Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nonce not present on JTW if user has Microsoft Authenticator app installed #1951

Open
gmarques33 opened this issue Nov 14, 2023 · 0 comments
Assignees

Comments

@gmarques33
Copy link

Describe the bug
Is your app live and in production or is this a development issue? Provide a clear and concise description of what the bug is.

Smartphone (please complete the following information):

  • Device: Pixel 6 Pro
  • Android Version: Android 14
  • MSAL Version: 4.9.0

To Reproduce
We're using the following call to authenticate:

PublicClientApplication.createSingleAccountPublicClientApplication(this, R.raw.auth_config_single_account).acquireToken(
  AcquireTokenParameters
    .Builder()
    .withPrompt(SELECT_ACCOUNT)
    .withAuthorizationQueryStringParameters(listOf(SimpleEntry("nonce", nonce)))
    .withScopes(listOf(EMAIL_SCOPE))
    .startAuthorizationFromActivity(activity)
    .withCallback(object : AuthenticationCallback {
      override fun onSuccess(authenticationResult: IAuthenticationResult) {
        continuation.resume(authenticationResult.account.idToken!!)
      }

      override fun onError(exception: MsalException) {
        continuation.resumeWithException(exception)
      }

      override fun onCancel() {
        continuation.cancel()
      }
    })
    .build()
)

But if the user has the Microsoft Authenticator app installed on the same phone as the generated token doesn't contain the nonce that we pass on .withAuthorizationQueryStringParameters(listOf(SimpleEntry("nonce", nonce))). If the user doesn't have the Microsoft Authenticator the login is done in an Chrome Custom Tab and the token will have the nonce as expected.

@negoe negoe self-assigned this Dec 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants