• Stars
    star
    209
  • Rank 188,325 (Top 4 %)
  • Language
    Java
  • License
    MIT License
  • Created over 8 years ago
  • Updated 4 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Microsoft Authentication Library (MSAL) for Android

Microsoft Authentication Library (MSAL) for Android

Getting Started Sample Code Library Reference Support Overview Feedback

The MSAL library for Android gives your app the ability to use the Microsoft Cloud by supporting Microsoft Azure Active Directory and Microsoft accounts in a converged experience using industry standard OAuth2 and OpenID Connect. The library also supports Azure AD B2C.

Version Badge

Introduction

What's new?

Looking for developers interested in providing early feedback on a x-platform implementation of MSAL written in C++ and Java, callable from Java, Kotlin and C++. If you're interested please please contact [email protected].

06/25/2021

  • Silent requests were inadvertently serialized in MSAL v2.0.10-v2.0.12, Common v3.2.0-v3.4.3. This will be fixed in an upcoming release, tentatively scheduled for next week.
  • In the meantime, please do not use the mentioned library versions, and strongly consider moving to 2.0.8. Details for the issue can be found here.

11/09/2020

09/04/2020 New updates with MSAL 2.0.0

  • Add Device Code Flow Support (#1112)
  • Introduces new AadAuthorityAudience enum to support new syntax for specifying cloud + audience
  • Broker Content Provider Changes
  • FOCI support for Local MSAL
  • Added new Single Account Public Client Application API overloads

02/12/2020 New updates with MSAL 1.3.0:

  • WebView zoom controls are now configurable
  • Bugs/issues fixed:
    • Incorrect id_token returned for B2C app with multiple policies
    • WebView calls loadUrl multiple times over lifecycle
    • WebView displays error when connectivity lost
    • AT caching logic change for scope intersection

09/30/2019 MSAL Android is now generally available with MSAL 1.0!:

Migrating from ADAL

See the ADAL to MSAL migration guide for Android

Sample

Run the quickstart to see how our Java sample works, or checkout this list of all MSAL sample repos.

Using MSAL

Requirements

  • Android API Level 16+

Step 1: Declare dependency on MSAL

Add to your app's build.gradle:

dependencies {
    implementation 'com.microsoft.identity.client:msal:3.0.+'
}

Please also add the following lines to your repositories section in your gradle script:

maven { 
    url 'https://pkgs.dev.azure.com/MicrosoftDeviceSDK/DuoSDK-Public/_packaging/Duo-SDK-Feed/maven/v1' 
}

Step 2: Create your MSAL configuration file

Configuration Documentation

It's simplest to create your configuration file as a "raw" resource file in your project resources. You'll be able to refer to this using the generated resource identifier when constructing an instance of PublicClientApplication. If you are registering your app in the portal for the first time, you will also be provided with this config JSON.

{
  "client_id" : "<YOUR_CLIENT_ID>",
  "redirect_uri" : "msauth://<YOUR_PACKAGE_NAME>/<YOUR_BASE64_URL_ENCODED_PACKAGE_SIGNATURE>",
  "broker_redirect_uri_registered": true,
}

NOTE: In the redirect_uri, the part <YOUR_PACKAGE_NAME> refers to the package name returned by the context.getPackageName() method. This package name is the same as the application_id defined in your build.gradle file.

NOTE: This is the minimum required configuration. MSAL relies on the defaults that ship with the library for all other settings. Please refer to the configuration file documentation to understand the library defaults.

Step 3: Configure the AndroidManifest.xml

  1. Request the following permissions via the Android Manifest
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
  1. Configure an intent filter in the Android Manifest, using your redirect URI

NOTE: Failure to include an intent filter matching the redirect URI you specify via configuration will result in a failed interactive token request. Please double check this!

    <!--Intent filter to capture authorization code response from the default browser on the device calling back to our app after interactive sign in -->
    <activity
        android:name="com.microsoft.identity.client.BrowserTabActivity">
        <intent-filter>
            <action android:name="android.intent.action.VIEW" />
            <category android:name="android.intent.category.DEFAULT" />
            <category android:name="android.intent.category.BROWSABLE" />
            <data
                android:scheme="msauth"
                android:host="<YOUR_PACKAGE_NAME>"
                android:path="/<YOUR_BASE64_ENCODED_PACKAGE_SIGNATURE>" />
        </intent-filter>
    </activity>

NOTE: Please refer to this FAQ for more information on common redirect uri issues.

Step 4: Create an MSAL PublicClientApplication

NOTE: In this example we are creating an instance of MultipleAccountPublicClientApplication, which is designed to work with apps that allow multiple accounts to be used within the same application. If you would like to use SingleAccount mode, refer to the single vs. multi account documentation. You can also check out the quickstart for examples of how this is used.

