Animadoria at 11:02, 13 May 2022

2022-05-13T11:02:36Z

← Older revision		Revision as of 11:02, 13 May 2022
Line 1:		Line 1:
	{{Protocols/MSNP/MSNP13 ~~Navigation~~}}		{{Protocols/MSNP\|
			section=MSNP13}}

AD: 1 revision imported

2020-05-29T00:23:42Z

1 revision imported

← Older revision		Revision as of 00:23, 29 May 2020
(No difference)

AD at 21:18, 7 July 2008

2008-07-07T21:18:10Z

New page

{{Protocols/MSNP/MSNP13 Navigation}}

= Passport 3.0 =
Since 1 April 2006, Microsoft has begun removing the old way of authenticating, called 'Passport 1.4', and has replaced it with 'Passport 3.0'. Every client that still uses Passport 1.4 will eventually receive ''401 Unauthorized'' responses, whether using SSL or not, with an 'Account locked out' message.

The new way of authenticating uses SOAP.

Unlike Passport 1.4, only SSL works successfully. Otherwise you will receive an error (S:ClientInvalid Request).

= SOAP Request =
The target URL for the SOAP request is '''<nowiki>https://loginnet.passport.com/RST.srf</nowiki>'''. The server does not discriminate on User Agent.

You will need the tweener ticket from the USR TWN S command received from the NS. URL decode the ticket, then replace the commas (,) with ampersands (&). You must then XML encode (HTML encode) the username, password and ticket.

Below is an example of the SOAP request sent to the server by the official client.

POST /RST.srf HTTP/1.1\r\n
Accept: text/*\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n
Host: loginnet.passport.com\r\n
Content-Length: 3098\r\n
Connection: Keep-Alive\r\n
Cache-Control: no-cache\r\n
\r\n
<?xml version="1.0" encoding="UTF-8"?>
<Envelope xmlns="<nowiki>http://schemas.xmlsoap.org/soap/envelope/</nowiki>" xmlns:wsse="<nowiki>http://schemas.xmlsoap.org/ws/2003/06/secext</nowiki>" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:wsp="<nowiki>http://schemas.xmlsoap.org/ws/2002/12/policy</nowiki>" xmlns:wsu="<nowiki>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd</nowiki>" xmlns:wsa="<nowiki>http://schemas.xmlsoap.org/ws/2004/03/addressing</nowiki>" xmlns:wssc="<nowiki>http://schemas.xmlsoap.org/ws/2004/04/sc</nowiki>" xmlns:wst="<nowiki>http://schemas.xmlsoap.org/ws/2004/04/trust</nowiki>">
<Header>
<ps:AuthInfo xmlns:ps="<nowiki>http://schemas.microsoft.com/Passport/SoapServices/PPCRL</nowiki>" Id="PPAuthInfo">
<ps:HostingApp>{7108E71A-9926-4FCB-BCC9-9A9D3F32E423}</ps:HostingApp>
<ps:BinaryVersion>4</ps:BinaryVersion>
<ps:UIVersion>1</ps:UIVersion>
<ps:Cookies></ps:Cookies>
<ps:RequestParams>AQAAAAIAAABsYwQAAAAzMDg0</ps:RequestParams>
</ps:AuthInfo>
<wsse:Security>
<wsse:UsernameToken Id="user">
<wsse:Username>'''alice@passport.com'''</wsse:Username>
<wsse:Password>'''password'''</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</Header>
<Body>
<ps:RequestMultipleSecurityTokens xmlns:ps="<nowiki>http://schemas.microsoft.com/Passport/SoapServices/PPCRL</nowiki>" Id="RSTS">
<wst:RequestSecurityToken Id="RST0">
<wst:RequestType><nowiki>http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue</nowiki></wst:RequestType>
<wsp:AppliesTo>
<wsa:EndpointReference>
<wsa:Address><nowiki>http://Passport.NET/tb</nowiki></wsa:Address>
</wsa:EndpointReference>
</wsp:AppliesTo>
</wst:RequestSecurityToken>
<wst:RequestSecurityToken Id="RST1">
<wst:RequestType><nowiki>http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue</nowiki></wst:RequestType>
<wsp:AppliesTo>
<wsa:EndpointReference>
<wsa:Address>messenger.msn.com</wsa:Address>
</wsa:EndpointReference>
</wsp:AppliesTo>
<wsse:PolicyReference URI="?'''<nowiki>lc=1033&amp;id=507&amp;tw=40&amp;fs=1&amp;ru=http://messenger.msn.com&amp;ct=1144076956&amp;kpp=1&amp;kv=7&amp;ver=2.1.6000.1&amp;rn=NgNNrtGr&amp;tpf=de8dd66124cd310ab344aa850bc5aa9b</nowiki>'''"></wsse:PolicyReference>
</wst:RequestSecurityToken>
</ps:RequestMultipleSecurityTokens>
</Body>
</Envelope>

= SOAP Response =
== Redirect ==
Just as with Passport 1.4, you may get redirected to a new server. Simply connect to the new server (indicated in bold below) and re-submit your SOAP request (above).

