3.2 Interaction with Security Token Service (STS)

  • Article

This section describes the third phase in MDE device enrollment: requesting and receiving the security token. The following diagram highlights this phase.

MDE device enrollment: requesting and receiving the security token

Figure 6: MDE device enrollment: requesting and receiving the security token

After the enrollment client receives the DiscoverResponse message (section 3.1.4.1.1.2), the client obtains a security token from the STS specified in the value for the <DiscoveryResponse><AuthenticationServiceUrl> element (section 3.1.4.1.3.2).

Note The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the STS might prompt for user credentials directly or enter into a federation protocol with an STS and directory service, MDE is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented.

The following are the explicit requirements for the STS:

The <DiscoveryResponse><AuthenticationServiceUrl> element (section 3.1.4.1.3.2) MUST support HTTPS.

The enrollment client issues an HTTPS request as follows:

 AuthenticationServiceUrl?appru=<appid>&login_hint=<User Principal Name>

<appid> is of the form ms-app://string

<User Principal Name> is the name of the enrolling user, for example, user@constoso.com. The value of this attribute serves as a hint that can be used by the STS as part of the authentication.

After authentication is complete, the STS SHOULD return an HTML form document with a POST method action of appid identified in the query string parameter. For example:

 HTTP/1.1 200 OK 
 Content-Type: text/html; charset=UTF-8
 Vary: Accept-Encoding
 Content-Length: 556
  
 <!DOCTYPE>
 <html>
    <head>
       <title>Working...</title>
       <script>
          function formSubmit() {
             document.forms[0].submit();
          }
            window.onload=formSubmit;
       </script>
    </head>
    <body>
       <form method="post" action="ms-app://windows.immersivecontrolpanel">
          <p><input type="hidden" name="wresult" value="token value"/></p>
          <input type="submit"/>
       </form>
    </body>
 </html>

The STS has to send a POST to a redirect URL of the form ms-app://string (the URL scheme is ms-app) as indicated in the POST method action. The security token value is the base64-encoded string "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary" contained in the <wsse:BinarySecurityToken> EncodingType attribute (section 3.3).

Sequentially, the string is HTML encoded before it is base64 encoded, so that when it is unencoded from base64 it can be returned embedded in HTML.

This string is opaque to the enrollment client; the client does not interpret the string.