Webview interaction and system webview

IdentityCore/IdentityCore.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>IDEDidComputeMac32BitWarning</key>
+	<true/>
+</dict>
+</plist>

IdentityCore/src/MSIDError.h

@@ -69,9 +69,49 @@ typedef NS_ENUM(NSInteger, MSIDErrorCode)
     MSIDErrorInvalidClient = -51015,
     MSIDErrorInvalidGrant = -51016,
     MSIDErrorInvalidParameter = -51017,
+
+    /*!
+     The user or application failed to authenticate in the interactive flow.
+     Inspect MSALOAuthErrorKey and MSALErrorDescriptionKey in the userInfo
+     dictionary for more detailed information about the specific error.
+     */
+    MSIDErrorAuthorizationFailed = -52018,
+
+    /*!
+     The state returned by the server does not match the state that was sent to
+     the server at the beginning of the authorization attempt.
+     */
+    MSALErrorInvalidState = -52501,
+    /*!
+     Interaction required errors occur because of a wide variety of errors
+     returned by the authentication service.
+     */
+    MSIDErrorMismatchedUser             = -52101,
+    MSIDErrorNoAuthorizationResponse    = -52102,
+    MSIDErrorBadAuthorizationResponse   = -52103,
+
+
+    MSIDErrorUserCancel = -51019,
+    /*!
+     The authentication request was cancelled programmatically.
+     */
+    MSIDErrorSessionCanceled = -51020,
+    /*!
+     An interactive authentication session is already running with the
+     SafariViewController visible. Another authentication session can not be
+     launched yet.
+     */
+    MSIDErrorInteractiveSessionAlreadyRunning = -51021,
+    /*!
+     An interactive authentication session failed to start.
+     */
+    MSIDErrorInteractiveSessionStartFailure = -51022,
+
     MSIDErrorCodeFirst = MSIDErrorInternal,
     MSIDErrorCodeLast = MSIDErrorInvalidParameter
 };
 
 extern NSError *MSIDCreateError(NSString *domain, NSInteger code, NSString *errorDescription, NSString *oauthError, NSString *subError, NSError *underlyingError, NSUUID *correlationId, NSDictionary *additionalUserInfo);
 
+extern MSIDErrorCode MSIDErrorCodeForOAuthError(NSString *oauthError, MSIDErrorCode defaultCode);
+

IdentityCore/src/MSIDError.m

@@ -49,3 +49,20 @@
 }
 
 
+MSIDErrorCode MSIDErrorCodeForOAuthError(NSString *oauthError, MSIDErrorCode defaultCode)
+{
+    if (oauthError && [oauthError caseInsensitiveCompare:@"invalid_request"] == NSOrderedSame)
+    {
+        return MSIDErrorInvalidRequest;
+    }
+    if (oauthError && [oauthError caseInsensitiveCompare:@"invalid_client"] == NSOrderedSame)
+    {
+        return MSIDErrorInvalidClient;
+    }
+    if (oauthError && [oauthError caseInsensitiveCompare:@"invalid_scope"] == NSOrderedSame)
+    {
+        return MSIDErrorInvalidParameter;
+    }
+
+    return defaultCode;
+}

IdentityCore/src/MSIDOAuth2Constants.h

@@ -27,6 +27,7 @@ extern NSString *const MSID_OAUTH2_AUTHORIZATION_CODE;
 extern NSString *const MSID_OAUTH2_AUTHORIZATION_URI;
 extern NSString *const MSID_OAUTH2_AUTHORITY;
 extern NSString *const MSID_OAUTH2_AUTHORIZE_SUFFIX;
+extern NSString *const MSID_OAUTH2_V2_AUTHORIZE_SUFFIX;
 extern NSString *const MSID_OAUTH2_BEARER;
 extern NSString *const MSID_OAUTH2_CLIENT_ID;
 extern NSString *const MSID_OAUTH2_CODE;
@@ -58,6 +59,7 @@ extern NSString *const MSID_OAUTH2_ASSERTION;
 extern NSString *const MSID_OAUTH2_EXPIRES_ON;
 extern NSString *const MSID_OAUTH2_EXT_EXPIRES_IN;
 extern NSString *const MSID_FAMILY_ID;
+extern NSString *const MSID_AUTH_CLOUD_INSTANCE_HOST_NAME;
 
