---
title: iVALT Two-Factor Authentication in Access Server
canonical: https://openvpn.net/as-docs/v3/ivalt-2fa/
product: Access Server Docs
description: OpenVPN's Access Server supports integrating iVALT 2FA using a Python post-authentication script.
---

# iVALT Two-Factor Authentication in Access Server

Access Server supports integrating iVALT Two-Factor Authentication (2FA) using a post-authentication script (PAS). This allows administrators to add an additional authentication factor to the login process, requiring users to verify their identity through iVALT before establishing a VPN session.

With iVALT 2FA enabled, users must successfully complete both:

- Their primary authentication method (such as local, LDAP, RADIUS, or SAML), and
- The iVALT second-factor verification.

This integration can help organizations:

- Strengthen remote access security.
- Meet compliance requirements.
- Add an extra layer of protection beyond username and password authentication.

The iVALT verification step is enforced during the post-authentication hook, before the VPN connection is fully established.

- [Tutorial: Add iVALT Two-Factor Authentication to Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--ivalt-2fa-access-server.md)

> **Important**
>
> The iVALT integration is implemented using a custom post-authentication script. Administrators are responsible for maintaining and validating the script configuration. Ensure the integration is properly tested before deploying it to production environments.

---

Prev: [LastPass 2FA](https://openvpn.net/as-docs/v3/lastpass-2fa.md)
Next: [Challenge/Response](https://openvpn.net/as-docs/v3/challenge-response.md)
Index: https://openvpn.net/as-docs/llms.txt