Native auth MFA, AB#2083675, Fixes AB#2083675 #2489
Conversation
SammyO
added
the
Skip-Consumers-Check
When MFA is required during a call to /token with grant_type=refresh_token, we need some native auth specific handling to inform developers on how to handle this error. **Note**: Ideally I'd like to store the `50076` error code in a dedicated file, but I'm unsure what to call such a file, as `OAuth2ErrorCode` already exists. IMO this class name is wrong, as these are OAuth2 errors, not error codes.
when /challenge returns browser_required, the SDK should return Redirect result, not APIError
New config types for MFA tests. [AB#2999484](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/2999484)
| override fun toUnsanitizedString(): String = "VerificationRequired(correlationId=$correlationId, codeLength=$codeLength, challengeTargetLabel=$challengeTargetLabel, challengeChannel=$challengeChannel)" | ||
|
|
||
| override fun toString(): String = "VerificationRequired(correlationId=$correlationId, codeLength=$codeLength, challengeChannel=$challengeChannel)" | ||
| } |
There was a problem hiding this comment.
Maybe challengeChannel is sensitive?
There was a problem hiding this comment.
I don't think so. challengeChannel is email, phone, etc.
common4j/src/main/com/microsoft/identity/common/java/controllers/ExceptionAdapter.java
Show resolved
Hide resolved
...osoft/identity/common/java/nativeauth/commands/parameters/MFAChallengeCommandParameters.java
Outdated
Show resolved
Hide resolved
...entity/common/java/nativeauth/commands/parameters/MFASelectedChallengeCommandParameters.java
Outdated
Show resolved
Hide resolved
...identity/common/java/nativeauth/commands/parameters/MFASubmitChallengeCommandParameters.java
Outdated
Show resolved
Hide resolved
...va/com/microsoft/identity/common/nativeauth/internal/controllers/NativeAuthMsalController.kt
Outdated
Show resolved
Hide resolved
...va/com/microsoft/identity/common/nativeauth/internal/controllers/NativeAuthMsalController.kt
Outdated
Show resolved
Hide resolved
...dentity/common/java/nativeauth/commands/parameters/MFADefaultChallengeCommandParameters.java
Outdated
Show resolved
Hide resolved
|
|
||
| try { | ||
| // Add default scopes | ||
| val mergedScopes: List<String> = addDefaultScopes(parameters.scopes) |
There was a problem hiding this comment.
interesting, on iOS we add the default scopes only during the first "signIn(username, password: optional)" SDK call. Then the scopes are stored internally in memory (in the state). Why do you add the default scopes here too?
There was a problem hiding this comment.
That would indeed be a better approach. Doing that is quite a refactoring in Android, as we pass scopes from one state to the next only if they're set by the developer (see interface classes, e.g. MFAStates. We don't take scopes from the result of an API call; but moreover, there is no result of an API call that includes scopes until the final token call is successful.
In signInSubmitCode we currently also set default scopes.
|
|
||
| /** | ||
| * Adds continuation token to [SignInStartCommandParameters] object and returns a new | ||
| * [SignInSubmitPasswordCommandParameters] object. |
There was a problem hiding this comment.
nit: Should this "SignInSubmitCodeCommandParameters" ?
There was a problem hiding this comment.
No, actually this entire comment is wrong.
|
❌ Work item link check failed. Description contains AB#2083675 but the Bot could not link it to an Azure Boards work item. Click here to learn more. |
|
✅ Work item link check complete. Description contains link AB#2083675 to an Azure Boards work item. |
github-actions
bot
changed the title
Support for email OTP based MFA in native authentication flows. - Added MFA results and states to the SDK interface - Business logic & API integration - Custom error handling for MFA required error during calls to /token with grant_type=refresh_token - Private preview warnings in console and documentation - Unit and E2E production tests MSAL common PR: AzureAD/microsoft-authentication-library-common-for-android#2489 --------- Co-authored-by: Yuki-YuXin <[email protected]>
5 participants
Support for email OTP based MFA in native authentication flows.
MSAL PR: AzureAD/microsoft-authentication-library-for-android#2167
AB#2083675