0

So currently the previous engineer has developed a 2FA functionality for the sharepoint 2010 intranet we are supporting. currently it is deployed as a webpart on the homepage and it does redirect users to the 2fa authentication page when they access it. however, they can bypass the 2fa by going directly to the site content or site settings without having the need to be authenticated.

_layouts/viewlsts.aspx AND layouts/settings.aspx

My question is. Do I have to change something to the existing code? It works in the homepage because it is deployed in that page as a webpart. But since we cannot edit the site settings page to insert the webpart I am not sure how to implement it.

Note: not all users are needed to be redirected to the 2FA only a few people which is being stored in a custom list.

EDIT: - added code snippet used:

public Hashtable Send2FArequest()
        {
            //change of TLS 1.2
            ServicePointManager.Expect100Continue = true;
            ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;

            Hashtable result = new Hashtable();
            Process2FaBC.ResponeMsg reMsg = new Process2FaBC.ResponeMsg();
            this.SetRequestInfo(this.RequestCode);
            if (this.Method == "GET" || this.Method == "DELETE")
            {
                //08Oct2018: commented
                //ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(this.CheckValidationResult);
                HttpWebRequest httpWebRequest = (HttpWebRequest)WebRequest.Create(this.RequestURL);
                this.CreateRequestHeaders(httpWebRequest);
                HttpWebResponse httpWebResponse = (HttpWebResponse)httpWebRequest.GetResponse();
                string responseString = new StreamReader(httpWebResponse.GetResponseStream()).ReadToEnd();
                reMsg = this.AnalysisResponeXML(responseString);
                result = this.GetReturnHashTable(reMsg);
                httpWebResponse.Close();
            }
            else if (this.Method == "POST" || this.Method == "PUT")
            {
                //08Oct2018: commented
                //ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(this.CheckValidationResult);
                HttpWebRequest httpWebRequest = (HttpWebRequest)WebRequest.Create(this.RequestURL);
                this.CreateRequestHeaders(httpWebRequest);
                using (Stream requestStream = httpWebRequest.GetRequestStream())
                {
                    byte[] parameterData = this.ParameterData;
                    requestStream.Write(parameterData, 0, parameterData.Length);
                    requestStream.Close();
                }
                HttpWebResponse httpWebResponse = (HttpWebResponse)httpWebRequest.GetResponse();
                string responseString = new StreamReader(httpWebResponse.GetResponseStream()).ReadToEnd();
                reMsg = this.AnalysisResponeXML(responseString);
                result = this.GetReturnHashTable(reMsg);
                httpWebResponse.Close();
            }
            return result;
        }
0

A web part is the wrong way to go for this. Not only could people access site settings, but they should be able to access any other page in the site that doesn't have that web part. This would require code on every page in the site. If you want this to happen regardless of which site or web app they go to, then a custom http module should work.

  • Hi @Mike2500 Thank You for this! this is actually my first time doing this but he did something like this kindly see the updated question can i just simply move these codes into the httpmodule one that i need to create? – Page F.P.T Jan 24 at 3:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.