Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to learn details on how LiveID works, when compared to other federation technologies.

To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand what I'm doing before I federate my application to LiveID.

In addition I'd like to understand the differences between the free implementatations and the RPS system. My understanding is that there are at least 4 different ways to hook up to LiveID. Considering that large surface area of authentication, and little public documentation, makes me uneasy.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

LiveID is an extension of WS-Trust/Federation/Security in a passive mode. Passive meaning that the client -- the browser -- needs to be told what to do by the clients, which is done through 302 redirects and POST-backs.

To rephrase this, LiveID follows a Claims-Based model, building on top of the protocols mentioned earlier. The documentation is very sparse because, well, Microsoft can be very lame at times.

The differences between the versions have to do with how the authentication happens, moreso what layer makes the redirect to login.live.com. E.g. the server-side code forcing the redirect, or the client code -- javascript -- does the redirect.

What exactly are you trying to accomplish? Are you just wanting a person to log into your site using their LiveID, or are you looking for a more in depth federation model?

share|improve this answer
add comment

I'm not sure about this, but I believe that LiveID is not it's own set of technologies, but simply Microsoft's offering in public federation.
They wrap it up nicely and provide easy interfaces, but underneath its still the same techs and protocols: ADFS, WS-Trust, SAML, etc. They might also give you some flexibility in mix-n-matching, that would be difficult to do on your own.
I'm also pretty sure that LiveID is also OpenID-compliant, being both a provider and consumer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.