In cloud computing, access control and security are two major problems, and there are some differences from traditional identity authentication. Inspired by the semi-group and chaotic properties of Chebyshev polynomials, a scheme of password-authenticated key agreement using Chebyshev chaotic mapping and biometrics has been presented. In the proposed model, the users and the servers need to register at the cloud service provider (CSP) in the beginning. Then they can complete authentication and establish session key without the participation of CSP. Moreover, security analysis and performance comparison show that the proposed scheme satisfies many security factors, such as mutual authentication, user privacy protection, multi-factor security and forward security. Forward security assures the confidentiality of the user's session key, even if the private key of the CSP is compromised. The proposed scheme is also robust to resist man-in-the-middle attacks, off-line password guessing and impersonation attacks, etc. In addition, it supports efficient changes to user passwords and biometric characteristics in a multi-server environment.