search

AzureAD / microsoft-authentication-library-for-js

Microsoft Authentication Library (MSAL) for JS
http://aka.ms/aadv2
MIT License
3.68k stars 2.65k forks source link

Angular 15 support #5410

Closed jerone closed 1 year ago

jerone commented 1 year ago

Core Library

MSAL.js v2 (@azure/msal-browser)

Core Library Version

Latest

Wrapper Library

MSAL Angular (@azure/msal-angular)

Wrapper Library Version

Latest

Public or Confidential Client?

Public

Description

Will MSAL support Angular 15.

MSAL Configuration

No response

Relevant Code Snippets

No response

Identity Provider

No response

Source

External (Customer)

YanerTavuz commented 1 year ago

i think that since Ivy is required in Angular v15, then this is connected to https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/4298 maybe?

sameerag commented 1 year ago

@jerone We are in the process of adding Angular 15 support. We have started tracking it internally and someone will start looking into this actively soon. I do not have a specific ETA yet but will be prioritized as soon as we can. cc @EmLauber

peterzenz commented 1 year ago

Assigning to @EmLauber for tracking. This should get picked up in Q1 2023.

aylmercarson commented 1 year ago

stopped me dead in my tracks after promoting azure B2C and Angular. hard to believe that MS can't/won't keep up with the NG release cycle given the HUGE number of corporate integrations there are.

ghost commented 1 year ago

@jerone This issue has been automatically marked as stale because it is marked as requiring author feedback but has not had any activity for 5 days. If your issue has been resolved please let us know by closing the issue. If your issue has not been resolved please leave a comment to keep this open. It will be closed automatically in 7 days if it remains stale.

jerone commented 1 year ago

Still relevant!

kauppfbi commented 1 year ago

@tnorling @peterzenz @EmLauber,

could you please provide some transparency and share your thoughts and plans on this topic? I assume for many enterprises, this is a major blocker right now. In our case, the @azure/msal-angular package is the last one, which is shipped with ViewEngine. It not only blocks us from updating to v15, it also prevents us from using pnpm with recommended settings.

It seems like effort and help from the community is not really requested/appreciated. So I would at least be interested in your timeline or maybe there are some dependencies to other topics, which the community is not aware of. Should I be wrong and you would appreciate the help of the community on this topic, just tell us. I guess there are many devs - including me - who are happy to help.

Thank you very much for your efforts.

tnorling commented 1 year ago

@kauppfbi I apologize if anyone gave the impression that we do not appreciate external contributions, that could not be further from the truth. We would love to see more community engagement and would welcome PRs that will help unblock your scenarios. To set expectations, however, just because someone opens a PR doesn't mean that it will be accepted. There are many things that we need to consider and keep in mind, especially when it may involve breaking changes. We commit to reviewing all PRs and providing feedback and if the author is able to address that feedback we will be delighted to merge it.

As for a timeline, Peter did share one above

gaweCodes commented 1 year ago

Our projects are also blocked. It would be great to have a solution asap. Can someone please provide an update on the release date for this issue? Thank you.

EmLauber commented 1 year ago

The timeline is the same as above. We have this on our roadmap to get picked up in Q1 2023.

aylmercarson commented 1 year ago

from the docs: "At a minimum, @azure/msal-angular will follow the support schedule of the main Angular project."

angular 15 was released 2 months ago at the date of writing this. i am beginning to wonder if the birth of blazor as a competing technology is affecting the willingness of ms to keep to its word and keep up with the angular release cycle?

jerone commented 1 year ago

Also, be aware that v16.0 is already planned for week of 2023-05-01. Please, please, please put support for v16.0 on your roadmap, so you and us can prevent this kind of frustrations. 🙏🙏🙏

gaweCodes commented 1 year ago

It's really tedious. Many Angular apps have dependencies on small npm packages. The community or the developers behind these small packages often have more will to keep up with the Angular release cycle than the big players like here. I don't know why this has to take so long. By the way: A release in Q1 2023 is not really a date. I would like to know if it is still coming in January or at the end of March?

DanielRose commented 1 year ago

The timeline is the same as above. We have this on our roadmap to get picked up in Q1 2023.

That is not even a promise of a release in Q1 2023, just that someone will start looking at it in Q1 2023. In other words, there is no assurance at all of when this might be released.

Angular 9, which contained the rollout of Ivy, was released on February 2020. The opt-in preview was already in the beta of June 2019. The official deprecation was in Angular 12, released May 2021 (which included the message "Now that View Engine is deprecated, it will be removed in a future major release").

