install the Rublon Authentication Proxy if you have not already.

3. ownCloud – Properly configured.

Create an Application in the Rublon Admin Console

1. Sign up for the Rublon Admin Console. Here’s how.

2. In the Rublon Admin Console, go to the Applications tab and click Add Application.

3. Enter a name for your application (e.g., ownCloud) and then set the type to Rublon Authentication Proxy.

4. Click Save to add the new application in the Rublon Admin Console.

5. Copy and save the values of the System Token and Secret Key. You are going to need these values later.

Install Rublon Authenticator

Some end-users may install the Rublon Authenticator mobile app. So, as a person configuring MFA for ownCloud, we highly recommend you install the Rublon Authenticator mobile app, too. Thanks to that, you will be able to test MFA for ownCloud via Mobile Push.

Download the Rublon Authenticator for:

Configuring Multi-Factor Authentication (MFA) for ownCloud

Add LDAP Integration to OwnCloud

1. In the top-left corner, click Files and select Market.

2. Find and select LDAP Integration. Then, click Install to install the module.

3. There is no success message after installation. However, after the blue Install button changes to the white Uninstall button, the module will have been installed successfully.

Configure LDAP Proxy

1. In the top-right corner, click admin and select Settings.

2. From the menu on the left, select User Authentication.

3. To complete the configuration, you must go through the steps in 4 tabs: Server, Users, Login

Attributes, and Groups. The rest are optional.

4. Let’s start from the Server tab. Fill in the fields and click Continue. Refer to the following image and table.

Host	The IP address or hostname of the Rublon Authentication Proxy LDAP Proxy server
Port	389 for LDAP
User DN	The user from your AD/LDAP written in LDAP notation, e.g., cn=rublonadmin,ou=Rublon,dc=rublondemo,dc=local
Password	The password of the User DN user.
One Base DN per line	In this section, you can enter the specific Distinguished Name (DN) for fetching users. No manual entry is required; if the fields above are completed, simply click the Detect Base DN button and ownCloud will automatically select the primary Base DN for your domain, such as dc=rublondemo,dc=local

4. In the Users tab, the settings depend on your preferences and how your base LDAP is configured. The default settings should suffice. Click Continue to go to the next tab. In case you want to change the settings:

Only these object classes: defines what object classes from LDAP should be taken into account when searching for users (person by default)
Only from these groups: restricts access to users of the specified group or groups. However, you do not have to indicate any group in which case users from the entire domain or the Base DN will be taken into account.
Note that the LDAP Filter listed below changes depending on the selected settings.
You can verify the correctness of your settings using Verify settings and count users. After clicking this button, the number of detected users should appear next to it.

5. In the Login Attributes tab, the settings depend on your preferences and how your base LDAP is configured. The default LDAP / AD Username setting should suffice. Click Continue to go to the next tab. Optionally, you can click Verify settings to check if your settings are correct.

6. In the Groups tab, the settings depend on your preferences and how your base LDAP is configured. The default settings should suffice.

7. All other tabs are optional and you can keep their default settings.

Testing Multi-Factor Authentication (MFA) for ownCloud

This example portrays logging in to ownCloud via the ownCloud subdomain login page, e.g. https://owncloud.example.co/. Mobile Push has been set as the second factor in Rublon Authentication Proxy configuration (AUTH_METHOD was set to push).

1. Go to your ownCloud subdomain login page.

2. Enter your login and password.