azuread/microsoft-authentication-library-common-for-objc

Common code used by both the Active Directory Authentication Library (ADAL) and the Microsoft Authentication Library (MSAL)

This library contains code shared between the Active Directory Authentication Library (ADAL) for Objective-C and the Microsoft Authentication Library (MSAL) for iOS and macOS. This library includes only internal classes and is NOT part of the public API. The contents of this library are subject to change without notice.

Master branch deprercation

The master branch has been copied over to main branch. The master branch will contain updates only until version 1.7.24, for further releases please refer to 'main' branch instead of 'master'.

Issues

We encourage users of ADAL and MSAL to file issues against the library that they are using rather than against common. This helps us understand the version of the common library in use based on the version of ADAL or MSAL against which you report the issue. With that said, if you determine that the issue is indeed with common please go ahead and create it within this repo. Likewise if you have a suggestion, request and/or other feedback relative to common please file it here.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Security Library

This library controls how users sign-in and access services. We recommend you always take the latest version of our library in your app when possible. We use semantic versioning so you can control the risk associated with updating your app. As an example, always downloading the latest minor version number (e.g. x.y.x) ensures you get the latest security and feature enhanements but our API surface remains the same. You can always see the latest version and release notes under the Releases tab of GitHub.

Security Reporting

If you find a security issue with our libraries or services please report it to [email protected] with as much detail as possible. Your submission may be eligible for a bounty through the Microsoft Bounty program. Please do not post security issues to GitHub Issues or any other public site. We will contact you shortly upon receiving the information. We encourage you to get notifications of when security incidents occur by visiting this page and subscribing to Security Advisory Alerts.

License

Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT License (the "License").

microsoft-authentication-library-common-for-objc's Issues

MSID common core should produce top level error of interaction required with underlying error of refresh token rejected or server oauth error

Provide context to MSIDHttpRequest subclasses during initialization

See how it is done in MSIDOpenIdConfigurationInfoRequest:

- (instancetype _Nullable)initWithEndpoint:(nonnull NSURL *)endpoint
                                   context:(nullable id<MSIDRequestContext>)context NS_DESIGNATED_INITIALIZER;

Improve UI implementation

MSIDCredentialCollectionController has bunch of values that we use to draw.
Let's improve on this.

Add support for SPN through ARM templates

Hi,

Currently the only way to create SPNs is powershell or API.

We need support for SPN creation through ARM template

Create a common base token cache component's API

Create an API layer for base token cache component

Allow to provide 3d party authority url

Currently we support only Microsoft's authorities (AAD, ADFS, B2C). Decide if we should allow to provide 3d party authorities.

MSAL cache won't find ADAL refresh tokens with common authority in silent calls

extra query parameters should really be array of nsurlqueryitem instead of dict

NegotiateHandler should always reject protection space for iOS

Currently it does the same Kerberos handling for both iOS and macOS. However, Kerberos is handled transparently by the system, so we should always reject negotiate if we get one.

Add support for CocoaPods

Would be great with support for CocoaPods as well.

https://guides.cocoapods.org/making/index.html

Finalize state value for webview authorization flow

Move MSALClientInfo to common core

AAD v1 will now also return client info. We can move the MSALClientInfo class to the common core.

Broker scenarios for Webviews

Refactor MSIDAADEndpointProviding

Move out drs discovery endpoint from here, because it's ADFS and not AAD specific.
Endpoint providing should apply also to basic Oauth2 flow, not only to AAD (e.g. we should be able to find an authorize endpoint or openid config for Google).

Refactor error codes

Create a shared constants file

There're lots of constants that are duplicated between ADAL and MSAL. Going forward, all the constants that are the same, should be in the common core.

Add telemetry to embedded webviews

If statement checks same property twice

microsoft-authentication-library-common-for-objc/IdentityCore/src/MSIDAccount.m

Line 247 in 18cb916

if (self.uid && self.uid)

Revisit MSIDLegacyTokenCacheKey

Currently MSIDLegacyTokenCacheKey needs to encode authority, resource etc, so it needs to parse those out of account, service properties. Revisit this logic.