HTTP/1.1 200 OK\r\n
Connection: close\r\n
Date: Mon, 03 Apr 2006 15:09:17 GMT\r\n
Server: Microsoft-IIS/6.0\r\n
PPServer: PPV: 30 H: BAYPPLOGN3B12 V: 0\r\n
Content-Type: text/html; charset=iso-8859-1\r\n
Expires: Mon, 03 Apr 2006 15:08:17 GMT\r\n
Cache-Control: no-cache\r\n
Pragma: no-cache\r\n
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"\r\n
Content-Length: ''xxx''\r\n
\r\n
<?xml version='1.0' encoding='UTF-8'?>
<S:Envelope xmlns:S='<nowiki>http://schemas.xmlsoap.org/soap/envelope/</nowiki>' xmlns:wsse='<nowiki>http://schemas.xmlsoap.org/ws/2002/04/secext</nowiki>' xmlns:psf='<nowiki>http://schemas.microsoft.com/Passport/SoapServices/SOAPFault</nowiki>'>
<S:Header>
<psf:pp xmlns:psf="<nowiki>http://schemas.microsoft.com/Passport/SoapServices/SOAPFault</nowiki>">
<psf:serverVersion>1</psf:serverVersion>
<psf:authstate>0x80048800</psf:authstate>
<psf:reqstatus>0x80048852</psf:reqstatus>
<psf:serverInfo Path="Live1" RollingUpgradeState="Unknown" LocVersion="0" ServerTime="2006-07-20T06:06:59Z">TK2PPMLOG3B05 2006.05.16.18.44.49</psf:serverInfo>
<psf:cookies/>
<psf:response/>
</psf:pp>
</S:Header>
<S:Fault>
<faultcode>psf:Redirect</faultcode>
<psf:redirectUrl>'''<nowiki>https://login.live.com/pp400/RST.srf</nowiki>'''</psf:redirectUrl>
<faultstring>Authentication Failure</faultstring>
</S:Fault>
</S:Envelope>

== Success ==
If all went well, you will receive the following reply from the server. If the username or password were incorrect, you will receive a SOAP:Fault reply for each sub-request ("RequestSecurityToken") that failed.

'''Remember to XML decode (HTML decode) the token received (in bold below)!'''

