Skip to content

Commit c973569

Browse files
hieunguyenmsfthieunguyenmsft
authored
Merge pull request #1195 from AzureAD/hieund/release.1.7.16
release 1.7.16
2 parents 85a110c + 3f29e49 commit c973569

File tree

55 files changed

+1460
-61
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1460
-61
lines changed

‎IdentityCore/IdentityCore.xcodeproj/project.pbxproj‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -872,6 +872,8 @@
872872
B21786A023A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = B217869E23A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.h */; };
873873
B21786A123A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.m in Sources */ = {isa = PBXBuildFile; fileRef = B217869F23A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.m */; };
874874
B21786A223A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.m in Sources */ = {isa = PBXBuildFile; fileRef = B217869F23A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.m */; };
875+
B21B4081297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m in Sources */ = {isa = PBXBuildFile; fileRef = B21B4080297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m */; };
876+
B21B4082297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m in Sources */ = {isa = PBXBuildFile; fileRef = B21B4080297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m */; };
875877
B21FA9DA22063CEA00806B68 /* MSIDAutomationActionConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = B25A39EE21C4CD6300213A62 /* MSIDAutomationActionConstants.h */; };
876878
B21FA9DB22063CED00806B68 /* MSIDAutomationActionConstants.m in Sources */ = {isa = PBXBuildFile; fileRef = B25A39EF21C4CD6300213A62 /* MSIDAutomationActionConstants.m */; };
877879
B21FA9DC22063CEE00806B68 /* MSIDAutomationActionConstants.m in Sources */ = {isa = PBXBuildFile; fileRef = B25A39EF21C4CD6300213A62 /* MSIDAutomationActionConstants.m */; };
@@ -2524,6 +2526,7 @@
25242526
B217863723A5994300839CE8 /* MSIDSSOExtensionSignoutController.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MSIDSSOExtensionSignoutController.m; sourceTree = "<group>"; };
25252527
B217869E23A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MSIDSSOExtensionGetAccountsRequest.h; sourceTree = "<group>"; };
25262528
B217869F23A710A000839CE8 /* MSIDSSOExtensionGetAccountsRequest.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MSIDSSOExtensionGetAccountsRequest.m; sourceTree = "<group>"; };
2529+
B21B4080297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MSIDBrokerOperationBrowserTokenRequestTests.m; sourceTree = "<group>"; };
25272530
B223B09922ACBFA400FB8713 /* MSIDMetadataCacheDataSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MSIDMetadataCacheDataSource.h; sourceTree = "<group>"; };
25282531
B223B09D22ADD86500FB8713 /* MSIDCacheItemSerializing.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MSIDCacheItemSerializing.h; sourceTree = "<group>"; };
25292532
B223B09F22ADD87A00FB8713 /* MSIDExtendedCacheItemSerializing.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MSIDExtendedCacheItemSerializing.h; sourceTree = "<group>"; };
@@ -5274,6 +5277,7 @@
52745277
589BDB1C2718CD7D00BF3799 /* MSIDBrokerOperationGetSsoCookiesRequestTests.m */,
52755278
580E254D271A1815003D1795 /* MSIDBrokerOperationGetSsoCookiesResponseTests.m */,
52765279
586CD77B293FD76100550710 /* MSIDRequestControllerFactoryTests.m */,
5280+
B21B4080297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m */,
52775281
);
52785282
path = tests;
52795283
sourceTree = "<group>";
@@ -6390,6 +6394,7 @@
63906394
B2DD4B3D20A9270B0047A66E /* MSIDDefaultCredentialCacheQueryTests.m in Sources */,
63916395
23CC944A20465CF100AA0551 /* MSIDTokenCacheDataSourceIntegrationTests.m in Sources */,
63926396
B217860E23A578BE00839CE8 /* MSIDBrokerOperationSignoutFromDeviceRequestTests.m in Sources */,
6397+
B21B4081297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m in Sources */,
63936398
B233F8CC219E57AC00DC90E3 /* MSIDLegacyBrokerRequestTests.m in Sources */,
63946399
238EF08320913D760035ABE6 /* MSIDAADRequestConfiguratorTests.m in Sources */,
63956400
23419F63239896E500EA78C5 /* MSIDBrokerOperationResponseTests.m in Sources */,
@@ -6870,6 +6875,7 @@
68706875
B27CCDD6229EF2C000CAD565 /* MSIDDictionaryExtensionsTests.m in Sources */,
68716876
B86FA7D52383757600E5195A /* MSIDMacTokenCacheTests.m in Sources */,
68726877
23419F7A2399AD7500EA78C5 /* MSIDBrokerOperationTokenResponseTests.m in Sources */,
6878+
B21B4082297786A3002607C8 /* MSIDBrokerOperationBrowserTokenRequestTests.m in Sources */,
68736879
B252913C2096698100E78695 /* MSIDAADIdTokenClaimsFactoryTests.m in Sources */,
68746880
B2DD5B98204756580084313F /* MSIDAccountTypeTests.m in Sources */,
68756881
23419F5E23973AAD00EA78C5 /* MSIDBrokerOperationRequestTests.m in Sources */,

