Sitefinity Custom 2FA Authentication

sitefinity | NET, CMS, Sitefinity | 2021-05-20

Only tested in V12.x

Idea in general

Create a new user in Sitefinity
User receive QR code and setup in Authenticator
User login with username & password -> Prompt for 2FA code
Login Successful!

Sample Code

Haw Jeh GitHub - Sitefinity 2FA

Steps

Go to

/Sitefinity/Administration/ProfileTypes -> Basic Profile
Add a custom field – AuthCode (ShortText) in user profile

screen1

Create a new user, wait for email and setup the Authenticator in your mobile.

screen2

Go to /Sitefinity/Administration/Settings/Advanced

a. Authentication -> Authentication protocol -> set to SimpleWebToken

b. Security -> RelyingParties -> Add a new record, and state the realm=”(host)”, key can be exactly same as the default localhost’s key.

c. Security -> SecurityTokenIssuers -> Add a new record, and state the realm=”(host)”, key can be exactly same as the default localhost’s key.

screen3

Update wsFederation at web.config

 <system.identityModel.services>
    <federationConfiguration>
      <wsFederation passiveRedirectEnabled="true" issuer="http://<host>/wsauth/authenticate/swt" realm="http://<host>" requireHttps="false" />
      <cookieHandler requireSsl="false" />
    </federationConfiguration>
  </system.identityModel.services>

Restart Sitefinity.
Go to /Sitefinity, it will route you to the sample login screen

screen4

Further enhancements:

Make fields configurable, such as: – custom field name – email template
Make it work in all Sitefinity version (Currently tested in v12.2)

References