Authentication is handled by Keycloak (auth.cyberlisten.cloud). Multi-factor is required for privileged roles.