This is something which was a very long time coming, and I don't understand how this was apparently forgotten or at least not given any priority.

EmLauber commented 1 year ago

Thank you to everyone for your feedback on this. I recognize MSAL's support of Angular 15 delays your own efforts of updating to Angular 15. We do take this feedback seriously and are discussing internally how better to prioritize this customer need in the future.

To some of the specific comments:

coming in January

I have no updates on a specific release date, but it won't be coming in January.

blazor as a competing technology

Blazor's development is exciting, but not related to MSAL.browser's prioritization. These two projects release on independent schedules.

put support for v16.0 on your roadmap

Thank you for the feedback. We are tracking the v16 Angular release schedule. I don't have a specific release date for MSAL.browser's support for v16, but we are aware of it.

sandrooco commented 1 year ago

@EmLauber I (and probably a lot of other people) appreciate the bits of communication you provided in the last weeks. Respectfully, I'm wondering what causes this massive delay? Can you elaborate for us?

You might ask why everyone is unpleased (...) with the current situation. A few inputs from the community's perspective: the technology the community wants support for has been around for quite some time, the Angular team provided lots of info about migrating and their timeline. Some people provided PRs that provided (at least) baseline support. These weren't merged because it breaks support for Angular version that not even Angular itself supports anymore. If it's possible for me to provide a PR in 4h (including setup for MS' OSS requirements) it seems like one of you could do this easily in 1h. Obviously it's not always that easy - maybe there are actual reasons that the community simply never has heard of.

Thank you for keeping us in the loop.

EmLauber commented 1 year ago

We appreciate the community PRs, but as you called out, they broke previous Angular version support within the MSAL.js library. We have an engineer this quarter actively looking at how best to move forward with adding Angular 15 support while addressing the impact to MSAL customers who may not have upgraded to the latest Angular version yet.

Zettexe commented 1 year ago

This is why you keep separate versions of your package that explicitly support a specific Angular version so that you can safely make breaking changes while keeping a usable version for older Angular versions.

DM-be commented 1 year ago

any update on an ETA? We are also waiting to update to angular 15 on this...

EmLauber commented 1 year ago

We have an engineer working on this issue this quarter and will update here once we have updated ETA.

ZeroGDrive commented 1 year ago

https://github.com/angular/angular-cli/pull/24720

Lonli-Lokli commented 1 year ago

@EmLauber Could you forward this link to the engineer? https://github.com/auth0/auth0-angular/issues/255#issuecomment-1261795471

jerone commented 1 year ago

Time to update the changelog; the "mid-term" is already here.

kauppfbi commented 1 year ago

Angular 16 is in active development. Just mentioning at this stage.

https://github.com/angular/angular/releases/tag/16.0.0-next.0

ThoSap commented 1 year ago

@EmLauber sorry to bug you, do you have an update for us?

EmLauber commented 1 year ago

Our engineer is still working on this. We don't yet have a finalized release date.

ikeppu commented 1 year ago

Our engineer is still working on this. We don't yet have a finalized release date.

Any information about release date ?

YanerTavuz commented 1 year ago

I don't quite understand why people are so stressed about this release. The package owners have explained why it is taking time and still people are not understanding.

Here is my take on the issue:

Currently the package is built for View Engine which supports multiple versions of Angular, however Angular v15+ has dropped this support. So why can't the package owners just change targeting to Angular versions that supports Ivy? Well, because not everybody upgrades their Angular versions, and if the "flow" of the login process changes then older versions of Angular (that only uses View Engine) still needs to be able to use newer versions of this package so they can also use the new flows.

The problem that the package owners/developers are facing is how to maintain two different versions. One that supports View Engine, and one that supports Ivy.

Correct me if I'm wrong 🤓

sandrooco commented 1 year ago

@YanerTavuz "The package owners have explained why it is taking time and still people are not understanding." It's correct, I don't understand. It hasn't been explained though.

Maintaining multiple versions is easy, see Vue and/or Spring for example. They still have security updates for the older 2.x versions but mainly work on 3.x.

YanerTavuz commented 1 year ago

Hmm, well. Now that you explain it like that 😅 @sandrooco
So kind of like keeping old major version for legacy patches and newer major versions for Ivy supported only

Lonli-Lokli commented 1 year ago

I think the main reason is lack of development resources, so can propose 2 options

DanielRose commented 1 year ago

Currently the package is built for View Engine which supports multiple versions of Angular, however Angular v15+ has dropped this support. So why can't the package owners just change targeting to Angular versions that supports Ivy? Well, because not everybody upgrades their Angular versions, and if the "flow" of the login process changes then older versions of Angular (that only uses View Engine) still needs to be able to use newer versions of this package so they can also use the new flows.

