Deployment from VS with Custom Forms Based Security with 2FA/MFA

Question

Deployment from VS with Custom Forms Based Security with 2FA/MFA

Justin Jondle 1

I have built a custom security extension for SSRS 2017 that accepts username, password, and a TOTP for 2FA that passes that onto a REST API to validate the information. The extension is working beautifully.

Now I'm trying to figure out the best way to have my BI/Report developers publish reports. Currently I have given them access to disable 2FA on their account, deploy inside of Visual Studio as normal with the forms credentials, and then enable 2FA again. It is working, but it has security issues I don't like and was trying to come up with a more elegant way.

Really, I think I just need help with authenticating programmatically. From there I have a lot of options. I'm leaning towards a VS Extension, but I can't quite seem to get the authentication piece. I see the SOAP API has a LogonUser() method, but it only supports username, password, and domain fields and not custom fields. I don't see any authentication endpoints in the REST API, so I guess it only works from an already authenticated browser.?.? As I'm typing this, I'm wondering if a .NET Core HttpClient could be used to mimic an interactive logon and share cookies between requests to use the REST API.?.?

Does anyone have any ideas on how to programmatically authenticate or any other clever solutions?

Thanks,
Justin

0 comments

1 answer

Your answer

Answer 1

Joyzhao-MSFT 15,651

Hi @Anonymous ,
To be honest , it is out of my capabilities, I'm sorry I cannot offer very insightful suggestion on this case. Thanks for your understanding.
Best Regards,
Joy

If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Justin Jondle 1 Reputation point

2021-02-24T03:36:29.153+00:00

For some reason I'm unable to "write an answer" on this with a code sample.

I think I figured out a successful way to go about this. It is by no means complete, but I validated from a custom Visual Studio extension I was able to authenticate and pull down a report object from the REST API. I assume I'll be able to parse the rptproj files and update the reports now, but I'm not 100% certain yet. Either way, this was a huge step in that direction.

I was able to authenticate using this technique: https://stackoverflow.com/questions/32860666/httpclient-scrape-data-from-website-with-login-c-sharp

I used Fiddler to review the logon and found the POST included __VIEWSTATE, __VIEWSTATEGENERATOR, and __EVENTVALIDATION as well. I then loaded the homepage response into an XmlDocument and use XPATH to get those values from the response of the homepage to pass into the logon post. From that, the REST queries worked fine.
Joyzhao-MSFT 15,651 Reputation points

2021-02-24T07:00:59.297+00:00

Thank you for sharing, I believe your sharing will help more people with the same confusion.

Share via

Deployment from VS with Custom Forms Based Security with 2FA/MFA

1 answer

Your answer