# Table of contents:

# Introduction

USR is a command introduced with MSNP2.

The command exists in all services, without a request or response payload.

Starts and continues the authentication process.

This command can only be sent once. Any further uses of this command in the same session is Undefined Behaviour.

For the command that is sent when sending a USR command to a Dispatch Server, read XFR.

# Client/Request

# Dispatch Server or Notification Server

# The Initial request

USR TrID security-package I user-handle

security-package defines the authentication scheme, which varies depending on client and protocol version:

# The Subsequent request

USR TrID security-package S {...challenge-args} {endpoint-id}

Where challenge-args can be anything, but based on security-package it can be:

Where endpoint-id is your Endpoint ID (GUID). Since MSNP16

# Web authentication

USR TrID WEB endpoint-id

Where endpoint-id is your Endpoint ID (GUID).

# Switchboard Server

USR TrID user-handle session-id.cookie

Where user-handle is your current user handle.

Where session-id is the Switchboard session ID. Given in XFR.

Where cookie is the Switchboard cookie. Given in XFR.

# Server/Response

# Dispatch Server or Notification Server

# Requesting a Subsequent action

USR TrID security-package S {...challenge-response}

Where challenge-response, based on the security-package is:

# Successfully authenticated

USR TrID OK user-handle {friendly-name} {email-validated} {account-managed}

Where OK is always OK.

Where user-handle is your user handle.

Where friendly-name is your current friendly (display) name. Removed in MSNP10.

Where email-validated is the account's validation (verification) status, where 0 is unvalidated ("unverified"), and 1 is validated ("verified"). Added since MSNP6.

Where account-managed is the account's management ("restriction") status, where 0 is unmanaged ("unrestricted"), and 1 is managed ("restricted"). Added since MSNP8. If this is set to 1, the Client may log out automatically and ask to use MSN Explorer.

# Switchboard Server

USR TrID OK user-handle friendly-name

Where user-handle is your current user handle.

Where friendly-name is your current friendly (display) name.

# Examples

# Notification Server

# Using CTP

Only in MSNP2.

C: USR 1 CTP I example@hotmail.com password
S: USR 1 OK example@hotmail.com example%20user

# Using MD5

Only in MSNP2 to MSNP7.

C: USR 2 MD5 I example@hotmail.com
S: USR 2 MD5 S 1234567890.123456789
C: USR 3 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: USR 3 OK example@hotmail.com example%20user 1

# Using TWN

Since MSNP8.

C: USR 4 TWN I example@hotmail.com
S: USR 4 TWN S passport=parameters,neat=huh,lc=1033,id=507

The HTTPS interlude has been moved to the Passport SSI 1.4 article.

# Without a Endpoint ID

Only in MSNP8 to MSNP15.

C: USR 5 TWN S t=token&p=profile
S: USR 5 OK example@hotmail.com example%20user 1 0

# With a Endpoint ID

Since MSNP16.

C: USR 6 TWN S t=token&p=profile {57454243-4c49-454e-544c-494252415259}
S: USR 6 OK example@hotmail.com example%20user 1 0

# Using SSO

Since MSNP15.

NOTE: This has been line-broken. Lines beginning with .. followed by a space are continuations of the previous line.

C: USR 6 SSO I example@hotmail.com
S: USR 6 SSO S MBI_KEY_OLD AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

The HTTPS interlude has been moved to the Passport Request Security Token service article.

The key-encryption interlude is described on the SSO article.

An implementation of the response generator is provided as the SolveSSOChallenge function in the msnp_challenges.cs file.

# Without a Endpoint ID

Only in MSNP15.

C: USR 7 SSO S t=ticket&p=profile
.. HAAAAAEAAAADZgAABIAAAAgAAAAUAAAASAAAAAAAAAAAAAAA7XgT5ohvaZdo
.. XdrWUUcMF2G8OK2JohyYcK5l5MJSitab33scxJeK/RQXcUr0L+R2ZA9CEAzn
.. 0izmUzSMp2LZdxSbHtnuxCmptgtoScHp9E26HjQVkA9YJxgK/HM=
S: USR 7 OK example@hotmail.com

# With a Endpoint ID

Since MSNP16.

C: USR 8 SSO S t=ticket&p=profile
.. HAAAAAEAAAADZgAABIAAAAgAAAAUAAAASAAAAAAAAAAAAAAA7XgT5ohvaZdo
.. XdrWUUcMF2G8OK2JohyYcK5l5MJSitab33scxJeK/RQXcUr0L+R2ZA9CEAzn
.. 0izmUzSMp2LZdxSbHtnuxCmptgtoScHp9E26HjQVkA9YJxgK/HM=
.. {44bfd5a4-7450-4bda-ba3a-c51b3031126d}
S: USR 8 OK example@hotmail.com

# Using WEB

Since MSNP16.

NOTE: This depends on the HTTP Gateway.

C: USR 9 WEB {57454243-4c49-454e-544c-494252415259}
S: USR 9 OK example@hotmail.com

# Invalid authentication scheme

C: USR 10 BAD I example@hotmail.com

Server disconnects client.

# Invalid username or password

C: USR 11 TWN I example@hotmail.com
S: USR 11 TWN S passport=parameters,neat=huh,lc=1033,id=507
C: USR 12 TWN S t=not*a*passport*ticket&p=not*a*profile*either
S: 911 12

Server disconnects client.

# Child account not authorized

Since MSNP4.

C: USR 13 MD5 I example@hotmail.com
S: USR 13 MD5 S 1234567890.123456789
C: USR 14 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: 923 14

Server disconnects client.

# Account not verified

# Hard block

Since MSNP5.

NOTE: This will show the Account Verification dialog.

C: USR 15 MD5 I example@hotmail.com
S: USR 15 MD5 S 1234567890.123456789
C: USR 16 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: 924 16

Server disconnects client.

# Soft warning

Since MSNP6.

C: USR 17 MD5 I example@hotmail.com
S: USR 17 MD5 S 1234567890.123456789
C: USR 18 MD5 S f59af8f2fa91d38aff7c870c17f99903
S: USR 18 OK example@hotmail.com example%20user 0

# Account restricted

Since MSNP8.

NOTE: This will automatically log you out and force you to use MSN Explorer instead.

C: USR 19 TWN I example@hotmail.com
S: USR 19 TWN S passport=parameters,neat=huh,lc=1033,id=507
C: USR 20 TWN S t=token&p=profile
S: USR 20 OK example@hotmail.com example%20user 1 1

Client disconnects from server.

# Wrong server for this account

C: USR 21 TWN I example@hotmail.com
S: 931 21

Server disconnects client.

# Switchboard Server

# Without a Endpoint ID

C: USR 22 example@hotmail.com 987654321.123456789.123456789
S: USR 22 OK example@hotmail.com example%20user

# With a Endpoint ID

Since MSNP16.

C: USR 22 example@hotmail.com;{44bfd5a4-7450-4bda-ba3a-c51b3031126d} 987654321.123456789.123456789
S: USR 22 OK example@hotmail.com example%20user

# Known changes