The microsoft passport network

NET Passport single sign-in. Note that to use many. NET Passport features and to access core profiles of users, a participating site must be registered. Registration entails providing URLs for your site, contact information, privacy policy, and so on. This also means that Microsoft will periodically audit your site for compliance. The resulting bit value is the PUID that participating sites should use to index databases and uniquely identify users within their site.

Secure sign-in A feature of version 2. NET Passport single sign-in and profile service. It expands standard sign-in and employs additional functionality to significantly reduce the possibility for hackers to log in to the account of the Passport user using replay and dictionary attacks. There are two levels of secure sign-in, Secure Channel and Security Key. Sign-in The process of signing in to. NET Passport, submitting a sign-in name and password when accessing the login server pages using a browser.

Single sign-in SSI A process that identifies users. In the. NET Passport network, single sign-in involves obtaining and verifying credential information for a user with a. NET Passport sign-in name and a password to gain access to protected services.

The term standard sign-in denotes nonsecure sign-in. Ticket Ticket cookie A cookie used by. NET Passport for secure single sign-in and profile sharing. A ticket contains time stamps that participating sites and the Passport Manager object can use to determine how to admit a user to the site by silent or manual sign-in.

The actual name of this cookie is "MSPAuth". After a user is signed in to a participating site, there are in effect two ticket cookies, one written by the participating site's domain and one written by the domain authority. TimeWindow A period of time, in seconds, during which a user's most recent authentication must have occurred at the login server.

TimeWindows help minimize the possibility of replay attack. Depending on the options, the user must either have silently or manually refreshed credentials after the TimeWindow. Sites that implement secure authentication for their Passport users will be required to make the following changes:. The primary COM object for most sites using.

NET Passport is Passport. Manager, a server-side object for. These are also the most frequently used functions for standard sign-ins. This function returns true if the user has been authenticated and his TimeWindow has not expired. If you set the ForceLogin parameter to True, then the user has to log back into the page for every access, even if their TimeWindow hasn't expired.

This method uses parameters similar to the other calls listed here see Figure 1. The primary purpose of this function is to deal with Passport-aware applications, such as Microsoft Internet Explorer 6. LoginUser takes the user directly to a Passport login screen. The user is logged in either by outputting a redirect URL or by initiating a. Its format is:. NET Passport link. In addition to the descriptions in Figure 1 , two parameters are particularly relevant to this discussion and deserve more explanation.

ReturnURL is an optional parameter that sets the URL to the place where the login server should redirect after sign-in is complete. You should call Server. If you add your own query string variables to returnURL, you should use only one query string variable; avoid special characters that require separate encoding and don't use the reserved. NET Passport variable names t, p, and f.

If you're going to a port other than port 80, you must specify the port in the URL; the URL must point to a named file not just a root. SecureLevel declares one of three security level options for the. NET Passport sign-in. These values are shown in Figure 2. People also read Active Directory Policies. Active Directory Policies. Active Directory Objects.

How to locate Active Directory Objects March 2, Recent Posts. Active Directory Sites February 4, Active Directory Fundamentals Recent Posts. Active Directory Policies Editor's Pick.

Top Read Articles. Group Policy Backup February 4, E-books Webcasts. Was this reply helpful? Yes No. Sorry this didn't help. Thanks for your feedback. Karen Stavert. Can someone give me a step by step on how to clean this mess up and connect these computers - most especially - the external drives I will greatly appreciate your help thanks Karen. This thread is locked. Microsoft Passport operates a lot likes smart cards do and is, in effect, a virtual smart card.

There is a challenge sent to the smart card that only the private key can respond to properly. The Microsoft Passport credential works in a similar manner. Microsoft Passport requires a TPM v2 for hardware assurance. The keys are encrypted and protected by the TPM. With Microsoft Passport in an on-premises Active Directory environment. My understanding is that the public key in use is identified during the initial communication with the DC. Regardless, it needs to work within the Kerberos protocol and be very fast.

But does that even matter? Hopefully Microsoft enables the ability to enforce Microsoft Passport authentication by user group.