 // Used for PKCE support
 extern NSString *const MSID_OAUTH2_CODE_CHALLENGE;

IdentityCore/src/MSIDOAuth2Constants.m

@@ -26,6 +26,7 @@
 NSString *const MSID_OAUTH2_ACCESS_TOKEN       = @"access_token";
 NSString *const MSID_OAUTH2_AUTHORIZATION      = @"authorization";
 NSString *const MSID_OAUTH2_AUTHORIZE_SUFFIX   = @"/oauth2/authorize";
+NSString *const MSID_OAUTH2_V2_AUTHORIZE_SUFFIX   = @"/oauth2/v2/authorize";
 NSString *const MSID_OAUTH2_AUTHORITY           = @"authority";
 NSString *const MSID_OAUTH2_AUTHORIZATION_CODE = @"authorization_code";
 NSString *const MSID_OAUTH2_AUTHORIZATION_URI  = @"authorization_uri";
@@ -75,6 +76,8 @@
 NSString *const MSID_OAUTH2_ADDITIONAL_SERVER_INFO       = @"additional_server_info";
 NSString *const MSID_OAUTH2_ENVIRONMENT                  = @"environment";
 
+NSString *const MSID_AUTH_CLOUD_INSTANCE_HOST_NAME       = @"cloud_instance_host_name";
+
 NSString *const MSID_CREDENTIAL_TYPE_CACHE_KEY           = @"credential_type";
 NSString *const MSID_ENVIRONMENT_CACHE_KEY               = @"environment";
 NSString *const MSID_REALM_CACHE_KEY                     = @"realm";

IdentityCore/src/oauth2/MSIDOauth2Factory.h

@@ -22,6 +22,7 @@
 // THE SOFTWARE.
 
 #import <Foundation/Foundation.h>
+#import "MSIDWebviewInteracting.h"
 
 @class MSIDTokenResponse;
 @class MSIDBaseToken;
@@ -57,7 +58,12 @@
 
 // Webviews
 - (id<MSIDWebviewInteracting>)embeddedWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
-                                                     customWebview:(WKWebView *)webview;
-- (id<MSIDWebviewInteracting>)systemWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams;
+                                                     customWebview:(WKWebView *)webview
+                                                 completionHandler:(MSIDWebUICompletionHandler)completionHandler;
+- (id<MSIDWebviewInteracting>)systemWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
+                                               callbackURLScheme:(NSString *)callbackURLScheme
+                                               completionHandler:(MSIDWebUICompletionHandler)completionHandler;
+
+- (NSURL *)startURLFromRequest:(MSIDRequestParameters *)requestParams;
 
 @end

IdentityCore/src/oauth2/MSIDOauth2Factory.m

@@ -30,6 +30,7 @@
 #import "MSIDLegacySingleResourceToken.h"
 #import "MSIDIdToken.h"
 #import "MSIDAccount.h"
+#import "MSIDSystemWebviewController.h"
 
 @implementation MSIDOauth2Factory
 
@@ -269,15 +270,24 @@ - (MSIDAccount *)fillAccount:(MSIDAccount *)account
 #pragma mark - Webview controllers
 - (id<MSIDWebviewInteracting>)embeddedWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
                                                      customWebview:(WKWebView *)webview
+                                                 completionHandler:(MSIDWebUICompletionHandler)completionHandler
 {
     // TODO: return default
     return nil;
 }
 
 - (id<MSIDWebviewInteracting>)systemWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
+                                               callbackURLScheme:(NSString *)callbackURLScheme
+                                               completionHandler:(MSIDWebUICompletionHandler)completionHandler
 {
     // TODO: return default
     return nil;
 }
 
+- (NSURL *)startURLFromRequest:(MSIDRequestParameters *)requestParams
+{
+    // Default URL from authority
+    return nil;
+}
+
 @end

IdentityCore/src/oauth2/MSIDRequestParameters.h

@@ -40,5 +40,7 @@
 
 @property (readwrite) NSString *loginHint;
 @property (readwrite) NSString *extraQueryParameters;
+@property (readwrite) NSString *promptBehavior;
+@property (readwrite) NSString *claims;
 
 @end

IdentityCore/src/oauth2/aad_v1/MSIDAADV1Oauth2Factory.m

@@ -28,6 +28,7 @@
 #import "MSIDRefreshToken.h"
 #import "MSIDLegacySingleResourceToken.h"
 #import "MSIDAccount.h"
+#import "MSIDDeviceId.h"
 
