Authenticate with login.microsoftonline.com through PHP cURL (SSL connect error)

Question

I am trying to extract data from a Micorosft Dynamics CRM 2015 with PHP. From various sources i learned that i had to start with an authentication with login.microsoftonline.com.

I am sending an XML request using cURL that results in a SSL connect error.

The XML request:

 <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
    <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action>         
    <a:MessageID>urn:uuid:4e586759-a5cc-483c-bbd0-9f3eed7667dc</a:MessageID> 
    <a:ReplyTo>
         <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address> 
    </a:ReplyTo>
    <VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink">uIDPo4TBVw9fIMZFmc7ZFxBXIcYAAAAAbd1LF/fnfUOzaja8sGev0GKsBdINtR5Jt13WPsZ9dPgACQAA</VsDebuggerCausalityData> 
    <a:To s:mustUnderstand="1">https://login.microsoftonline.com/RST2.srf</a:To> 
    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <u:Timestamp u:Id="_0">
              <u:Created>2015-06-11T17:14:09.00Z</u:Created> 
              <u:Expires>2015-06-12T17:14:09.00Z</u:Expires> 
        </u:Timestamp>
        <o:UsernameToken u:Id="uuid-14bed392-2320-44ae-859d-fa4ec83df57f-4">
            <o:Username>{username}</o:Username> 
            <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">{password}</o:Password> 
        </o:UsernameToken>
    </o:Security>
</s:Header>
<s:Body>
    <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
        <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
            <a:EndpointReference>
                <a:Address>urn:crmemea:dynamics.com</a:Address> 
            </a:EndpointReference>
        </wsp:AppliesTo>
        <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType> 

    </t:RequestSecurityToken>
</s:Body>

The cURL setup:

$headers = array(
        "POST " . $postUrl . " HTTP/1.1",
        "Host: " . $hostname,
        'Connection: Keep-Alive',
        "Content-type: application/soap+xml; charset=UTF-8",
        "Content-length: " . strlen($content),
);

$cURLHandle = curl_init();
$soapUrl = "https://login.microsoftonline.com/RST2.srf";
curl_setopt($cURLHandle, CURLOPT_URL, $soapUrl);
curl_setopt($cURLHandle, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($cURLHandle, CURLOPT_TIMEOUT, 60);
curl_setopt($cURLHandle, CURLOPT_SSL_VERIFYPEER, false);        
curl_setopt($cURLHandle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($cURLHandle, CURLOPT_HTTPHEADER, $headers);
curl_setopt($cURLHandle, CURLOPT_POST, 1);
curl_setopt($cURLHandle, CURLOPT_POSTFIELDS, $content);
curl_setopt($cURLHandle, CURLOPT_SSLVERSION , 3);
curl_setopt($cURLHandle, CURLOPT_FOLLOWLOCATION, TRUE);
curl_setopt($cURLHandle, CURLINFO_HEADER_OUT, false);
$fp = fopen('error.txt', 'w'); 
curl_setopt($cURLHandle, CURLOPT_STDERR, $fp);
curl_setopt($cURLHandle, CURLOPT_VERBOSE, true);        

$response = curl_exec($cURLHandle);

headers:

array(5) {
  [0]=>
  string(23) "POST /RST2.srf HTTP/1.1"
  [1]=>
  string(31) "Host: login.microsoftonline.com"
  [2]=>
  string(22) "Connection: Keep-Alive"
  [3]=>
  string(49) "Content-type: application/soap+xml; charset=UTF-8"
  [4]=>
  string(20) "Content-length: 3083"
}

curl_error: string(17) "SSL connect error"

Verbose Error info:

• About to connect() to login.microsoftonline.com port 443 (#0)
• Trying 23.97.148.36... * connected
• Connected to login.microsoftonline.com (23.97.148.36) port 443 (#0)
• warning: ignoring value of ssl.verifyhost
• NSS error -5961
• Closing connection #0
• SSL connect error

cURL version info:

array(9) {
  ["version_number"]=>
  int(463623)
  ["age"]=>
  int(3)
  ["features"]=>
  int(1597)
  ["ssl_version_number"]=>
  int(0)
  ["version"]=>
  string(6) "7.19.7"
  ["host"]=>
  string(23) "x86_64-redhat-linux-gnu"
  ["ssl_version"]=>
  string(22) "NSS/3.16.2.3 Basic ECC"
  ["libz_version"]=>
  string(5) "1.2.3"
  ["protocols"]=>
  array(12) {
    [0]=>
    string(4) "tftp"
    [1]=>
    string(3) "ftp"
    [2]=>
    string(6) "telnet"
    [3]=>
    string(4) "dict"
    [4]=>
    string(4) "ldap"
    [5]=>
    string(5) "ldaps"
    [6]=>
    string(4) "http"
    [7]=>
    string(4) "file"
    [8]=>
    string(5) "https"
    [9]=>
    string(4) "ftps"
    [10]=>
    string(3) "scp"
    [11]=>
    string(4) "sftp"
  }
}

If i need to provide more please let me know any help would be appreciated! Any information about NSS error -5961 would be helpfull to i guess.

Answer 1

I suspect it might be an issue with your POST and Host values. Your successfully connecting to login.microsoftonline.com however the next step I believe is your organisation.

I haven't played around with this stuff for a while however the values I have look like so:- POST /Organization.svc Host yourorganisation.api.crm5.dynamics.com

Obviously you need to change the "yourorganisation" part and the "crm5" to match your region.

I did a connection a few years ago that as far as I know still works. http://crmtroubleshoot.blogspot.com.au/2013/07/dynamics-crm-2011-php-and-soap-using.html