Identify WS-Trust Authentication

[skmanja]

Can someone please let me know if i am using WS-TRUST authentication that is going to deprecate? and how to identify?

POST https://login.microsoftonline.com/RST2.srf HTTP/1.1

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action>
<a:MessageID>urn:uuid:8cafd7fb-604e-482b-a0f4-200fdba91ce4</a:MessageID>
<a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo>
<a:To s:mustUnderstand="1">https://login.microsoftonline.com/RST2.srf</a:To>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="_0">
<u:Created>2020-08-10T12:16:20Z</u:Created>
<u:Expires>2020-08-10T12:21:20Z</u:Expires>
</u:Timestamp>
<o:UsernameToken u:Id="user">
<o:Username>**************************</o:Username>
<o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">***...>
</o:UsernameToken>
</o:Security>
</s:Header>
<s:Body>
<t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
<wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<a:EndpointReference>
<a:Address>urn:crmind:dynamics.com</a:Address>
</a:EndpointReference>
</wsp:AppliesTo>
<t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
</t:RequestSecurityToken>
</s:Body>
</s:Envelope>

[DavidJennaway]

Yes, this code is using WS-Trust - for example this line is part of WS-Trust:

<t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">

Also any references to http://docs.oasis-open.org/wss indicate it's using WS-Trust

[skmanja]

Thanks @DavidJennaway

This is going to deprecate next year. 
Is there any other way to get the <EncryptedData..<EncryptedKey>...</EncryptedKey>...<CipherData>...</CipherData>..</EncryptedData> ? That we should use to POST <Execute.. request on SOAP URI?

or How we can use Bearer token with soap body?

[DavidJennaway]

When WS-Trust is deprecated, the whole structure of the message will need to change - the server won't accept the <EncryptedData..<EncryptedKey>...</EncryptedKey>...<CipherData>...</CipherData>..</EncryptedData> elements.

How is your code structured ? If you are using the .Net SDK assemblies and the OrganizationServiceProxy class or CrmServiceClient with AuthType=Office365, then you should be able to change your code as per https://docs.microsoft.com/en-us/powerapps/developer/common-data-service/authenticate-office365-depr...

If you are constructing the SOAP request in some other way, then I don't think you can continue to use that approach, but should instead change the code to use the Web API

[mrstrong]

Hi,

Similar to the above, I have read: https://docs.microsoft.com/en-us/powerapps/developer/data-platform/authenticate-office365-deprecatio...

And believed that my code was not affected, HOWEVER I have just come across this post.

Similar to the original poster above, we have a custom app that we built using .Net standard 2.0 - it was a mobile app that we used to connect to SharePoint. At the time the CSOM libraries were not compatible (not sure if they are now) so we wrote our own auth library.

This involved writing code that:

1) Made a POST request to: https://login.microsoftonline.com/rst2.srf   to retrieve a binarysecuritytoken, eg

<?xml version="1.0" encoding="UTF-8"?>
<S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://schemas.xmlsoap.org/ws/2005/02/trust" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<S:Header>
<wsa:Action S:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</wsa:Action>
<wsa:To S:mustUnderstand="1">sharepoint.com</wsa:To>
<ps:AuthInfo xmlns:ps="http://schemas.microsoft.com/LiveID/SoapServices/v1" Id="PPAuthInfo">
<ps:BinaryVersion>5</ps:BinaryVersion>
<ps:HostingApp>Managed IDCRL</ps:HostingApp>
</ps:AuthInfo>
<wsse:Security>
<wsse:UsernameToken wsu:Id="user">
<wsse:Username>user@domain.com.au</wsse:Username>
<wsse:Password>password</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</S:Header>
<S:Body>
<wst:RequestSecurityToken Id="RST0">
<wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType>
<wsp:AppliesTo>
<wsa:EndpointReference>
<wsa:Address>sharepoint.com</wsa:Address>
</wsa:EndpointReference>
</wsp:AppliesTo>
<wsp:PolicyReference URI="MBI" />
</wst:RequestSecurityToken>
</S:Body>
</S:Envelope>

2) Receive binarysecuitytoken and make a secondary (get) request, to:  https://<domain>.sharepoint.com/_vti_bin/idcrl.svc which included the binarysecuritytoken in the header, and the response included an auth cookie to be used for subsequent requests

There is scant documentation around if this uses 'ws-trust' -this post being an obscure find - can you (MS) please confirm if this does use ws-trust, and if so how will it be affected going forward?

What are the options for updating this particular type of code going foward, and/or how can I find out more information? Is there someone that I can speak to if necessary?

Thanks