Edge TB: changes related to GetToken, Fixes AB#3317102 #2803

melissaahn · 2025-11-04T12:16:33Z

Summary

Broker PR: https://github.com/AzureAD/ad-accounts-for-android/pull/3267

Changes related to WebApps getToken are done in this PR, and it also notably contains refactoring (such as moving some files from broker to common) and some additions to core classes such as AccountChooser and AccountChooserActivity.

To optimize the number of IPCs and repeated code, the sub operations will be completed as follows:

Caller calls BrokerMsalController.ExecuteWebAppsRequest.
BrokerMsalController takes a peek at the request.
- If it is a GetCookies or SignOut request, we will go ahead and call the usual methods to call the ExecuteWebAppsRequestOperation, which will assign the WebAppsGetCookiesSubOperation and WebAppsSignOutSubOperation.
- If it is GetToken request, we need to deserialize the entire request into a GetToken request object.
  - If we determine that we should force interactive for this request right away:
    1a. we will form the BrokerInteractiveTokenParameters needed and call the BrokerMsalController.acquireTokenInternal method. The parameters will have the BrokerRequestType set to WEB_APPS, and that will serve as a flag to show that this is a WEB_APP flow.
    2a. Eventually, AccountChooserActivity is going to receive these parameters. It is aware that this is a WEB_APP flow because of that flag.
    3a. acquireTokenInternal proceeds as usual. Regardless if it is successful or not, AccountChooser will pass back a custom response to BrokerMsalController already in the protocol format.
    4a. BrokerMSALController will return this response back as-is.
  - If we should first try silent:
    1b. We will call the methods to get to ExecuteWebAppsRequestOperation, which will assign WebAppsGetTokenSubOperation.
    2b. GetTokenSubOperation will preprocess and check for errors. If all is good, it will call SdkOperation.acquireTokenSilent with the necessary parameters.
    3b. If successful, it will send back the expected token response string (the same sort of response which will be sent by AccountChooser). If not, it will send back an error response string.
    4b. If we receive the token response, BrokerMsalController will return the string response as-is. If we receive an error, BrokerMsalController now needs to decide from the initial request if we should fall back to interactive or return an error. In the interactive case, we will run the logic to start an interactive request.

If I try to put this more succinctly:

GetCookies and SignOut requests will be taken care of by their respective custom SubOperations.
A GetToken interactive request will be taken care of by BrokerMsalController; custom logic was added to the existing AccountChooserActivity to detect the webapp request and return a custom value.
A GetToken silent request will be taken care of by its respective custom SubOperation. If this SubOperation returns an error, an interactive request will occur, if possible.

AB#3317102

…poseWebApis Dev

dev

…pers dev

github-actions · 2025-11-04T12:16:50Z

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java

…pers dev

melissaahn · 2025-11-18T19:05:25Z

common/src/main/java/com/microsoft/identity/common/adal/internal/AuthenticationConstants.java

         * String for broker webapps get contracts result.
         */
-        public static final String BROKER_WEBAPPS_GET_CONTRACTS_RESULT = "contracts";
+        public static final String BROKER_WEBAPPS_GET_CONTRACTS_RESULT = "web_apps_contracts";


Just making these values more specific

melissaahn · 2025-11-18T19:10:16Z

common/src/main/java/com/microsoft/identity/common/internal/broker/BrokerRequest.java

+     */
+    @Nullable
+    @SerializedName(SerializedNames.WEB_APPS_STATE)
+    private String mWebAppsState;


To allow AccountChooserActivity to return a result as a string we can return directly to the caller (without BrokerMsalController interfering too much), we pass the state webapp parameter so that AccountChooserActivity can include it in the result.
I think this is also the more correct approach vs BrkerMsalController injecting it at the end, as the state parameter should be included at the time when the token result is getting created.

melissaahn · 2025-11-18T19:12:36Z

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java

        final String methodTag = TAG + ":acquireToken";
+        final AcquireTokenResult result;
+        try {
+            final Bundle resultBundle = acquireTokenInternal(parameters);


I factored out logic into acquireTokenInternal in order to allow executeWebAppsRequest to reuse interactive request logic and get the custom webapp result directly from the bundle. The acquireToken method is not changed otherwise.

melissaahn · 2025-11-18T19:15:12Z

common/src/main/java/com/microsoft/identity/common/internal/util/WebAppsUtil.kt

@@ -0,0 +1,180 @@
+// Copyright (c) Microsoft Corporation.


One of the classes moved from broker to common.

melissaahn · 2025-11-18T19:23:56Z

common4j/src/main/com/microsoft/identity/common/java/commands/webapps/MatsProperties.kt

+ * Note: This class isn't going to be used until the design for the MATS blob is complete.
+ * Once that is complete, we will need to pass this data for each error object and getToken suboperation.
+ */
+data class MatsProperties(


This is being created for the future when the design for the MatsProperties schema is complete.

Copilot

Pull Request Overview

Copilot reviewed 37 out of 37 changed files in this pull request and generated 19 comments.

