Microsoft Office 2007 Ultimate Windows Live ID SSO

[kegen87247]

Windows Live SSO from Java! News February 24th 2011
Issues with SSO displaying the wrong Mailbox after the Dual ID switch (described here:
After generating this change, they found out that on occasion a user is linked to a second user’s mailbox. The lead to is with LiveID which sometimes strips URL params in addition to the alternative should be to consist of exsvurl=1 like a parameter. Add this URL parameter to your house au.com.identityconcepts.windowslive.loginURLExchan geLabs within the WindowsLiveSSO.properties file and all ought to be resolved.
The residence will now appear like this
au.com.identityconcepts.windowslive.loginURLExchan geLabs=https://login.live.com/ppsecure/post.srf?wa=wsignin1.0&rpsnv=10&ct=1217534617&rver =5.5.4177.0&wp=MBI_SSL&wreply=https:%2F%2Fexchange labs.com%2Fowa%2F&lc=1033&exsvurl=1
July 13th 2010
Java 6 and problems with SSL renegotiation
Thanks to a Brasillian person for this advice.
Microsoft's web service require TLS renegotiation and this feature is disabled in Java 6 by default. Sun's position this behavior will be to avoid "Man while in the Middle" attacks and TLS renegotiation makes the software vulnerable to this kind of attack.
It is possible to allow TLS renegotiation on Java 6 by setting the system home sun.security.ssl.allowUnsafeRenegotiation to true before creating the session and calling GetSLT ( or like a residence on the JVM call ).
In code:
System.setProperty("sun.security.ssl.allowUnsafeRe negotiation", "true");
this.session = new Session();
this.shortLivedToken = Marshall.GetSLT(session,Office 2010 Standard,userName,loginSeconds);
Via JAVA_OPTS:
-Dsun.security.ssl.allowUnsafeRenegotiation=true
September 4th 2009
- Use your PFX file,Windows 7 64bit!
- Use SVN HEAD!
Background
- Windows Stay uses a set of SOAP based Passport Web Services to obtain a short lived token (SLT) using a method known as GetSLT. GetSLT is secured using Client Certificate's and requires the TLS connection undergoes mutual authentication
- In order to make a TLS connection, Java must have access to a private key and a set of certificates from trusted Root and Intermediate CAs. Java requires the private key is located with the native format keystore known as Java Key Store (JKS). Both the keystore and private key must have the same password and all intermediate certificates must be present.
- We also require a truststore (usually cacerts in Java) which contains all required Root and Intermediate CA's. Java 6 doesn't have the necessary entries so we need to build a new truststore.
- Apache CXF is used to build a Java Proxy Client from the Passport WSDL (slightly modified)
Prerequisites
Truststore
- Use the supplied cacerts-win32.jks
Prerequisites
Keystore
- Use the PFX file supplied by the Partner Center
- Import to IE – double click in Windows Explorer – make sure you stipulate the private key is exportable and to use extended properties
- Export from IE. Check the option to incorporate all intermediate certificates and extended properties and save with a password
- Update the WindowsLiveSSO.properties file with the path and password for the new PFX file
Windows Live SSO
- Java 1.5
- CXF 2.1.1 (and dependencies)
- PassportUtil.jar
- WindowsLiveHelper.jar
- Your code,Office 2010 Sale!
Optional
- WindowsLive SSO for J2EE. Secure the JSP and pass through the username from the HTTP header and get a URL which can be used for SSO
Tasks
Create a Truststore (trusted Root and intermediate CAs) (optional)
- Generate a new trust store using CertificateConvert.exe. Modify the App.Config to reflect where you would like your working/output directory to be and where your Java keytool.exe is located. Password for the resulting trust store is changeit.
Create a Windows Reside SSO application
- Modify the client.properties file with your site specific information
---snip---
au.com.identityconcepts.windowslive.siteID=253988
au.com.identityconcepts.windowslive.domain=WLEduTr aining.com
au.com.identityconcepts.windowslive.domainAdmin=ad ministrator@WLEduTraining.com
au.com.identityconcepts.windowslive.keyStore=c:/customer.pfx
au.com.identityconcepts.windowslive.keyStorePasswo rd=changeit
au.com.identityconcepts.windowslive.trustStore=c:/cacerts-win32.jks
au.com.identityconcepts.windowslive.trustStorePass word=changeit
au.com.identityconcepts.windowslive.debug=false
au.com.identityconcepts.windowslive.verbose=false
au.com.identityconcepts.windowslive.sslDebug=false
au.com.identityconcepts.windowslive.WSDLPath=c:/PPSACredentialWSDL.srf.wsdl
au.com.identityconcepts.windowslive.loginURLLive=h ttps://login.live.com/ppsecure/post.srf
au.com.identityconcepts.windowslive.loginURLExchan geLabs=https://login.live.com/ppsecure/post.srf?wa=wsignin1.0&rpsnv=10&ct=1217534617&rver =5.5.4177.0&wp=MBI_SSL&wreply=https:%2F%2Fexchange labs.com%2Fowa%2F&lc=1033
---snip---
Create an application (JSP/Servlet/etc) and call the GetSLT method
WindowsLive SSO for J2EE
- Set the system environment variable WLIDConfigFilePath to the full path of the file which holds the configuration information for your Domain "WLIDConfigFilePath=c:/WLIDSSO.config"
(it defaults to c:\WindowsLiveSSO.properties)
- Unpack the installation zip file to a directory. There need to be 3 files,Windows 7 Professional, WindowsLiveSSO.war,Microsoft Office 2007 Ultimate, an example configuration file WindowsLiveSSO.properties in addition to the Passport WSDL PPSACredentialWSDL.srf.wsdl
and an example Java trust store cacert-win32.jks
- Edit the configuration file and encompass your site specific information
- Deploy the WAR file for the Tomcat server
- Submit a request for the Servlet with a header variable "username" with the LiveID of the consumer, "service" with the servicename (either "livemail" or "exchangelabs"). Additional headers can include "redirect" (set to true or false) and "debug" (also set to true or false).
Troubleshooting
- Ensure you've validated against the official SSO Toolkit first!
- Confirm you're using a PFX file with a Certificate
- Turn on debugging from the Properties file (debug, verbose and ssl)
- Ensure you're using the cacerts-win32.pks file from SVN HEAD
- Turn on CXF debugging by modifying the cxf.xml file (more details to come!)
<!-- Uncomment this block for CXF debugging -->
<cxf:bus>
<cxf:features>
<cxf:logging/>
</cxf:features>
</cxf:bus>