Windows Live ID SSO Luminis Integration

New Post: Luminis 4 Modifications

attheshow — Mon, 28 Sep 2009 16:07:04 GMT

I've made the modifications above, but when I direct my browser to our portal in the format http://x.x.x.x/jsp/email/emaildirect.jsp, I get an Access Denied page. Any ideas what I could be doing wrong?

New Post: Issue with Internet Explorer browsers and email button

rwakeman — Wed, 15 Jul 2009 20:06:24 GMT

I am out performing a workshop with a customer. During this time, I will have very little access to E-Mail. Please mark a message as important for a reply as quickly as possible.

For attention on Outlook Live issues, please contact Mitch Groeneveld at v-mitchg@microsoft.com.

For all other requests, please contact my manager Paul Cotter at pcotter@microsoft.com.

New Post: Issue with Internet Explorer browsers and email button

michaelhuw — Wed, 15 Jul 2009 20:03:13 GMT

Hi,

We've implemented the Luminis integration as per this kit on our TEST portal instance. The luminis email button works fine in Firefox and throws a new window with the desired result of providing SSO to Outlook Live, however in Internet Explorer we get the following error when clicking on the email button: "Access Denied. You do not have permission to access this service."

Any suggestions or help would be much appreciated as Luminis is not my area of expertise.

The kit is excellent btw - thanks to St Johns for sharing their work.

Cheers,

Huw

New Post: Need help troubleshooting Luminis Live SSO

ty72182 — Mon, 08 Jun 2009 16:55:57 GMT

That did the trick. Our SSO implementation is now working properly.

New Post: Need help troubleshooting Luminis Live SSO

rwakeman — Fri, 29 May 2009 19:09:43 GMT

This one is actually fairly common. There may even be another thread on this in codeplex. It has to do with the setup for RPS. The zip file that contained the SSO Toolkit had a special copy of RPSServer.xml that is in the root of the SSO Toolkit zip file. What you will need to do is uninstall RPS and reinstall using this special copy of the RPSServer.xml. For example, if you extract the SSO Toolkit to c:\SSO, you will type the full path when asked by the RPS setup of C:\SSO\RPSServer.xml. If you simply type RPSServer.xml, it will give you the wrong one, you need the full file path. The ONLY other setting during RPS installation you will change is for selecting the production environment.

New Post: Need help troubleshooting Luminis Live SSO

ty72182 — Fri, 29 May 2009 16:58:30 GMT

My problem was I didn't "merge" the two App_Code directories, instead I just replaced the one from the SSO toolkit with the one from codeplex. The original 404 error I had been getting was caused by improperly configured Web Service Extensions (the ASP .Net version I was using wasn't shown in the list of web service extensions in IIS, so it was prohibiting them even though it wasn't showing me the option to set it to Allowed).

Fixing the App_Code directory has led me to my latest issue (below). I did install the windows live ID server even though for our setup (hotmail) I'm not sure if it's needed. I set up the rpsserver.xml file according to the SSO documenation, but it doesn't give much guidance in editing it. Any thoughts?

Microsoft Live Single Sign-On cannot be completed at this time. Please return to the school portal to access your email.

Cannot find object or property. Internal error: CertFindCertificateInStore failed, the certificates in the config\certs directory must be installed to the local machine cert store with the private key :cs.rpssample.pp.test.microsoft.com.

New Post: Need help troubleshooting Luminis Live SSO

rwakeman — Fri, 29 May 2009 02:27:11 GMT

Ahhhhh, this is making more sense now. It looks like you may have an older copy of the SSO Toolkit. Where\When did you get your copy? The one that is up on connect.microsoft.com is v4.1 and this Luminis solution will work with any v4+. The SSO Toolkit v4+ has the LiveSLT.cs file in the App_Code directory. Can you verify?

New Post: Need help troubleshooting Luminis Live SSO

ty72182 — Thu, 28 May 2009 22:12:06 GMT

Bit of a different error now (an a much more meaningful one). I get this on the redirect.aspx page:

Description: An error occurred during the compilation of a resource required to service this request. Please review the following specific error details and modify your source code appropriately.

Compiler Error Message: CS0246: The type or namespace name 'LiveSLT' could not be found (are you missing a using directive or an assembly reference?)

Source Error:


Line 87:                     redirected = true;
Line 88: 
Line 89:                     LiveSLT ticket = new LiveSLT(certThumb, siteID, webProxy, loginSeconds);
Line 90:                     string slt = ticket.GetSLT(liveMail);
Line 91:

Source File: c:\Inetpub\wwwroot\SSOPortal\Public\Redirect.aspx.cs Line: 89

New Post: Need help troubleshooting Luminis Live SSO

ty72182 — Wed, 27 May 2009 16:08:04 GMT

I went back through and re-setup the directories (keeping the same Web.Config). I had previously done a "move" rather than a copy. I then explicitly gave both the "Internet Guest Account" and "ANONYMOUS LOGON" Read & Execute rights on everything at or below the SSO directory. I restarted IIS and that didn't seem to resolve the issue we are having. Is there anyway to verify the redirect in IIS by using the "Browse" function in the IIS manager? I'm wondering if there could be a problem on the Luminis server. If you have any other thoughts let me know (and thanks again for the help).