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java

...4j/src/main/com/microsoft/identity/common/java/commands/webapps/WebAppsSupportedContracts.kt

common/src/main/java/com/microsoft/identity/common/internal/result/MsalBrokerResultAdapter.java

common4j/src/main/com/microsoft/identity/common/java/util/IPlatformUtil.java

...c/main/com/microsoft/identity/common/java/providers/oauth2/OpenIdConnectPromptParameter.java

common/src/main/java/com/microsoft/identity/common/internal/util/WebAppsUtil.kt

...in/com/microsoft/identity/common/java/commands/webapps/WebAppsGetTokenSubOperationRequest.kt

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java

mohitc1 · 2025-11-25T19:15:43Z

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java

+                }
+            } else {
+                envelope = null;
+            }


nit: just initialize with null

I think though since it's being used in an inner method, if I were to get rid of this else clasue and just init in the beginning with no final, that would not be allowed?

mohitc1 · 2025-11-25T19:18:49Z

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java

+                            if (resultBundle.containsKey(BROKER_WEB_APPS_ERROR_RESULT)
+                                    && envelope != null) {
+                                final WebAppsGetTokenSubOperationRequest getTokenRequest = envelope.getRequest();
+                                if (canFallbackToInteractiveRequestForWebApp(getTokenRequest, additionalRequiredParams.getCanShowUi())) {


should all errors fallback to interactive? In normal AT/ATS it's invalid_grant and interaction_required

I am double checking with the iOS folks as to how it's being done on their side.

…pers dev

melissaahn added 28 commits October 17, 2025 10:07

start

21c3ed2

cleaning up

1276de7

changelog

cf872e1

suggestion

1378c50

exposing api

8f04dd0

reentrant readwrite lock

addd84a

removing cache

3672ba1

changed structure

075440c

unused imports

f813536

renames

6e5b3c3

Merge branch 'melissaahn/WebAppsAccountIdRegistry' into melissaahn/Ex…

456e0d5

…poseWebApis Dev

Merge remote-tracking branch 'origin/dev' into melissaahn/ExposeWebApis

c7cb41d

dev

min version

935091d

addressing comments

3eae88b

changelog

b53404d

changelog

6fbaa31

Merge remote-tracking branch 'origin/dev' into melissaahn/ExposeWebApis

34d9d6f

dev

dev

7b2876d

dev

84ea614

Merge branch 'dev' into melissaahn/ExposeWebApis

17b851a

Merge remote-tracking branch 'origin/dev' into melissaahn/ExposeWebApis

262e689

dev

saving progress

a763095

saving progress

19e573f

saving progress again

8a1d9ff

clean up

27f6cf2

Merge remote-tracking branch 'origin/dev' into melissaahn/GetTokenHel…

827d081

…pers dev

removed

7f0003d

more

94338cd

melissaahn requested a review from Copilot November 4, 2025 12:16

fadidurah reviewed Nov 6, 2025

View reviewed changes

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java Outdated Show resolved Hide resolved

fadidurah approved these changes Nov 6, 2025

View reviewed changes

melissaahn added 7 commits November 7, 2025 10:18

moving files around

7f362b5

dev

a98544a

big refactor

391eab5

Merge remote-tracking branch 'origin/dev' into melissaahn/GetTokenHel…

3c3b36d

…pers dev

edits

191ad5b

testing

629b232

edits

1a6dfba

melissaahn commented Nov 18, 2025

View reviewed changes

melissaahn added 2 commits November 18, 2025 11:26

comments

dc07634

dev

5c2484b

melissaahn requested a review from Copilot November 18, 2025 19:30

Copilot started reviewing on behalf of melissaahn November 18, 2025 19:31 View session

Copilot finished reviewing on behalf of melissaahn November 18, 2025 19:33

Copilot AI reviewed Nov 18, 2025

View reviewed changes

melissaahn added 4 commits November 18, 2025 12:23

comments

42061ce

updated test

a212d9f

catch

1f42ada

two more tests

e3c2f5a

mohitc1 reviewed Nov 25, 2025

View reviewed changes

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java Outdated Show resolved Hide resolved

mohitc1 reviewed Nov 25, 2025

View reviewed changes

...n/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java Outdated Show resolved Hide resolved

mohitc1 reviewed Nov 25, 2025

View reviewed changes

melissaahn added 2 commits December 2, 2025 17:24

Merge remote-tracking branch 'origin/dev' into melissaahn/GetTokenHel…

3c88be3

…pers dev

addressing some comments

f8fbdf8

Edge TB: changes related to GetToken, Fixes AB#3317102 #2803

Are you sure you want to change the base?

Edge TB: changes related to GetToken, Fixes AB#3317102 #2803

Uh oh!

Conversation

melissaahn commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

github-actions bot commented Nov 4, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mohitc1 Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

melissaahn commented Nov 4, 2025 •

edited

Loading

mohitc1 Nov 25, 2025 •

edited

Loading