microsoft-authentication-library-for-android
microsoft-authentication-library-for-android copied to clipboard
Nonce not present on JTW if user has Microsoft Authenticator app installed
Describe the bug Is your app live and in production or is this a development issue? Provide a clear and concise description of what the bug is.
Smartphone (please complete the following information):
- Device: Pixel 6 Pro
- Android Version: Android 14
- MSAL Version: 4.9.0
To Reproduce We're using the following call to authenticate:
PublicClientApplication.createSingleAccountPublicClientApplication(this, R.raw.auth_config_single_account).acquireToken(
AcquireTokenParameters
.Builder()
.withPrompt(SELECT_ACCOUNT)
.withAuthorizationQueryStringParameters(listOf(SimpleEntry("nonce", nonce)))
.withScopes(listOf(EMAIL_SCOPE))
.startAuthorizationFromActivity(activity)
.withCallback(object : AuthenticationCallback {
override fun onSuccess(authenticationResult: IAuthenticationResult) {
continuation.resume(authenticationResult.account.idToken!!)
}
override fun onError(exception: MsalException) {
continuation.resumeWithException(exception)
}
override fun onCancel() {
continuation.cancel()
}
})
.build()
)
But if the user has the Microsoft Authenticator app installed on the same phone as the generated token doesn't contain the nonce that we pass on .withAuthorizationQueryStringParameters(listOf(SimpleEntry("nonce", nonce))). If the user doesn't have the Microsoft Authenticator the login is done in an Chrome Custom Tab and the token will have the nonce as expected.