‎IdentityCore/src/MSIDError.h‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,27 @@ typedef NS_ENUM(NSInteger, MSIDErrorCode)
272272
// JIT - Compliance Check - Device unknown
273273
MSIDErrorJITComplianceCheckResultUnknown = -51823,
274274

275+
// JIT - Compliance Check - Invalid linkPayload from SSO configuration
276+
MSIDErrorJITComplianceCheckInvalidLinkPayload = -51824,
277+
278+
// JIT - Compliance Check - Could not create compliance check web view controller
279+
MSIDErrorJITComplianceCheckCreateController = -51825,
280+
281+
// JIT - Link - LinkConfig not found
282+
MSIDErrorJITLinkConfigNotFound = -51826,
283+
284+
// JIT - Link - Invalid LinkTokenConfig
285+
MSIDErrorJITInvalidLinkTokenConfig = -51827,
286+
287+
// JIT - WPJ - Device Registration Failed
288+
MSIDErrorJITWPJDeviceRegistrationFailed = -51828,
289+
290+
// JIT - WPJ - AccountIdentifier is nil
291+
MSIDErrorJITWPJAccountIdentifierNil = -51829,
292+
293+
// JIT - WPJ - Failed to acquire broker token
294+
MSIDErrorJITWPJAcquireTokenError = -51830,
295+
275296
// Throttling errors
276297
MSIDErrorThrottleCacheNoRecord = -51900,
277298
MSIDErrorThrottleCacheInvalidSignature = -51901,

‎IdentityCore/src/MSIDError.m‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,12 @@ MSIDErrorCode MSIDErrorCodeForOAuthErrorWithSubErrorCode(NSString *oauthError, M
178178
@(MSIDErrorJITComplianceCheckResultNotCompliant),
179179
@(MSIDErrorJITComplianceCheckResultTimeout),
180180
@(MSIDErrorJITComplianceCheckResultUnknown),
181+
@(MSIDErrorJITComplianceCheckInvalidLinkPayload),
182+
@(MSIDErrorJITLinkConfigNotFound),
183+
@(MSIDErrorJITInvalidLinkTokenConfig),
184+
@(MSIDErrorJITWPJDeviceRegistrationFailed),
185+
@(MSIDErrorJITWPJAccountIdentifierNil),
186+
@(MSIDErrorJITWPJAcquireTokenError),
181187

182188
],
183189
MSIDOAuthErrorDomain : @[// Server Errors

‎IdentityCore/src/MSIDOAuth2Constants.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ extern NSString *const MSID_OAUTH2_CODE_CHALLENGE;
7979
extern NSString *const MSID_OAUTH2_CODE_CHALLENGE_METHOD;
8080
extern NSString *const MSID_OAUTH2_CODE_VERIFIER;
8181

82+
// Nested auth protocol
83+
extern NSString *const MSID_NESTED_AUTH_BROKER_CLIENT_ID;
84+
extern NSString *const MSID_NESTED_AUTH_BROKER_REDIRECT_URI;
85+
8286
// AAD user identifiers
8387
extern NSString *const MSID_OAUTH2_CLIENT_INFO;
8488
extern NSString *const MSID_OAUTH2_UNIQUE_IDENTIFIER;

‎IdentityCore/src/MSIDOAuth2Constants.m‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
// THE SOFTWARE.
2323

2424
#import "MSIDOAuth2Constants.h"
25-
#import "MSIDAADNetworkConfiguration.h"
2625