Use MSIDAuthority instance instead of NSURL for authority

Instead of passing authority as NSURL, developer should create instance of MSIDAuthority and provide authority endpoint together with authority type to it.

Fix MSIDLogger EXC_BAD_INSTRUCTION crash

Because MSIDLogger is not thread safe, it crashes during the tests. Run the following UT to reproduce the issue:

• (void)test_logger
  {
  while (true) {
  dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0), ^ {
  MSID_LOG_WARN(nil, @"BG thread");
  });

    MSID_LOG_WARN(nil, @"Main thread");
  

  }
  }

MSIDWebMSAuthResponse error cases

For broker, need to check UPN, for clients, applink check is needed.

Discuss json serialization approach (MSIDJsonSerializable vs MSIDJsonObject)

See context here: #48

Create a common keychain token cache API

Going forward we should refactor the keychain token cache to be generic enough to handle both ADAL and MSAL and operate on keys and values. Token cache should be responsible for accessing the cache storage and performing reading and writing of tokens for that storage (in that case keychain storage).

This should include designing the actual API and keeping stub implementations.

Broker request should determine username better

In interactive flow, see if using upn from the response of msauth://wpj?upn=...&applink=... be better than username from request parameter

Move utils to common core

Currently we have lots of utils that are same between ADAL and MSAL:

e.g. Base64 url encoding/decoding
checking if string is empty or nil
string manipulation (e.g. string trimming)
sha256 computation

Because token cache and lots of ADAL/MSAL code uses those utils, we should move them to common core to be reusable.

Move Logger to common core

Logger implementations and macros are already the same between ADAL and MSAL. We can now just move them to the common core.

Add json serialization to MSIDTokenCacheKey

Currently it can serialize/deserialize to NSData via NSArchiver. We might need to add json serialization as well.

Dictionary extensions methods not handling key without value

Improve MSID -> MSAL error conversion

Current error conversion is very error prone, if developer forgets to convert error in MSAL or ADAL

Instead, convert error when creating in in MSID space to avoid developer forgetting to convert it

This can be achieved if MSID creates "error delegate" that it calls before returning the final error. ADAL and MSAL would implement it and return appropriate error.

Remove 'resource', 'clientId', 'authority' from MSIDTokenCacheKey

Remove 'resource', 'clientId', 'authority' from MSIDTokenCacheKey and parse them from 'service' instead;

+ (MSIDTokenCacheKey *)keyWithAuthority:(NSURL *)authority
                               clientId:(NSString *)clientId
                               resource:(NSString *)resource
                                    upn:(NSString *)upn
{
    MSIDTokenCacheKey *key = [[MSIDTokenCacheKey alloc] initWithAccount:upn
                                                                service:[self.class serviceWithAuthority:authority
                                                                                                resource:resource
                                                                                                clientId:clientId]
                                                                   type:nil];
    
    key.authority = authority;
    key.clientId = clientId;
    key.resource = resource;
    
    return key;
}

+ (NSString *)serviceWithAuthority:(NSURL *)authority
                          resource:(NSString *)resource
                          clientId:(NSString *)clientId
{
    
    return [NSString stringWithFormat:@"%@|%@|%@|%@",
            s_adalLibraryString,
            authority.absoluteString.msidBase64UrlEncode,
            [self.class getAttributeName:resource.msidBase64UrlEncode],
            clientId.msidBase64UrlEncode];
}

Move out metadata parsing logic from MSIDAadAuthorityCache to MSIDAADAuthorityMetadataResponseSerializer

Investigate possible memory leaking of NSDictionary when it is used in MSIDMacTokenCache

// Using the dictionary @{ key : value } syntax here causes _cache to leak. Yay legacy runtime!
NSDictionary *wrapper = [NSDictionary dictionaryWithObjectsAndKeys:cacheCopy, @"tokenCache",@CURRENT_WRAPPER_CACHE_VERSION, @"version", nil];

Rename MSIDDeviceId class

MSIDDeviceId class has multiple things in it, consider renaming or splitting this class. Also synchronize the method names.

