To sign in to Windows Live™ Messenger, users must first be authenticated with Windows Live. Delegated Authentication enables an application to authenticate a user with Windows Live without prompting the user for a username and password. In order for an application to use Delegated Authentication, the application must first request consent from the user and the user must provide consent for the application.
After a user grants consent, the application provider will receive a consent token. This consent token can then be used to authenticate a user and sign in to Messenger. The user only needs to grant consent on the first sign in. Subsequently, the application can store the consent token and use it to authenticate the user for all future sessions.
The DelegatedAuthControl is designed to help abstract the functionality that is required to request consent from a user. For a new user, the sequence of events when signing in is as follows:
-
The user clicks the DelegatedAuthControl and a dialog box appears.
-
The dialog box will prompt the user to sign in, if the user is not already authenticated.
-
After authentication, the user is redirected to a page that prompts the user for permission to allow the application to sign in on the user's behalf.
-
The user grants permission for the application to use Delegated Authentication.
-
The application receives a consent token when the request is granted.
-
The application decrypts the consent token to retrieve the delegation token.
-
The application uses the delegation token to authenticate the user for the current and any subsequent sessions.