Windows Mobile 6.5 SSO on Corporate Portals

This article examines how single sign-on (SSO) functioned on Windows Mobile 6.5 devices accessing corporate web portals. In enterprise environments, Windows Mobile 6.5 achieved SSO through a combination of native Active Directory integration, Integrated Windows Authentication (IWA), secure device enrollment via System Center Mobile Device Manager, and credential caching within Internet Explorer Mobile.

Native Domain Authentication and Credential Caching

Windows Mobile 6.5, built on the Windows Embedded CE 6.0 kernel, relied heavily on its native Credential Manager to facilitate seamless authentication. When a user initially unlocked the device or authenticated against their corporate infrastructure (often during the Exchange ActiveSync configuration or VPN initialization), the operating system securely cached these corporate credentials using Windows Data Protection API (DPAPI).

When a user navigated to an intranet portal using Internet Explorer Mobile, the browser interacted directly with the operating system’s Security Support Provider Interface (SSPI). If the web portal requested Integrated Windows Authentication, the browser automatically supplied the stored NTLMv2 or Kerberos tokens, negotiating access without prompting the user for secondary credentials.

Network Gateways and Reverse Proxies

Because mobile devices operated outside the local corporate perimeter, direct Kerberos ticketing was often impractical over cellular networks. Enterprises resolved this by deploying perimeter reverse proxies, primarily Microsoft Internet Security and Acceleration (ISA) Server or Microsoft Forefront Threat Management Gateway (TMG).

These edge gateways managed the authentication transition:

  1. Pre-Authentication: The gateway intercepted requests from Windows Mobile 6.5 devices and challenged them for credentials using HTTP Basic Authentication over SSL, client-side certificates, or NTLM.
  2. Kerberos Constrained Delegation (KCD): Once the reverse proxy verified the device's identity, it impersonated the user via KCD to request tickets from Active Directory for the destination internal web servers (such as Microsoft SharePoint or custom IIS-hosted portals).
  3. Session Persistence: Gateways utilized encrypted session cookies, which Internet Explorer Mobile maintained throughout the browsing session, ensuring seamless transitions across different sub-sites within the corporate intranet.

Certificate-Based Single Sign-On

For higher-security environments, enterprises bypassed password-based SSO entirely in favor of Public Key Infrastructure (PKI). Using System Center Mobile Device Manager (SCMDM) 2008 or Active Directory Certificate Services, administrators pushed user-specific X.509 digital certificates to the device's personal certificate store via Over-The-Air (OTA) provisioning.

When accessing a corporate web portal configured for Mutual TLS (mTLS), Internet Explorer Mobile automatically presented the installed client certificate to the web server or reverse proxy. The server mapped the certificate directly to the user’s Active Directory account, eliminating credential prompts while securing the communication channel.

System Center Mobile Device Manager Integration

SCMDM 2008 played a critical role in bringing true domain-joined capabilities to Windows Mobile 6.5. Devices managed by SCMDM received an authenticated IPsec Mobile VPN tunnel that connected automatically whenever corporate resources were requested. By placing the mobile device virtually inside the corporate intranet, Internet Explorer Mobile could resolve internal DNS names and interact directly with internal Key Distribution Centers (KDCs) to negotiate native Kerberos authentication, establishing a desktop-like SSO experience on a mobile handheld.