search

microsoftconnect / ms-intune-app-sdk-android

Intune App SDK for Android enables data protection features and mobile app management via Microsoft Intune
44 stars 18 forks source link

Unable enforce Policy. AUTHORIZATION_NEEDED Error is thrown #243

Open rassackak opened 1 month ago

rassackak commented 1 month ago

Intune Android App SDK Policy Enforcement Issue

Questions to Ask Before Submission

  1. Have you completed the exit criteria for each phase in the Intune App SDK for Android Integration Guide? - Yes
  2. Have you checked the Microsoft Intune App SDK for Android repository for similar issues? - Yes
  3. Are you using the latest version of the SDK? - Yes

Summary

I'm Followed all the steps from the document. After MSAL acquireToken call I' getting MsalIntuneAppProtectionPolicyRequiredException. But after calling remediateCompliance(), I'm getting AUTHORIZATION_NEEDED in MAMEnrollmentNotification.

In tried with the sample application as well. But, Same issue happens

Logs

com.microsoft.identity.client.exception.MsalUiRequiredException: no account found for ad9fe314-1e14-4161-b118-7b2f00503ed7 at com.microsoft.intune.samples.taskr.authentication.MSALUtil.acquireTokenSilentSync(MSALUtil.java:148) at com.microsoft.intune.samples.taskr.authentication.AuthenticationCallback.acquireToken(AuthenticationCallback.java:38) at java.lang.reflect.Method.invoke(Native Method) at o.forCodedOutput$cancelAll.invoke(:84) at java.lang.reflect.Proxy.invoke(Proxy.java:1006) at $Proxy13.acquireToken(Unknown Source) at com.microsoft.intune.mam.policy.AbstractEnrollmentManager$1.acquireToken(:93) at com.microsoft.intune.mam.policy.AbstractEnrollmentManager$2.acquireToken(:109) at com.microsoft.intune.mam.policy.MAMEnrollmentManagerImpl$StrictAuthenticationCallbackWrapper.acquireToken(:221) at com.microsoft.intune.mam.client.app.AuthCallbackUtils.acquireMAMServiceToken(:48) at com.microsoft.intune.mam.client.ipcclient.OnlineAuthCallbackUtils.acquireMAMServiceTokenWithTelemetry(:56) at com.microsoft.intune.mam.policy.MAMEnrollmentManagerImpl.lambda$attemptMamEnrollment$2(:770) at com.microsoft.intune.mam.policy.MAMEnrollmentManagerImpl.$r8$lambda$WM6rw15dJ2GWTLxdrifJqhGCseM(:0) at com.microsoft.intune.mam.policy.MAMEnrollmentManagerImpl$$ExternalSyntheticLambda3.run(:0) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:644) at java.lang.Thread.run(Thread.java:1012)

Company Portal Logs

Incident ID: 3GBNS2JX

kanishkaBagga commented 1 month ago

I am looking into this

kanishkaBagga commented 3 weeks ago

@rassackak - could you please share the package name

rassackak commented 3 weeks ago

@rassackak - could you please share the package name

package name is com.morohub.smartoffice.

Update: When I tried in a new device(custom app and company portal installed for the first time) it is working for one user. When I try to login to a different user the same error is thrown.

kanishkaBagga commented 3 weeks ago

@rassackak The error com.microsoft.identity.client.exception.MsalUiRequiredException: no account found for ad9fe314-1e14-4161-b118-7b2f00503ed7 indicates that the Microsoft Authentication Library (MSAL) could not find an account with the specified ID. This exception typically occurs when a silent token acquisition attempt is made, but no account is found in the token cache that matches the provided account ID.

Here are some key points from the stack trace:

MSALUtil.acquireTokenSilentSync: The error occurs in the acquireTokenSilentSync method of the MSALUtil class. This method attempts to acquire a token silently (without user interaction) using the cached account information. AuthenticationCallback.acquireToken: The acquireToken method in the AuthenticationCallback class is invoked, which likely calls the acquireTokenSilentSync method. MAM Enrollment: The error is related to the Microsoft Intune Mobile Application Management (MAM) enrollment process. The MAMEnrollmentManagerImpl class attempts to acquire a MAM service token using the AuthCallbackUtils and OnlineAuthCallbackUtils classes.

To resolve this issue, you can take the following steps:

Ensure that the account with the specified ID (ad9fe314-1e14-4161-b118-7b2f00503ed7) is present in the token cache. If the account is not found, you may need to prompt the user to sign in again to add the account to the cache i.e. If the silent token acquisition fails, you can fall back to an interactive token acquisition method. This will prompt the user to sign in and obtain a new token. If the token cache is corrupted or contains stale data, clearing the token cache and prompting the user to sign in again can help resolve the issue. Verify that the MSAL configuration (such as client ID, redirect URI, and authority) is correct and matches the settings in the Azure portal.

rassackak commented 3 weeks ago

@kanishkaBagga I have tried the same user with (ID ad9fe314-1e14-4161-b118-7b2f00503ed7) in a different device. And it is working fine. I'm getting the token and MAM Policy is applied successfully. But, as I mentioned earlier, I'm unable to login another user in the same device.

I'm using a account_mode= SINGLE as my app requires only once user to be logged In at a time. I'm calling the signout method provided. Still I'm unable to login to a different account in the same device.

kanishkaBagga commented 3 weeks ago

@rassackak - is this issue specific to this user on all devices?

rassackak commented 3 weeks ago

@kanishkaBagga It is not specific to a user. It happens when a user try to login to a device where another user is logged in and applied the MAM policies. As I mentioned earlier, it works when we try to login for the first. Also it works when I go to device settings and delete the account added to accounts section.

kanishkaBagga commented 4 days ago

did you try this?

To resolve this issue, you can take the following steps:

Ensure that the account with the specified ID (ad9fe314-1e14-4161-b118-7b2f00503ed7) is present in the token cache. If the account is not found, you may need to prompt the user to sign in again to add the account to the cache i.e. If the silent token acquisition fails, you can fall back to an interactive token acquisition method. This will prompt the user to sign in and obtain a new token. If the token cache is corrupted or contains stale data, clearing the token cache and prompting the user to sign in again can help resolve the issue. Verify that the MSAL configuration (such as client ID, redirect URI, and authority) is correct and matches the settings in the Azure portal.