Allow to save tokens in cache without Account

Consider the following flow:

We get list of ATs, using api like 'getAllTokensOfType:withClientId:context:error', after we set expireOn to current date and we wanna save tokens back to the cache.

Add client TLS handling to the network stack

Improve Spinner dismissing for challenge handling

Currently for embedded webview, we dismiss the loading spinner in the following delegate callback:

• webView:didFinishNavigation:
• webView:didFailNavigation:withError:
• webView:didFailProvisionalNavigation:withError:

However, depending on server behavior, a page may or may not continue to load if we reject a auth challenge, say client TLS challenge.
If a page continues to load, the spinner will be dismissed by hitting any of the above delegate callbacks;
If a page does not continue to load, the spinner will not be dismissed.

We could try to figure out whether there is a way to improve the experience.

PKeyAuth in silent request

Some logic might need to be added to MSIDAADRequestErrorHandler.m, to replicate the behavior here: https://github.com/AzureAD/azure-activedirectory-library-for-objc/blob/dev/ADAL/src/request/ADWebAuthResponse.m#L240

Logger interface - revisit context

We use context to get correlationID and logcomponents.
Discussion point here is to decide whether or not we want to pass in the context object vs passing in 2 strings, namely correlationId and log components.

Decoupling of stringify and hashing

In NSString+MSIDExtensions, should we return a hex string or base64 encoding?

Discuss using of macroses and possible ways to get rid of them

Fix codecov on static libs built into xctest bundles

In the past we've built and tested a dynamic library and tested that, however with a static library the executable being tested is the xctest binary itself. This means we need to change what binary is fed into llvm-cov and provide it a set of source files to filter on.

llvm-cov report [options] -instr-profile PROFILE BIN [-object BIN,...] [[-object BIN]] [SOURCES]

There currently is a bug in llvm-cov that prevents the SOURCES from being respected, but it's been fixed and will eventually get folded into an xcode release: https://bugs.llvm.org/show_bug.cgi?id=34275

Add this to the target specifier in build.py

		"codecov_sources" : "IdentityCore/src",
		"codecov_use_test_binary" : True,

prefix in extension classes

such as nsdictionary extension, does not have msid prefix.

Improve NTLM Dialog for Mac

Currently the NTLM dialog implementation for Mac has some hard-coded X/Y coordinates.
Probably we want to figure out a better way to construct the dialog. NSStackView, NSAlert, or something else....

keychain API - remove revisit

Currently, there is a single remove API,
removeItemsWithKey:
which if key is nil, deletes everything.
This could create confusion down the road.

As a reference, ADAL when given nil key, does not remove anything.

Not sure which is correct, but surely needs to be discussed and make it coherent.

Revise MSIDOauth2Factory

Decide if we need to move out logic that is not related to json parsing from this class. In particular, these methods:

@property (readonly) MSIDWebviewFactory *webviewFactory;
- (NSString *)cacheEnvironmentFromEnvironment:(NSString *)originalEnvironment context:(id<MSIDRequestContext>)context;
- (NSArray<NSString *> *)defaultCacheAliasesForEnvironment:(NSString *)originalEnvironment;

Cover using of authority aliases in default cache with UT/IT

Create a shared telemetry implementation

Because both ADAL and MSAL token caches have telemetry around them, it will be tricky to implement common cache without bringing telemetry to common.

As part of the unified cache work we should minimize the amount of telemetry work, but the telemetry around cache should be common.

Refactor (and rename) MSIDTokenSerializer

MSIDTokenSerializer should be able to ser/deser any class type, not only MSIDToken.

Reuse URL session.

Current design creates session per request.
Let's design such that we have a queue for a session that we can reuse for all our tasks.