HTTP/1.1 200 OK\r\n
Connection: close\r\n
Date: Mon, 03 Apr 2006 15:09:17 GMT\r\n
Server: Microsoft-IIS/6.0\r\n
PPServer: PPV: 30 H: BAYPPLOGN3B12 V: 0\r\n
Content-Type: text/html; charset=iso-8859-1\r\n
Expires: Mon, 03 Apr 2006 15:08:17 GMT\r\n
Cache-Control: no-cache\r\n
Pragma: no-cache\r\n
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"\r\n
Content-Length: 6495\r\n
\r\n
<?xml version="1.0" encoding="utf-8" ?>
<S:Envelope xmlns:S="<nowiki>http://schemas.xmlsoap.org/soap/envelope/</nowiki>">
<S:Header>
<psf:pp xmlns:psf="<nowiki>http://schemas.microsoft.com/Passport/SoapServices/SOAPFault</nowiki>">
<psf:serverVersion>1</psf:serverVersion>
<psf:PUID> ''See '''[[Protocols/MSNP/Passport Unique ID]]''' for more info'' </psf:PUID>
<psf:configVersion>3.0.869.0</psf:configVersion>
<psf:uiVersion>3.0.869.0</psf:uiVersion>
<psf:authstate>0x48803</psf:authstate>
<psf:reqstatus>0x0</psf:reqstatus>
<psf:serverInfo Path="Live1" RollingUpgradeState="ExclusiveNew" LocVersion="0" ServerTime="2006-04-03T15:09:17Z">BAYPPLOGN3B12 2006.01.27.13.57.29</psf:serverInfo>
<psf:cookies/>
<psf:response/>
</psf:pp>
</S:Header>
<S:Body>
<wst:RequestSecurityTokenResponseCollection xmlns:S="<nowiki>http://schemas.xmlsoap.org/soap/envelope/</nowiki>" xmlns:wst="<nowiki>http://schemas.xmlsoap.org/ws/2004/04/trust</nowiki>" xmlns:wsse="<nowiki>http://schemas.xmlsoap.org/ws/2003/06/secext</nowiki>" xmlns:wsu="<nowiki>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd</nowiki>" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:wsp="<nowiki>http://schemas.xmlsoap.org/ws/2002/12/policy</nowiki>" xmlns:psf="<nowiki>http://schemas.microsoft.com/Passport/SoapServices/SOAPFault</nowiki>">
<wst:RequestSecurityTokenResponse>
<wst:TokenType>urn:passport:legacy</wst:TokenType>
<wsp:AppliesTo xmlns:wsa="<nowiki>http://schemas.xmlsoap.org/ws/2004/03/addressing</nowiki>">
<wsa:EndpointReference>
<wsa:Address><nowiki>http://Passport.NET/tb</nowiki></wsa:Address>
</wsa:EndpointReference>
</wsp:AppliesTo>
<wst:LifeTime>
<wsu:Created>2006-04-03T15:09:17Z</wsu:Created>
<wsu:Expires>2006-04-04T15:09:17Z</wsu:Expires>
</wst:LifeTime>
<wst:RequestedSecurityToken>
<EncryptedData xmlns="<nowiki>http://www.w3.org/2001/04/xmlenc#</nowiki>" Id="BinaryDAToken0" Type="<nowiki>http://www.w3.org/2001/04/xmlenc#Element</nowiki>">
<EncryptionMethod algorithm="<nowiki>http://www.w3.org/2001/04/xmlenc#tripledes-cbc</nowiki>"></EncryptionMethod>
<ds:KeyInfo xmlns:ds="<nowiki>http://www.w3.org/2000/09/xmldsig#</nowiki>">
<ds:KeyName><nowiki>http://Passport.NET/STS</nowiki></ds:KeyName>
</ds:KeyInfo>
<CipherData>
<CipherValue>AfiQDIvIPHyZ/aJmpm/hoaJCzRMYbhNZT1VZDvuoYuXpWLBVCa+dHstPX7/3qaq0YbAzROTU6mi0ovQ6BYOVD8tgwb3yzfdm6OMd77RWKpZMMc3sLKEbxzutc6tpG7euj0Y5nlIyCRUFJATcqpvOOFS3EYchcOe7UG5si/w+4CUnPk+YG/X2+lJt6yEaD7+oxu7vCueResAJoqwi2fOu/3hSh0k9Meqd4QYmaijkLZT3jy+GQu/8Jku6f+o0DiKoQzg0JYfaKV7ROfznRXWxUoUiigv7EiAcgG+Ri9kaB0E54QecOuh23mCoiowVdDexh19Ep24Am1KexozOXuLdwEsO5S3IHSdC0xZzFl3Fa4XKRFeEfeYJ6OFvTu9FoiLq+c9XX7OmroVbaOWE1Bi4C8es2bObPjkxg5JEl2M6vFlWEJUbTQ==</CipherValue>
</CipherData>
</EncryptedData>
</wst:RequestedSecurityToken>
<wst:RequestedTokenReference>
<wsse:KeyIdentifier ValueType="urn:passport"></wsse:KeyIdentifier>
<wsse:Reference URI="#BinaryDAToken0"></wsse:Reference>
</wst:RequestedTokenReference>
<wst:RequestedProofToken>
<wst:BinarySecret>UDmOO8Ep5vU+vQUjcziMW6fI43rIeKLD</wst:BinarySecret>
</wst:RequestedProofToken>
</wst:RequestSecurityTokenResponse>
<wst:RequestSecurityTokenResponse>
<wst:TokenType>urn:passport:legacy</wst:TokenType>
<wsp:AppliesTo xmlns:wsa="<nowiki>http://schemas.xmlsoap.org/ws/2004/03/addressing</nowiki>">
<wsa:EndpointReference>
<wsa:Address>messenger.msn.com</wsa:Address>
</wsa:EndpointReference>
</wsp:AppliesTo>
<wst:LifeTime>
<wsu:Created>2006-04-03T15:09:17Z</wsu:Created>
<wsu:Expires>2006-04-03T15:17:37Z</wsu:Expires>
</wst:LifeTime>
<wst:RequestedSecurityToken>
<wsse:BinarySecurityToken Id="PPToken1">'''t=7rl6lZ8V0AwqPJX7V0sI7UTeVeSI2IsNyUs54yhGxkw75Wk3FKmZPRlt5HRk5zTutPTRdA4Z0HZlSEzrNDATrJkbticILv0GB7UV1hs18Lv3!htfM2GRQhudbsLMYI2Tylbfp!3WDZYNo$&amp;p=7p*vh1jxRHI5149VnAwA9pzqQhV4NspMqdEpizzDolZdz6lDrkjisFoc4tKXlmxb5dIe7JKgr5Qmr8ULvHcU0bX6XUbcVQ4ra1dkLzpNltx47fkxjHLMJJiCFq*uOn9ijQLDNtw752hZvd0duHXMygF3y9rKDMhr27*WSs!10nbysjJ7gn70SyRWibFc1rnQlRHyCdf6ZTBhw$'''</wsse:BinarySecurityToken>
</wst:RequestedSecurityToken>
<wst:RequestedTokenReference>
<wsse:KeyIdentifier ValueType="urn:passport"></wsse:KeyIdentifier>
<wsse:Reference URI="#PPToken1"></wsse:Reference>
</wst:RequestedTokenReference>
</wst:RequestSecurityTokenResponse>
</wst:RequestSecurityTokenResponseCollection>
</S:Body>
</S:Envelope>