2726
NSString *const MSID_OAUTH2_ACCESS_TOKEN = @"access_token";
2827
NSString *const MSID_OAUTH2_AUTHORIZATION = @"authorization";
@@ -80,6 +79,9 @@
8079
NSString *const MSID_OAUTH2_CODE_CHALLENGE_METHOD = @"code_challenge_method";
8180
NSString *const MSID_OAUTH2_CODE_VERIFIER = @"code_verifier";
8281

82+
NSString *const MSID_NESTED_AUTH_BROKER_CLIENT_ID = @"brk_client_id";
83+
NSString *const MSID_NESTED_AUTH_BROKER_REDIRECT_URI = @"brk_redirect_uri";
84+
8385
NSString *const MSID_OAUTH2_CLIENT_INFO = @"client_info";
8486
NSString *const MSID_OAUTH2_UNIQUE_IDENTIFIER = @"uid";
8587
NSString *const MSID_OAUTH2_UNIQUE_TENANT_IDENTIFIER = @"utid";

‎IdentityCore/src/broker_operation/request/token_request/MSIDBrokerOperationBrowserTokenRequest.m‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,13 @@ - (instancetype)initWithRequest:(NSURL *)requestURL
5555

5656
_requestURL = requestURL;
5757

58+
[self printRequestURLInfo:requestURL];
59+
5860
if (![requestValidator shouldHandleURL:_requestURL])
5961
{
6062
if (error)
6163
{
62-
NSString *errorMessage = [NSString stringWithFormat:@"Failed to create browser operation request, %@ is not authorize request", _PII_NULLIFY([requestURL absoluteString])];
64+
NSString *errorMessage = [NSString stringWithFormat:@"Failed to create browser operation request, %@ is not a valid request", _PII_NULLIFY([requestURL absoluteString])];
6365
*error = MSIDCreateError(MSIDErrorDomain,MSIDErrorInvalidInternalParameter,errorMessage,nil, nil, nil, nil, nil, YES);
6466
}
6567

@@ -90,6 +92,42 @@ - (instancetype)initWithRequest:(NSURL *)requestURL
9092
return self;
9193
}
9294

95+
+ (NSDictionary *)logProtocolNames
96+
{
97+
static NSDictionary *logProtocolNames = nil;
98+
static dispatch_once_t onceToken;
99+
dispatch_once(&onceToken, ^{
100+
logProtocolNames = @{@"/authorize" : @"OAuth2 Authorize",
101+
@"/token": @"OAuth2 Token",
102+
@"/logout": @"OAuth2 Logout",
103+
@"/saml2": @"SAML2"
104+
};
105+
});
106+
107+
return logProtocolNames;
108+
}
109+
110+
+ (NSString *)protocolLogNameForRequestURL:(NSURL *)requestURL
111+
{
112+
NSString *requestURLString = requestURL.absoluteString;
113+
NSDictionary *logProtocolNames = [self logProtocolNames];
114+
115+
for (NSString *keyword in logProtocolNames.allKeys)
116+
{
117+
if ([requestURLString rangeOfString:keyword options:NSCaseInsensitiveSearch].location != NSNotFound)
118+
{
119+
return logProtocolNames[keyword];
120+
}
121+
}
122+
123+
return @"N/A";
124+
}
125+
126+
- (void)printRequestURLInfo:(NSURL *)requestURL
127+
{
128+
MSID_LOG_WITH_CTX(MSIDLogLevelInfo, nil, @"[Browser SSO] Request URL host %@, protocol %@", requestURL.host, [self.class protocolLogNameForRequestURL:requestURL]);
129+
}
130+
93131
#pragma mark - MSIDBaseBrokerOperationRequest
94132

95133
+ (NSString *)operation

‎IdentityCore/src/cache/accessor/MSIDDefaultTokenCacheAccessor.m‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,14 +211,17 @@ - (MSIDRefreshToken *)getRefreshableTokenWithAccount:(MSIDAccountIdentifier *)ac
211211
{
212212
if (credentialType != MSIDRefreshTokenType && credentialType != MSIDPrimaryRefreshTokenType) return nil;
213213

214+
// For nested auth, get the RT using the broker/hub's client id
215+
NSString *clientId = [configuration isNestedAuthProtocol] ? configuration.nestedAuthBrokerClientId : configuration.clientId;
216+
214217
if (![NSString msidIsStringNilOrBlank:accountIdentifier.homeAccountId])
215218
{
216219
MSID_LOG_WITH_CTX_PII(MSIDLogLevelVerbose, context, @"(Default accessor) Finding token with user ID %@, clientId %@, familyID %@, authority %@", accountIdentifier.maskedHomeAccountId, configuration.clientId, familyId, configuration.authority);
217220