As a side question, should the Web.Config be in the Public Directory or in the SSOPortal Directory?

New Post: Need help troubleshooting Luminis Live SSO

rwakeman — Tue, 26 May 2009 21:49:10 GMT

This is correct. You shouldn't need to alter those files. The only non-standard setting from the SSO Toolkit to support this page is adding the connection string in the web.config, which should be updated as you point out. I wonder if you are experiencing a permissions issue. You need anonymous access turned on in IIS for the public virtual directory and the anonymous user account should have read permissions to the files in the file system. It's possible that if you extracted the files to some other location and then moved (as opposed to copy) the files, they do not inherit the file permissions properly. You can force inheritance or simply add the anonymous account with read permissions.

New Post: Need help troubleshooting Luminis Live SSO

ty72182 — Tue, 26 May 2009 20:46:58 GMT

We are infact using Hotmail for our mail system, we will be going to Outlook Live and sometime in the future, just not right now. On the Windows Server, the path to the redirect.aspx is C:\Inetpub\wwwroot\SSOPortal\Public\redirect.aspx. The redirect.aspx.cs resides in this directory as well. The redirect.aspx and redirect.aspx.cs have not been edited from the originals provided via CodePlex. Only the web.config file has been changed. Is that correct?

New Post: Need help troubleshooting Luminis Live SSO

rwakeman — Tue, 26 May 2009 20:35:09 GMT

I know it's confusing, but the redirect in the web.config is different than the Luminis redirect. I do notice you have mail.live.com for the web.config... are you using Hotmail? There were some additional files in the zip for the Windows Web Server that needed to be merged into the website. Can you validate that \public\Redirect.aspx actually exists in the file system?

New Post: Need help troubleshooting Luminis Live SSO

ty72182 — Tue, 26 May 2009 19:55:50 GMT

Thanks for the response.

Our problem isn't with the testdirect.jsp page, basically what is happening is after the user logs into the Luminis portal, and then uses the email link, a new window pops up with the following address:

http://%windows web server IP%/SSO/Public/Redirect.aspx?ID=%GUID%

From my understanding this is correct. However, that page resolves to a 404 - File or directory not found error, instead of going to Windows Live Mail.

When just doing a simple "Browse" from IIS on the redirect.aspx page, it also returns the same error (http://localhost/SSOPortal/Public/Redirect.aspx). I'm not sure if there's a paramenter in the web.config file on the Windows Server configured incorrectly, but when I check the configuration in ASP.NET, redirectURL is pointing to http://mail.live.com/default.aspx, which I can open from IE on the web server.

Hope this makes some sense.

New Post: Need help troubleshooting Luminis Live SSO

rwakeman — Tue, 26 May 2009 16:16:19 GMT

Are you referring to the testredirect.jsp page on the Luminis Server? The link is built using the variables at the top of the page that you must provide values for. The actual link target is built using the value for redirectUrl, which should point to the URL for your Windows Web Server.

Also, Microsoft will not support this custom solution unless it is a configuration of the Windows Web Server that has been unaltered.

New Post: Support for multiple email domains

ty72182 — Tue, 26 May 2009 15:20:59 GMT

Thanks!

New Post: Scaling the Database

ty72182 — Tue, 26 May 2009 15:19:17 GMT

Thanks!

New Post: Need help troubleshooting Luminis Live SSO

ty72182 — Tue, 26 May 2009 15:16:25 GMT

I am actually having the same issue with out implementation. I have opened a ticket with microsoft as well. If anyone has any ideas, please let me know. I've ran through the entire setup multiple times, every time with the same result. I see all the values from the web.config files showing up properly in the .Net configuration. I've also tried both the 4.0 and 4.1 versions of SSO from Microsoft, without a change.

Thanks for any help or guidance anyone can provide.

New Post: Support for multiple email domains

rwakeman — Fri, 22 May 2009 00:11:19 GMT

You can have Microsoft assign multiple domains to a single certificate and site ID. However, you will need to fully-qualify the email address instead of having the SSO Toolkit calculate it for you. The domain suffix that is in the web.config is simply for calculating the email address from a user ID.

New Post: Support for multiple email domains

ty72182 — Thu, 21 May 2009 15:34:54 GMT

Good afternoon,

My question is in regards to supporting multiple email domains from Microsoft live email services. Our school has several "brands" so we need to support the email domains my.school1.edu; my.school2.edu and my.school3.edu. In the web_config file, it only specifies one domain. My question is can it support more than one?

Thanks for everyones time and consideration.

New Post: PowerCAMPUS SelfService

rwakeman — Tue, 19 May 2009 18:09:44 GMT

Make sure you have an SRZ support incident prefix to ensure you are in the proper support queue for SSO.