= Example code =
The following code has been written in pseudo code, and can be freely translated to any language, such as PHP, Perl, C, C#, etc.

var url = "<nowiki>https://loginnet.passport.com/RST.srf</nowiki>";

var ticket = url_decode("lc=1033,id=507,tw=40,fs=1,ru=http%3A%2F%2Fmessenger%2Emsn%2Ecom,ct=1144678795,kpp=1,kv=7,ver=2.1.6000.1,rn=henwjH6T,tpf=9fae2e057425cab598a766a38ccd447a");
ticket = string_replace(ticket, ",", "&");

var body = "<?xml ..... " +
// Snip!
"<wsse:Username>" + html_encode(user) + "</wsse:Username>" +
"<wsse:Password>" + html_encode(password) + "</wsse:Password>" +
// Snip!
"<wsse:PolicyReference URI=\"?" + html_encode(ticket) + "\"></wsse:PolicyReference>" +
// Snip!
"</Envelope>";

var request = new HTTPRequest(url);
request->body = body;

var response = request->get_response();

if response->succeeded then
begin
var twnticket = response->body;
twnticket = twnticket->getbetween("<wsse:BinarySecurityToken Id="PPToken1">", "</wsse:BinarySecurityToken>");

return html_decode(twnticket);
end
else
throw new Exception("Could not fetch ticket");

= Implementations =
Example implementations of this method are available:

* C#: [http://siebe.bot2k3.net/docs/files/PP30_SecurityToken.cs PP30_SecurityToken.cs] (By [[User:Darkener Daemon EX|Eon (formerly Darkener Daemon EX)]])
* Java: [http://yourpaste.net/910/AuthTWN.java AuthTWN.java] (By Tom van der Woerdt)
* Perl: [http://siebe.bot2k3.net/docs/files/AuthPP3.pm AuthPP3.pm] (By [[User:Inky|Siebe "Inky" Tolsma]])
* PHP: [http://homepage.ntlworld.com/albrecht/tweener.class.txt tweener.class.php] (By [[User:Mpmc|Mark "MPMC"]]) - [[Protocols/MSNP/MSNP13/SOAPTweener/tweener.class|Info]]
* PHP: [http://www.toutmessenger.info/wlm_pp3_class.php.txt wlm_pp3_class.php] (By [[User:Exyr1090|Nowan190]] for [http://www.toutmessenger.info/ ToutMessenger])
* Python: [http://www.thomasdimson.com/web_files/TweenerAuthentication/TweenerAuthentication.txt TweenerAuthetication.py] (By [[User:Turtlesoup|Thomas "Turtlesoup" Dimson]])
* VB .NET: [http://files.konphuzion.net/code/PP3.vb.txt PP3.vb] (By [[User:Jay|Jay]])

[[Category:MSN]]
[[Category:Protocols/MSNP]]
[[Category:Work_In_Progress]]

Protocols/MSNP/MSNP13/SOAPTweener - Revision history

Animadoria at 11:02, 13 May 2022

AD: 1 revision imported

AD at 21:18, 7 July 2008