A second factor (authenticator app) is required after the password. Forgotten password: an administrator resets it on the control VM with envctl user reset.
envctl user reset