Microsoft Windows Live sign-in

Add Windows Live sign-in as an authentication method to Integrity Web

Let your consumers use their existing Windows Live account to sign in to any service protected by Integrity Web.

Guide prerequisite:

• Integrity Web installed

• DNS-name and certificates in place for the Integrity Web https-host

• Enterprise Entra ID admin account (for production purposes, for test you may use another Entra ID account)

Add authentication method

Add this configuration to the Authn module in the configuration:

  {
                        "id": "mswindowslive",
                        "type": "OIDCRP",
                        "config": {
                            "base_path": "/saml/authn",
                            "discovery_metadata_url": "https://login.live.com/.well-known/openid-configuration",
                            "internal_http_destination": "default",
                           "client_id": "windows.client.id.value",
                            "client_secret": "windows.client.secret.value",
                            "redirect_uri": "https://my.own.host/saml/authn/mswindowslive",
                            "jwt_subject_parameter": "email",
                           "scope" : "openid email"
                        }
                    }

Change the DNS host name of the redirect_uri to match your environment. Copy the value of the redirect_uri as this will be used in a later step.

Microsoft Azure AD (Entra ID) configuration

1. Sign in to portal.azure.com

2. Click App registrations

3. Click New registration

4. Enter a name, such as Integrity

5. Select the third option, Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)

6. Add the redirect URI copied from previous step. Select Web as the platform. Example:

1. Click Register

2. Select Certificates and Secrets

3. Client Secrets

4. New client secret

5. Enter a description, such as Integrity

6. Select Expires

7. Click Add

8. Once created, copy the client secret value (shown in the column Value). This will be used in a later step.

9. Click Overview

10. Copy the Application (client) id value. This will be used in a later step.

Add client credentials

1. Open the Integrity Web configuration

2. Locate the Windows Live Authentication method added in previous step

3. Replace the client_id and client_secret values with the values copied in previous step.

Example:

  {
                        "id": "mswindowslive",
                        "type": "OIDCRP",
                        "config": {
                            "base_path": "/saml/authn",
                            "discovery_metadata_url": "https://login.live.com/.well-known/openid-configuration",
                            "internal_http_destination": "default",
                           "client_id": "frs3123-45db-123e-9cf1-561eaacad221",
                            "client_secret": "gu22~jSHT.234jsdsd234sdfP~uFlykHkSq34sdgsg",
                            "redirect_uri": "https://my.own.host/saml/authn/mswindowslive",
                            "jwt_subject_parameter": "email",
                           "scope" : "openid email"
                        }
                    }

Test

Alter the configuration to point to the new Windows Live authenticator, either directly or as a selector option.

Browse to the service protected by Integrity Web.

Select Windows Live as authentication method.

Your browser should now be redirected to the Windows Live sign-in site.

Enter your Windows Live credentials and approve the authentication.

You should now be redirected back to Integrity and then to the service with a valid authentication.

Use server.log for error tracing and debugging. Fix accordingly and test again.

Sample configuration

A sample Integrity Web configuration, including a number of different social provider sign-in options, can be downloaded here.