218221
MSIDDefaultCredentialCacheQuery *query = [MSIDDefaultCredentialCacheQuery new];
219222
query.homeAccountId = accountIdentifier.homeAccountId;
220223
query.environmentAliases = [configuration.authority defaultCacheEnvironmentAliases];
221-
query.clientId = familyId ? nil : configuration.clientId;
224+
query.clientId = familyId ? nil : clientId;
222225
query.familyId = familyId;
223226
query.credentialType = credentialType;
224227

@@ -240,7 +243,7 @@ - (MSIDRefreshToken *)getRefreshableTokenWithAccount:(MSIDAccountIdentifier *)ac
240243

241244
MSIDRefreshToken *refreshToken = (MSIDRefreshToken *) [self getRefreshableTokenByDisplayableId:accountIdentifier
242245
authority:configuration.authority
243-
clientId:configuration.clientId
246+
clientId:clientId
244247
familyId:familyId
245248
credentialType:credentialType
246249
context:context

‎IdentityCore/src/cache/token/MSIDCredentialCacheItem.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,9 @@
8484
// Requested claims for access tokens, currently only used by MSAL C++
8585
@property (atomic, readwrite, nullable) NSString *requestedClaims;
8686

87+
// Redirect Uri
88+
@property (atomic, readwrite, nullable) NSString *redirectUri;
89+
8790
- (BOOL)isEqualToItem:(nullable MSIDCredentialCacheItem *)item;
8891

8992
- (BOOL)matchesTarget:(nullable NSString *)target comparisonOptions:(MSIDComparisonOptions)comparisonOptions;

‎IdentityCore/src/cache/token/MSIDCredentialCacheItem.m‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,9 @@ @implementation MSIDCredentialCacheItem
5151

5252
- (NSString *)description
5353
{
54-
return [NSString stringWithFormat:@"MSIDCredentialCacheItem: clientId: %@, credentialType: %@, target: %@, realm: %@, environment: %@, expiresOn: %@, extendedExpiresOn: %@, refreshOn: %@, cachedAt: %@, last recovery attempted at: %@, familyId: %@, homeAccountId: %@, enrollmentId: %@, speInfo: %@, secret: %@",
54+
return [NSString stringWithFormat:@"MSIDCredentialCacheItem: clientId: %@, credentialType: %@, target: %@, realm: %@, environment: %@, expiresOn: %@, extendedExpiresOn: %@, refreshOn: %@, cachedAt: %@, last recovery attempted at: %@, familyId: %@, homeAccountId: %@, enrollmentId: %@, speInfo: %@, secret: %@, redirectUri: %@",
5555
self.clientId, [MSIDCredentialTypeHelpers credentialTypeAsString:self.credentialType], self.target, self.realm, self.environment, self.expiresOn,
56-
self.extendedExpiresOn, self.refreshOn, self.cachedAt, self.lastRecoveryAttempt, self.familyId, self.homeAccountId, self.enrollmentId, self.speInfo, [self.secret msidSecretLoggingHash]];
56+
self.extendedExpiresOn, self.refreshOn, self.cachedAt, self.lastRecoveryAttempt, self.familyId, self.homeAccountId, self.enrollmentId, self.speInfo, [self.secret msidSecretLoggingHash], MSID_PII_LOG_TRACKABLE(self.redirectUri)];
5757
}
5858

5959
#pragma mark - MSIDCacheItem
@@ -93,6 +93,7 @@ - (BOOL)isEqualToItem:(MSIDCredentialCacheItem *)item
9393
result &= (!self.tokenType && !item.tokenType) || [self.tokenType isEqual:item.tokenType];
9494
result &= (!self.kid && !item.kid) || [self.kid isEqual:item.kid];
9595
result &= (!self.requestedClaims && !item.requestedClaims) || [self.requestedClaims isEqual:item.requestedClaims];
96+
result &= (!self.redirectUri && !item.redirectUri) || [self.redirectUri isEqual:item.redirectUri];
9697
// Ignore the lastMod properties (two otherwise-identical items with different
9798
// last modification informational values should be considered equal)
9899
return result;
@@ -121,6 +122,7 @@ - (NSUInteger)hash
121122
hash = hash * 31 + self.tokenType.hash;
122123
hash = hash * 31 + self.kid.hash;
123124
hash = hash * 31 + self.requestedClaims.hash;
125+
hash = hash * 31 + self.redirectUri.hash;
124126
return hash;
125127
}
126128