 @implementation MSIDAADV1Oauth2Factory
 
@@ -151,15 +152,70 @@ - (MSIDLegacySingleResourceToken *)legacyTokenFromResponse:(MSIDTokenResponse *)
 #pragma mark - Webview controllers
 - (id<MSIDWebviewInteracting>)embeddedWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
                                                            Webview:(WKWebView *)webview
+                                                 completionHandler:(MSIDWebUICompletionHandler)completionHandler
 {
     // Create MSIDEmbeddedWebviewRequest and create EmbeddedWebviewController
     return nil;
 }
 
 - (id<MSIDWebviewInteracting>)systemWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
+                                               callbackURLScheme:(NSString *)callbackURLScheme
+                                               completionHandler:(MSIDWebUICompletionHandler)completionHandler
 {
     // Create MSIDSystemWebviewRequest and create SystemWebviewController
     return nil;
 }
 
+- (NSURL *)startURLFrom:(MSIDRequestParameters *)requestParams
+{
+    NSString *state = [self encodeProtocolState:requestParams];
+
+    // if value is nil, it won't appear in the dictionary
+    NSMutableDictionary *queryParams = [NSMutableDictionary dictionaryWithObjectsAndKeys:
+                                        MSID_OAUTH2_CODE, MSID_OAUTH2_RESPONSE_TYPE,
+                                        [requestParams clientId], MSID_OAUTH2_CLIENT_ID,
+                                        [requestParams resource], MSID_OAUTH2_RESOURCE,
+                                        [requestParams redirectUri], MSID_OAUTH2_REDIRECT_URI,
+                                        state, MSID_OAUTH2_STATE,
+                                        requestParams.promptBehavior, @"prompt",
+                                        @"1", @"hashchrome", //to hide back button in UI
+                                        [NSString msidIsStringNilOrBlank:requestParams.loginHint] ? nil : requestParams.loginHint, MSID_OAUTH2_LOGIN_HINT,
+                                        nil];
+
+    [queryParams addEntriesFromDictionary:[MSIDDeviceId deviceId]];
+
+    NSMutableString *startUrl = [NSMutableString stringWithFormat:@"%@?%@",
+                                 [requestParams.authority.absoluteString stringByAppendingString:MSID_OAUTH2_AUTHORIZE_SUFFIX], [queryParams msidURLFormEncode]];
+
+    // we expect extraQueryParameters to be URL form encoded
+    if (![NSString msidIsStringNilOrBlank:requestParams.extraQueryParameters])
+    {
+        //Add the '&' for the additional params if not there already:
+        if ([requestParams.extraQueryParameters hasPrefix:@"&"])
+        {
+            [startUrl appendString:requestParams.extraQueryParameters.msidTrimmedString];
+        }
+        else
+        {
+            [startUrl appendFormat:@"&%@", requestParams.extraQueryParameters.msidTrimmedString];
+        }
+    }
+
+    // we expect claims to be URL form encoded
+    if (![NSString msidIsStringNilOrBlank:requestParams.claims])
+    {
+        [startUrl appendFormat:@"&claims=%@", requestParams.claims];
+    }
+
+    return [NSURL URLWithString:startUrl];
+}
+
+// TODO: if same in MSAL, move to common logic
+// Encodes the state parameter for a protocol message
+- (NSString *)encodeProtocolState:(MSIDRequestParameters *)requestParams
+{
+    return [[[NSMutableDictionary dictionaryWithObjectsAndKeys:[requestParams authority], @"a", [requestParams resource], @"r", nil]
+             msidURLFormEncode] msidBase64UrlEncode];
+}
+
 @end

IdentityCore/src/oauth2/aad_v2/MSIDAADV2Oauth2Factory.m

@@ -31,6 +31,7 @@
 #import "MSIDAuthority.h"
 #import "MSIDAccount.h"
 #import "MSIDIdToken.h"
+#import "MSIDSystemWebviewController.h"
 
