# Table of contents:

# Introduction

USR is a command introduced with MSNP2.

The command exists in all services, without a request or response payload.

Starts and continues the authentication process.

This command can only be sent once. Any further uses of this command in the same session is Undefined Behaviour.

For the command that is sent when sending a USR command to a Dispatch Server, read XFR.

# Client/Request

# Dispatch Server or Notification Server

# The Initial request

USR TrID security-package I user-handle

security-package defines the authentication scheme, which varies depending on client and protocol version:

# The Subsequent request

USR TrID security-package S {...challenge-args}

Where challenge-args can be anything, but based on security-package it can be:

# Switchboard Server

USR TrID user-handle session-id.cookie

Where user-handle is your current user handle.

Where session-id is the Switchboard session ID. Given in XFR.

Where cookie is the Switchboard cookie. Given in XFR.

# Server/Response

# Dispatch Server or Notification Server

# Requesting a Subsequent action

USR TrID OK security-package S {...challenge-response}

Where challenge-response, based on the security-package is:

# Successfully authenticated

USR TrID OK user-handle {friendly-name} {email-validated} {account-managed}

Where OK is always OK.

Where user-handle is your user handle.

Where friendly-name is your current friendly (display) name. Removed in MSNP10.

Where email-validated is the account's validation (verification) status, where 0 is unvalidated ("unverified"), and 1 is validated ("verified"). Added since MSNP6.

Where account-managed is the account's management ("restriction") status, where 0 is unmanaged ("unrestricted"), and 1 is managed ("restricted"). Added since MSNP8. If this is set, the Client may log out automatically and ask to use MSN Explorer.

# Switchboard Server

USR TrID OK user-handle friendly-name

Where user-handle is your current user handle.

Where friendly-name is your current friendly (display) name.

# Examples

# Notification Server

# Using CTP

Only in MSNP2.

C: USR 1 CTP I example@hotmail.com password
S: USR 1 OK example@hotmail.com example%20user

# Using MD5

Only in MSNP2 to MSNP7.

C: USR 2 MD5 I example@hotmail.com
S: USR 2 MD5 S 1234567890.123456789
C: USR 3 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: USR 3 OK example@hotmail.com example%20user 1

# Using TWN

Since MSNP8.

C: USR 4 TWN I example@hotmail.com
S: USR 4 TWN S passport=parameters,neat=huh,lc=1033,id=507

The HTTPS interlude has been moved to the Passport SSI 1.4 article.

C: USR 5 TWN S t=token&p=profile
S: USR 5 OK example@hotmail.com example%20user 1 0

Since MSNP13.

S: BLP 5 AL

# Using SSO

Since MSNP15.

NOTE: This has been line-broken. Lines beginning with .. followed by a space are continuations of the previous line.

C: USR 6 SSO I example@hotmail.com
S: USR 6 SSO S MBI_KEY_OLD AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

The HTTPS interlude has been moved to the Passport SOAP (RST) article.

The key-encryption interlude has been removed from here and is to reinstated as another article.

An implementation of the response generator is provided as the SolveSSOChallenge function in the msnp_challenges.cs file.

C: USR 7 SSO S t=ticket&p=HAAAAAEAAAADZgAABIAAAAgAAAAUAAAASAAAA
.. AAAAAAAAAAA7XgT5ohvaZdoXdrWUUcMF2G8OK2JohyYcK5l5MJSitab33scx
.. JeK/RQXcUr0L+R2ZA9CEAzn0izmUzSMp2LZdxSbHtnuxCmptgtoScHp9E26H
.. jQVkA9YJxgK/HM=
S: USR 7 OK example@hotmail.com
S: BLP 7 AL

# Invalid authentication scheme

C: USR 8 BAD I example@hotmail.com

Server disconnects client.

# Invalid username or password

C: USR 9 TWN I example@hotmail.com
S: USR 9 TWN S passport=parameters,neat=huh,lc=1033,id=507
C: USR 10 TWN S t=not*a*passport*ticket&p=not*a*profile*either
S: 911 10

Server disconnects client.

# Child account not authorized

Since MSNP4.

C: USR 11 MD5 I example@hotmail.com
S: USR 11 MD5 S 1234567890.123456789
C: USR 12 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: 923 12

Server disconnects client.

# Account not verified

# Hard block

Since MSNP5.

NOTE: This will show the Account Verification dialog.

C: USR 13 MD5 I example@hotmail.com
S: USR 13 MD5 S 1234567890.123456789
C: USR 14 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: 924 14

Server disconnects client.

# Soft warning

Since MSNP6.

C: USR 15 MD5 I example@hotmail.com
S: USR 15 MD5 S 1234567890.123456789
C: USR 16 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: USR 16 OK example@hotmail.com example%20user 0

# Account restricted

Since MSNP8.

NOTE: This will automatically log you out and force you to use MSN Explorer instead.

C: USR 17 TWN I example@hotmail.com
S: USR 17 TWN S passport=parameters,neat=huh,lc=1033,id=507
C: USR 18 TWN S t=token&p=profile
S: USR 18 OK example@hotmail.com example%20user 1 1

Client disconnects from server.

# Wrong server for this account

C: USR 19 TWN I example@hotmail.com
S: 931 19

Server disconnects client.

# Switchboard Server

C: USR 20 example@passport.com 987654321.123456789.123456789
S: USR 20 OK example@passport.com example%20user

# Known changes