I've got FBA enabled. Created custom login page, which uses two factor authentication. It is all working fine, same as /_forms/default.aspx.

However, I'd not like users to use /_forms/default.aspx as a back-door and skip additional security check at login.

What is the the best approach for this scenario?

  • I can do that as modifying web.config for _forms: <deny users="*" /> But it seems like a hack. – Milen Nov 5 '13 at 10:29

You can override the login page on the web application settings in Central Administration. You would need to create a login page to replace it with. There are a number of examples on the web, here is one you could start with: http://sivarajan.me/post/SharePoint-2013-Enabling-Custom-Login-Page-and-Mixed-Contents-Part-2


To answer your revised question, you can redirect the page at the IIS level. The URL Rewrite module for IIS could handle this for you: http://www.iis.net/downloads/microsoft/url-rewrite

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.