I was working on an Atom publishing API for my blog, since I want to use more secure authentication than is possible with the MetaWeblog API.  But I had no luck getting Windows Live Writer to authenticate against my API even though it tested out correctly in every other way.  I finally discovered it was a quirk of Windows Live Writer.

The secret is to make sure you check the box to remember your password!  Even if you don’t actually need or want to do that.  Otherwise Windows Live Writer sends a blank password across no matter what you type in.  This occurs with Basic, Digest and WSSE authentication.

Here are the steps that created the problem.  First add a blog account.  (Or edit an existing one.)

Enter a name and password, but do not check the “Remember my password” box.  In this case it doesn’t auto-detect the Atom API (I’m still working on that), so I have to put in the Atom service document manually.

Everything seems okay.

When you click Finish and get back to the Blog Settings window everything still looks okay.

I go to publish a test post.  It asks for a login and password, which is what I expect.

I still don’t click on the “Remember my password” box, because I want to be super-secure and type it in every time.  But:

It turns out that Windows Live Writer didn’t send the password - it sent the username “Tom” with an empty string as the password.  (I figured this out by computing the digest for an empty password, which matches what Windows Live Writer sends.)

[2009-09-01 17:48:04] : incoming digest: UkLGsjIPGPHslCyJAcI70GddLno= (127.0.0.1)
[2009-09-01 17:48:04] : expected digest: mUl53CjnIWkxxeuRG4frOSP0L1o= (127.0.0.1)
[2009-09-01 17:48:04] : blank password digest: UkLGsjIPGPHslCyJAcI70GddLno= (127.0.0.1)

When you go back to the Blog Settings you find that the password has disappeared.

Furthermore Windows Live Writer no longer asks for a username and password when attempting to re-publish the same post, so you are stuck.  The only way I found to reset it is to edit the Blog Settings and go through the Update Account Configuration again.  And the only way I found to get Windows Live Writer to send the password correctly to check the “Remember my password” box.

This is the version I used for these tests.

So there you go.  If you’re trying to test your Atom publishing code with Windows Live Writer, make sure you check the “Remember my password” box.