Search Results :

×
Sign Up Contact Us

Contents

Configure Umbraco 2FA Using OTP Over SMS

Umbraco Two-Factor Authentication (2FA) adds an extra layer of security to your Umbraco application login by enabling OTP verification over SMS. After users enter the correct username and password, they receive a time-sensitive one-time passcode (OTP) on their registered mobile number. OTP over SMS is a reliable second-factor method that helps protect user accounts against phishing, brute-force attacks, and unauthorized access. The plugin also supports methods such as Google Authenticator, Microsoft Authenticator, Duo Authenticator, and OTP over Email.

plugin pricing button plugin pricing button Pricing Plans
Select your umbraco version to configure 2FA with:
  • Download the Umbraco Two-Factor Authentication (2FA) plugin.
  • For setting up the Umbraco 2FA plugin, add the below namespaces, services and middleware in your program.cs file. Below here is a sample example.
    Include only the highlighted section below in the program.cs file of your application.

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using System.Reflection;
  using miniorange.aspnet.tfa;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);

  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();

  app.UseSession();

  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseHttpsRedirection();

  app.MapWhen(
    context => context.Request.Path.StartsWithSegments("/TFA") ||
               context.Request.Path.StartsWithSegments("/Validate"),
    tfa =>
    {
      tfa.UseRouting();
      tfa.UseEndpoints(endpoints =>
      {
        endpoints.MapControllers();
      });
    });

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.EndpointRouteBuilder.MapControllers();

      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using miniorange.aspnet.tfa;
  using System.Reflection;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddDeliveryApi()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();
  app.UseSession();
  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.UseInstallerEndpoints();
      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  using System.Reflection;
  using miniorange.aspnet.tfa;

  WebApplicationBuilder builder = WebApplication.CreateBuilder(args);

  builder.Services.AddDistributedMemoryCache();

  builder.Services.AddSession(options =>
  {
    options.IdleTimeout = TimeSpan.FromMinutes(60);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
  });

  builder.Services.AddminiOrangeServices(Assembly.GetExecutingAssembly());

  builder.CreateUmbracoBuilder()
    .AddBackOffice()
    .AddWebsite()
    .AddComposers()
    .Build();

  WebApplication app = builder.Build();

  await app.BootUmbracoAsync();

  app.UseSession();

  app.UseMiddleware<RedirectAfterLoginMiddleware>();
  app.UseStateCheck();

  app.UseHttpsRedirection();

  app.MapWhen(
    context => context.Request.Path.StartsWithSegments("/TFA") ||
               context.Request.Path.StartsWithSegments("/Validate"),
    tfa =>
    {
      tfa.UseRouting();
      tfa.UseEndpoints(endpoints =>
      {
        endpoints.MapControllers();
      });
    });

  app.UseUmbraco()
    .WithMiddleware(u =>
    {
      u.UseBackOffice();
      u.UseWebsite();
    })
    .WithEndpoints(u =>
    {
      u.EndpointRouteBuilder.MapControllers();

      u.UseBackOfficeEndpoints();
      u.UseWebsiteEndpoints();
    });

  await app.RunAsync();

  • Run the application when the configuration is done.

Step-by-step guide for implementing Two-Factor Authentication (2FA) in Umbraco using OTP over SMS.

  • After integration, open your browser and browse the connector dashboard with the URL below:
 https://<umbraco-base-url>/tfa/configure
  • If the registration page or login page pops up, you have successfully added the miniOrange Umbraco 2FA middleware in your application.
Umbraco 2FA - Register with miniOrange

  • Register with your account by clicking the Register button to configure the Umbraco 2FA plugin.
  • After successful registration, you will receive a trial license key on your registered email address.
  • To activate the plugin, you can either:

    • Enter the license key received via email in the provided input field.

    OR

    • Upload the license file that you downloaded using the Download License Key button by using the Choose File option.
Umbraco 2FA - Activate License

  • Then, check the box "I have read the above conditions and I want to activate the plugin", and click the Activate License button.
Umbraco 2FA - Activate License button

  • After successful license activation, the plugin dashboard will open as shown below.
Umbraco 2FA - Plugin Dashboard
  • On the plugin dashboard, click the Configure button under the SMS card to configure OTP over SMS.
Umbraco 2FA - Configure OTP over SMS

  • After clicking on Configure, the OTP over SMS dashboard will open. Click on Configure, select the User phone attribute from the dropdown, enter the phone number and click on the Get OTP button.
Umbraco 2FA - OTP over SMS Get OTP

  • After clicking on the Get OTP button, the user will receive a One Time Passcode on the entered mobile number. Enter the received OTP.
Umbraco 2FA - Enter OTP received on phone

  • Click on the Verify OTP button. After verifying the OTP, the method will be configured and can be enabled for the end user.
Umbraco 2FA - Verify OTP

  • To enable the method for the end user, click on the OTP over SMS toggle button.
Umbraco 2FA - OTP over SMS configured and active

  • Enable the 2FA for End Users toggle button.
Umbraco 2FA - Enable 2FA for End Users

  • To enable 2FA for admins, turn on the Admin Only toggle.
Umbraco 2FA - Admin Only toggle
  • Log in to your Umbraco application.
Umbraco 2FA - Umbraco login page

  • After login, end users see the Setup 2FA screen. Click Setup beside OTP Over SMS.
Umbraco 2FA - Setup 2FA methods

  • Enter your phone number in the popup and click Send OTP.
Umbraco 2FA - SMS Authenticator Registration

  • Enter the OTP sent to your phone number and click Verify OTP.
Umbraco 2FA - Verify end user OTP

Note: These configuration steps are a one-time setup for configuring the TFA method for the user. The next time the user logs in, they will only see the Validate OTP screen (the last step below) to complete authentication.


  • On the next login, enter the OTP and click Validate OTP.
Umbraco 2FA - Validate OTP on login

  • The user will be logged in to their Umbraco application.

Related Articles


 Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again

We'll Reach Out to You at the Earliest!


ADFS_sso ×
Hello there!

Need Help? We are right here!

support