The problem that the package owners/developers are facing is how to maintain two different versions. One that supports View Engine, and one that supports Ivy.

Ivy exists since Angular 9, which was released in February 2020. From https://angular.io/guide/releases:

"All major releases are typically supported for 18 months. [...] Angular versions v2 to v12 are no longer under support."

So this shouldn't be a problem.

schmkr commented 1 year ago

Maybe a suggestion if maintenance and versioning is a concern:

Recently Sentry was facing similar challenges. They had/have their @sentry/angular package and do want to keep on releasing that one (with ViewEngine support) with all new features they keep on adding to their product. So they published an entirely new package @sentry/angular-ivy. See https://github.com/getsentry/sentry-javascript/issues/5268#issuecomment-1446489347.

EmLauber commented 1 year ago

I appreciate everyone's engagement and suggestions. The team has been working on a new major MSAL release (v3) which will use the Ivy engine and support Angular 15. This is actively in development. I will update here once released and those interested in Ivy and Angular 15 can update to v3.

jerone commented 1 year ago

@jerone commented on Jan 20, 2023, 10:36 AM GMT+1:

Also, be aware that v16.0 is already planned for week of 2023-05-01. Please, please, please put support for v16.0 on your roadmap, so you and us can prevent this kind of frustrations. 🙏🙏🙏

Less then 1 month away from completely skipping Angular 15 and going straight to version 16.

FYI. this is literally the only package that is keeping our products from upgrading to the latest Angular version.

aylmercarson commented 1 year ago

something about a dead horse and flogging...i gave up on this and went with

https://github.com/damienbod/angular-auth-oidc-client

it's fine and does all i want/need...

rubiesonthesky commented 1 year ago

It's possible also to use general browser package in Angular app. Of course depending on your needs but that is how we are using this library with Angular 15.

https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-browser

stevenruizhang commented 1 year ago

any update on an ETA? We are also waiting when v3 can support ng 15

RichardCutmore commented 1 year ago

Is there any schedule for release?

nelsonmontano commented 1 year ago

Is there any schedule for release?

EmLauber commented 1 year ago

We are targeting an alpha release of v3 this month (April).

sandrooco commented 1 year ago

For those interested, this is the pull request (merged): https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/5753. Not sure about the difference to my (and other) PR. At least this thing is about to land soon.

Alexiafe commented 1 year ago

Any update yet ?

tonycarew commented 1 year ago

We are targeting an alpha release of v3 this month (April).

Can you clarify which April?

eluchsinger commented 1 year ago

So to summarize, Angular 16 is scheduled for release this month and we are still stuck with Angular 14 because of this library due to a bug that was raised in 2021 (#4298).

It looks like the fix is not coming anytime soon, because we are still talking about an (obviously delayed) Alpha, while this library is being used in many production applications. To go from Alpha to a GA release, I again expect months. And because it's bound to a major release v3, I also expect breaking changes, major refactorings and major bugs.

I will start looking for an alternative now.

kauppfbi commented 1 year ago

Actually, Angular 16 will already be released this week.

Edit: https://github.com/angular/angular/releases

EmLauber commented 1 year ago

Can you clarify which April?

Yes the target was April for an alpha release for v3, but we had some unexpected delays push it back. The team is actively working on a release, and I will update here once it is available.

major release v3, I also expect breaking changes, major refactorings and major bugs.

We aimed to keep breaking changes to a minimum for v2 to v3. We have not yet released, but you can see the expected changes here

Angular 16 will already be released this week

We are actively evaluating v3 against Angular 16 and will provide an update here and on the README once we confirm it is compatible.

EmLauber commented 1 year ago

MSAL.Angular v3 alpha with Angular 15 and Ivy support is released: https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-angular-v3.0.0-alpha.0

grosch-intl commented 1 year ago

@EmLauber I keep getting errors about package "" referring to a non-existing file. What should I be putting in my package.json to use this version?

YanerTavuz commented 1 year ago

@grosch-intl If you look at the package in npmjs https://www.npmjs.com/package/@azure/msal-angular/v/3.0.0-alpha.0, you can see that you should add this to package.json "@azure/msal-angular": "3.0.0-alpha.0"