@@ -151,6 +153,7 @@ - (id)copyWithZone:(NSZone *)zone
151153
item.tokenType = [self.tokenType copyWithZone:zone];
152154
item.kid = [self.kid copyWithZone:zone];
153155
item.requestedClaims = [self.requestedClaims copyWithZone:zone];
156+
item.redirectUri = [self.redirectUri copyWithZone:zone];
154157
return item;
155158
}
156159

@@ -205,6 +208,7 @@ - (instancetype)initWithJSONDictionary:(NSDictionary *)json error:(__unused NSEr
205208
_tokenType = [json msidStringObjectForKey:MSID_OAUTH2_TOKEN_TYPE];
206209
_expiryInterval = [json msidStringObjectForKey:MSID_EXPIRES_IN_CACHE_KEY];
207210
_requestedClaims = [json msidStringObjectForKey:MSID_REQUESTED_CLAIMS_CACHE_KEY];
211+
_redirectUri = [json msidStringObjectForKey:MSID_OAUTH2_REDIRECT_URI];
208212
return self;
209213
}
210214

@@ -242,6 +246,7 @@ - (NSDictionary *)jsonDictionary
242246
dictionary[MSID_KID_CACHE_KEY] = _kid;
243247
dictionary[MSID_OAUTH2_TOKEN_TYPE] = _tokenType;
244248
dictionary[MSID_REQUESTED_CLAIMS_CACHE_KEY] = _requestedClaims;
249+
dictionary[MSID_OAUTH2_REDIRECT_URI] = _redirectUri;
245250
return dictionary;
246251
}
247252

‎IdentityCore/src/configuration/MSIDConfiguration.h‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ extern NSString * const MSID_REDIRECT_URI_JSON_KEY;
3030
extern NSString * const MSID_CLIENT_ID_JSON_KEY;
3131
extern NSString * const MSID_SCOPE_JSON_KEY;
3232
extern NSString * const MSID_TOKEN_TYPE_JSON_KEY;
33+
extern NSString * const MSID_NESTED_AUTH_BROKER_CLIENT_ID_JSON_KEY;
34+
extern NSString * const MSID_NESTED_AUTH_BROKER_REDIRECT_URI_JSON_KEY;
3335

3436
@interface MSIDConfiguration : NSObject <NSCopying, MSIDJsonSerializable>
3537

@@ -40,6 +42,10 @@ extern NSString * const MSID_TOKEN_TYPE_JSON_KEY;
4042
@property (atomic, readonly) NSString *target;
4143
@property (atomic, readwrite) MSIDAuthenticationScheme *authScheme;
4244

45+
// Nested auth protocol
46+
@property (atomic, readwrite) NSString *nestedAuthBrokerClientId;
47+
@property (atomic, readwrite) NSString *nestedAuthBrokerRedirectUri;
48+
4349
@property (atomic, readwrite) NSString *applicationIdentifier;
4450

4551
@property (atomic, readonly) NSString *resource;
@@ -56,4 +62,21 @@ extern NSString * const MSID_TOKEN_TYPE_JSON_KEY;
5662
resource:(NSString *)resource
5763
scopes:(NSOrderedSet<NSString *> *)scopes;
5864

65+
- (instancetype)initWithAuthority:(MSIDAuthority *)authority
66+
redirectUri:(NSString *)redirectUri
67+
clientId:(NSString *)clientId
68+
target:(NSString *)target
69+
nestedAuthBrokerClientId:(NSString *)nestedAuthBrokerClientId
70+
nestedAuthBrokerRedirectUri:(NSString *)nestedAuthBrokerRedirectUri;
71+
72+
- (instancetype)initWithAuthority:(MSIDAuthority *)authority
73+
redirectUri:(NSString *)redirectUri
74+
clientId:(NSString *)clientId
75+
resource:(NSString *)resource
76+
scopes:(NSOrderedSet<NSString *> *)scopes
77+
nestedAuthBrokerClientId:(NSString *)nestedAuthBrokerClientId
78+
nestedAuthBrokerRedirectUri:(NSString *)nestedAuthBrokerRedirectUri;
79+
80+
- (BOOL)isNestedAuthProtocol;
81+
5982
@end

0 commit comments

Comments
 (0)