SAML Authentication with login.microsoft.com from Progress Openedge - azure

Question

Hi Does anyone have any experience of getting Progress Openedge to authenticate with login.microsoft.com.
Specifically with the certificates required to get it to work.
I have installed the Baltimore Root cert and the VeriSignClass3PublicPrimaryCertificationAuthority-G5
and the Symantec SymantecClass3EVSSLCA-G3 certificates in the Progress\Openedge\certs folder.
The error i'm getting is
Secure Socket Layer (SSL) failure. error code -55: CONNECT HostName: (login.microsoftonline.com) does not match
Certificate: (graph.windows.net) (9318)
Nowhere in my code am i referencing graph.windows.net and i believe this is an issue with the certificate setup but i'm at a loss as to what it is.
BLOCK-LEVEL ON ERROR UNDO, THROW.
USING OpenEdge.Core.String.
USING OpenEdge.Net.HTTP.ClientBuilder.
USING OpenEdge.Net.HTTP.IHttpRequest.
USING OpenEdge.Net.HTTP.IHttpResponse.
USING OpenEdge.Net.HTTP.RequestBuilder.
DEFINE VARIABLE httpUrl AS CHARACTER NO-UNDO.
DEFINE VARIABLE oRequest AS IHttpRequest NO-UNDO.
DEFINE VARIABLE oResponse AS IHttpResponse NO-UNDO.
DEFINE VARIABLE oRequestBody AS String NO-UNDO.
DEFINE VARIABLE JsonString AS LONGCHAR NO-UNDO.
SESSION:DEBUG-ALERT = TRUE.
httpUrl = "https://login.microsoftonline.com/extSTS.srf".
oRequestBody = new String('samlenvelope').
oRequest = RequestBuilder:Post(httpUrl, oRequestBody)
:ContentType('application/soap+xml; charset=utf-8')
:AcceptJson()
:Request.
oResponse = ClientBuilder:Build():Client:Execute(oRequest).
MESSAGE
oResponse:StatusCode SKIP
oResponse:StatusReason SKIP
VIEW-AS ALERT-BOX.

Answer 1

OpenEdge < 11.7 is still common, so the answer below is still valid. However, Microsoft changed the certificates and aliases, and this addressed in my specific answer.
The error message of SSL failure, is telling us that the HTTPS certificate was issued to a different entity than expected. This is what older OpenEdge see, because it does not see a property called SAN, which contain all valid name for the site.
In practice, all you need to do is following these 3 steps:
Step 1: Do you trust the certificate?
Validate that you trust "stamp2.login.microsoftonline.com" (at the time of the question was "login.microsoftonline.com").
Step 2: Optional Mapping
It is possible that "stamp2.login.microsoftonline.com" is not reachable. In this case you'd need to edit the "hosts" file of the OE server, so "stamp2.login.microsoftonline.com" would resolve to the IP of "login.microsoftonline.com" (how to edit the "hosts" file: https://www.siteground.com/kb/how_to_use_the_hosts_file/)
Step 3: Replace the URL in your code
Replace
httpUrl = "https://login.microsoftonline.com/extSTS.srf".
with
httpUrl = "https://stamp2.login.microsoftonline.com/extSTS.srf".