The library uses wrong authority when the authority url in the app changes

[vandac]

Describe the bug Two scenarios:

1. A freshly installed app with a custom authority url uses the default authority during authentication
2. a) When the app is installed on the device using a given authority url, the activation works correctly. b) When the authority url in the app is changed to a custom authority url, the web agent falls back to using the default authority url, which can't authenticate users under our organization. The same happens when the user is signed out between 2.a) and 2.b)

Smartphone (please complete the following information):

• Device: Any device
• Android Version: Tested on Android 10
• Browser: Chrome
• MSAL Version 1.5.1 & 1.5.4

I built a custom build to be able to see what authorisation url the library takes and it seemed to take the authority url correctly. However, the UI failed to authenticate the user and showed a wrong organization logo (Microsoft logo instead of custom logo).

I modified PublicClientApplicationConfigurationFactory as follows just to get logs:

@VisibleForTesting @WorkerThread static PublicClientApplicationConfiguration loadConfiguration(@NonNull final Context context, final int configResourceId) { Log.i("WAN", "Loading config file from" + configResourceId); final InputStream configStream = context.getResources().openRawResource(configResourceId); Log.i("WAN", "configStream:" + configStream); boolean useDefaultConfigResourceId = configResourceId == R.raw.msal_default_config; Log.i("WAN", "use default config?" + useDefaultConfigResourceId); return loadConfiguration(configStream, useDefaultConfigResourceId); }

From logs: 2020-07-15 16:20:42.075 4139-4234/com.wandera.android.debug I/WAN: Initializing configuration 2020-07-15 16:20:42.075 4139-4234/com.wandera.android.debug I/WAN: Loading config file from2131755009 2020-07-15 16:20:42.076 4139-4234/com.wandera.android.debug I/WAN: configStream:android.content.res.AssetManager$AssetInputStream@7e470e7 2020-07-15 16:20:42.076 4139-4234/com.wandera.android.debug I/WAN: use default config?false 2020-07-15 16:20:42.076 4139-4234/com.wandera.android.debug I/WAN: config:{ "client_id" : "12345", "authorization_user_agent" : "DEFAULT", "redirect_uri" : "msauth://com.wandera.android.debug/xxx", "account_mode" : "SINGLE", "broker_redirect_uri_registered": true, "authorities" : [ { "type": "AAD", "authority_url": "https://login.microsoftonline.com/customTenant1.onmicrosoft.com" } ] }

This proves that the library correctly loads the config file from our app and merges the dev config authority url with the default config, but it is then lost somewhere in the next steps.

Expected screen to see after any authentication prompt: But the screen showing up is:

It gets fixed after a couple of application kills and reopenings, but it is very random. It resembles a race condition somewhere in the library, because every time I debug the code, the issue never occurs.

[vandac]

This must have been caused in version 1.5.0. It is not reproducible with version 1.4.1

[shoatman]

@vandac - Would you mind sharing you configuration with us. I observed a bug similar to this one with the sample app today. The configuration for an app that's intended to be used by only one organization should look like this:

"authorities" : [ { "type": "AAD", "audience": { "type": "AzureADMyOrg", "tenant_id": "" } } ]

[shoatman]

@vandac - Nevermind I saw your configuration above and i believe that what I provided above will fix this.

[vandac]

Thank you, this helped us and it is working fine now, even with the newest library. I was blinded by the "race condition" and thought at first that it worked in 1.4.1 but it was just pure luck. Now it works without problems. For reference, could you point me to a documentation, if there is one, where we could have found the config?

[shoatman]

https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-configuration

[mattvlas]

@shoatman I think we got the wrong configuration from the MSAL configuration builder in Azure AD > App Registrations. Can you perhaps log an issue with the appropriate team there?

As you can see, the MSAL config being generated doesn't match your suggested configuration for a single-tenant app:

[shoatman]

@mattvlas - Will do. @hamiltonha - Is this something you can help us with?