microsoft-authentication-library-for-android icon indicating copy to clipboard operation
microsoft-authentication-library-for-android copied to clipboard

If BrokerActivity destroyed, account chooser activity can spin indefinitely

Open codylund opened this issue 3 years ago • 0 comments

Describe the bug BrokerActivity is not robust to the Activity.onDestroy() lifecycle event which the system may trigger at arbitrary times while BrokerActivity is in the background to temporarily preserve system resources. Contrary to the current assumptions in BrokerActivity, onDestroy() may be called while the interactive authentication session is in a healthy state. Rather than continue waiting for an auth result from the broker, BrokerActivity assumes the session is unhealthy and terminates with an error. This can leave any MSAL activities started on top of BrokerActivity in an unstable state.

In my own local repros, I have observed this to result in an infinite spinner on the account picker screen. From our app's perspective, we have received an error result, but our activity never resumes because the user is stuck on an infinite spinner on the account picker screen.

Smartphone (please complete the following information):

  • Device: Pixel 4 XL
  • Android Version: 12
  • Brokered auth with CP
  • MSAL Version: 3.0.2

To Reproduce Unfortunately, there is no straightforward repro for this issue and it occurs intermittently. It does not repro with "Don't keep activities" turned on, because this repro requires that only the BrokerActivity is destroyed. It may be possible to replicate this in an Espresso test environment, however.

Expected behavior BrokerActivity is resilient to system-triggered onDestroy() invocations and the interactive auth session does not deadlock on infinite spinner.

Actual Behavior If BrokerActivity is destroyed while doing interactive auth, the user can become stuck on the account chooser activity's infinite spinner.

codylund avatar May 27 '22 17:05 codylund