 @implementation MSIDAADV2Oauth2Factory
 
@@ -214,14 +215,32 @@ - (MSIDBaseToken *)fillAADV2BaseToken:(MSIDBaseToken *)baseToken
 #pragma mark - Webview controllers
 - (id<MSIDWebviewInteracting>)embeddedWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
                                                            Webview:(WKWebView *)webview
+                                                 completionHandler:(MSIDWebUICompletionHandler)completionHandler
 {
     // Create MSIDEmbeddedWebviewRequest and create EmbeddedWebviewController
+
+
     return nil;
 }
 
 - (id<MSIDWebviewInteracting>)systemWebviewControllerWithRequest:(MSIDRequestParameters *)requestParams
+                                               callbackURLScheme:(NSString *)callbackURLScheme
+                                               completionHandler:(MSIDWebUICompletionHandler)completionHandler
+{
+    // TODO: get authorization endpoint from authority validation cache.
+
+//    MSIDWebUIStateVerifier stateVerifier = ^BOOL(NSDictionary *dictionary, NSString *requestState)
+//    {
+//        return NO;
+//    };
+//    
+//    
+    return nil;
+}
+
+- (NSURL *)startURLFromRequest:(MSIDRequestParameters *)requestParams
 {
-    // Create MSIDSystemWebviewRequest and create SystemWebviewController
+
     return nil;
 }
 

IdentityCore/src/webview/request/MSIDWebviewRequest.h → IdentityCore/src/util/MSIDCryptoHelper.h

@@ -27,8 +27,8 @@
 
 #import <Foundation/Foundation.h>
 
-@interface MSIDWebviewRequest : NSObject
+@interface MSIDCryptoHelper : NSObject
 
-@property NSURL *startURL;
++ (NSData *)msidSHA256fromString:(NSString *)string;
 
 @end

IdentityCore/src/util/MSIDCryptoHelper.m

@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+//
+// Copyright (c) Microsoft Corporation.
+// All rights reserved.
+//
+// This code is licensed under the MIT License.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files(the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and / or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions :
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+//
+//------------------------------------------------------------------------------
+
+#import "MSIDCryptoHelper.h"
+#import <CommonCrypto/CommonDigest.h>
+#import "MSIDError.h"
+
+@implementation MSIDCryptoHelper
+
++ (NSData *)msidSHA256fromString:(NSString *)string;
+{
+    NSData *inputData = [string dataUsingEncoding:NSASCIIStringEncoding];
+    NSMutableData *outData = [NSMutableData dataWithLength:CC_SHA256_DIGEST_LENGTH];
+
+    // input length shouldn't be this big
+    if (inputData.length > UINT32_MAX)
+    {
+        MSID_LOG_ERROR(nil, @"InvalidArgumentException: length too big");
+        @throw [NSException exceptionWithName: NSInvalidArgumentException
+                                       reason:@"Please provide a valid string parameter."
+                                     userInfo:nil];
+    }
+    CC_SHA256(inputData.bytes, (uint32_t)inputData.length, outData.mutableBytes);
+
+    return outData;
+}
+
+@end

IdentityCore/src/util/NSDictionary+MSIDExtensions.h

@@ -27,4 +27,6 @@
 - (NSString *)msidURLFormEncode;
 - (NSDictionary *)dictionaryByRemovingFields:(NSArray *)fieldsToRemove;
 
+- (NSArray<NSURLQueryItem *> *)urlQueryItemsArray;
+
 @end

IdentityCore/src/util/NSDictionary+MSIDExtensions.m

@@ -94,4 +94,22 @@ - (NSDictionary *)dictionaryByRemovingFields:(NSArray *)fieldsToRemove
     return mutableDict;
 }
 
+- (NSArray<NSURLQueryItem *> *)urlQueryItemsArray;
+{
+    NSMutableArray<NSURLQueryItem *> *array = [NSMutableArray new];
+
+    for (id key in self.allKeys)
+    {
+
+        NSString *value = [self[key] isKindOfClass:NSUUID.class] ?
+        ((NSUUID *)self[key]).UUIDString : [self[key] description];
+
+        [array addObject:[NSURLQueryItem queryItemWithName:[key description]
+                                                      value:value]];
+    }
+
+    return array;
+}
+
+
 @end

IdentityCore/src/util/NSString+MSIDExtensions.h

@@ -59,4 +59,7 @@
 
 - (NSOrderedSet<NSString *> *)scopeSet;
 
+/*! Generate a URL-safe string of random data */
++ (NSString *)randomUrlSafeStringOfSize:(NSUInteger)size;
+
 @end