  1. Create a new MultipleAccountPublicClientApplication instance.
String[] scopes = {"User.Read"};
IMultipleAccountPublicClientApplication mMultipleAccountApp = null;
IAccount mFirstAccount = null;

PublicClientApplication.createMultipleAccountPublicClientApplication(getContext(),
    R.raw.msal_config,
    new IPublicClientApplication.IMultipleAccountApplicationCreatedListener() {
        @Override
        public void onCreated(IMultipleAccountPublicClientApplication application) {
            mMultipleAccountApp = application;
        }

        @Override
        public void onError(MsalException exception) {
            //Log Exception Here
        }
    });
  1. Acquire a token interactively
mMultipleAccountApp.acquireToken(this, SCOPES, getAuthInteractiveCallback());

private AuthenticationCallback getAuthInteractiveCallback() {
    return new AuthenticationCallback() {
        @Override
        public void onSuccess(IAuthenticationResult authenticationResult) {
            /* Successfully got a token, use it to call a protected resource */
            String accessToken = authenticationResult.getAccessToken();
            // Record account used to acquire token
            mFirstAccount = authenticationResult.getAccount();
        }
        @Override
        public void onError(MsalException exception) {
            if (exception instanceof MsalClientException) {
                //And exception from the client (MSAL)
            } else if (exception instanceof MsalServiceException) {
                //An exception from the server
            }
        }
        @Override
        public void onCancel() {
            /* User canceled the authentication */
        }
    };
}
  1. Acquire a token silently
/*
    Before getting a token silently for the account used to previously acquire a token interactively, we recommend that you verify that the account is still present in the local cache or on the device in case of brokered auth

    Let's use the synchronous methods here which can only be invoked from a Worker thread
*/

//On a worker thread
IAccount account = mMultipleAccountApp.getAccount(mFirstAccount.getId());

if(account != null){
    //Now that we know the account is still present in the local cache or not the device (broker authentication)

    //Request token silently
    String[] newScopes = {"Calendars.Read"};
    
    String authority = mMultipleAccountApp.getConfiguration().getDefaultAuthority().getAuthorityURL().toString();

    //Use default authority to request token from pass null
    IAuthenticationResult result = mMultipleAccountApp.acquireTokenSilent(newScopes, account, authority);
}

ProGuard

MSAL uses reflection and generic type information stored in .class files at runtime to support various persistence and serialization related functionalities. Accordingly, library support for minification and obfuscation is limited. A default configuration is shipped with this library; please file an issue if you find any issues.

Community Help and Support

We use StackOverflow with the community to provide support. You should browse existing issues to see if someone has asked about your issue before. If there are workable solutions to your issue then try out those solutions. If not, ask your question and let the community help you out. We're part of the community too and watch for new questions. We help with answers when the community cannot give you a solution.

If you find and bug or have a feature request, please raise the issue on GitHub Issues.

Submit Feedback

We'd like your thoughts on this library. Please complete this short survey.

Contribute

We enthusiastically welcome contributions and feedback. You should clone the repo and start contributing now.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Android Studio Build Requirement

Please note that this project uses Lombok internally and while using Android Studio you will need to install Lobmok Plugin to get the project to build successfully within Android Studio.

Roadmap

Date Release Blog post Main features
09/30/19 MSAL 1.0.0 https://developer.microsoft.com/identity/blogs/microsoft-authentication-libraries-for-android-ios-and-macos-are-now-generally-available/ General Availability of MSAL
12/17/19 MSAL 1.1.0 Expose raw id_token IAccount/ITenantProfile from AuthenticationResult
02/04/20 MSAL 1.2.0 Adds spinner to WebView interactive requests, replaced PublicClientApplication create methods, adds fragment support to WebView flow, bug fixes
02/12/20 MSAL 1.3.0 Bug fixes & WebView zoom controls configurable
Projected for end of Q4 Proof of Possession Access Token Proof of Possession is currently in preview and is not yet recommended for production environments. Learn more.

Security Library

This library controls how users sign-in and access services. We recommend you always take the latest version of our library in your app when you can. We use semantic versioning so you can control the risk of updating your app. For example, always downloading the latest minor version number (e.g. x.y.x) ensures you get the latest security and feature enhanements with the assurance that our API surface area has not changed. You can always see the latest version and release notes under the Releases tab of GitHub.

Security Reporting

If you find a security issue with our libraries or services, please report the issue to [email protected] with as much detail as you can provide. Your submission may be eligible for a bounty through the Microsoft Bounty program. Please do not post security issues to GitHub Issues or any other public site. We will contact you shortly after receiving your issue report. We encourage you to get new security incident notifications by visiting Microsoft technical security notifications to subscribe to Security Advisory Alerts.

Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT License (the "License");

More Repositories

1

microsoft-authentication-library-for-js

Microsoft Authentication Library (MSAL) for JS
TypeScript
3,652
star
2

microsoft-authentication-library-for-dotnet

Microsoft Authentication Library (MSAL) for .NET
C#
1,393
star
3

azure-activedirectory-identitymodel-extensions-for-dotnet

IdentityModel extensions for .Net
C#
1,048
star
4

microsoft-authentication-library-for-python

Microsoft Authentication Library (MSAL) for Python makes it easy to authenticate to Microsoft Entra ID. General docs are available here https://learn.microsoft.com/entra/msal/python/ Stable APIs are documented here https://msal-python.readthedocs.io. Questions can be asked on www.stackoverflow.com with tag "msal" + "python".
Python
815
star
5

AzureADAssessment

Tooling for assessing an Azure AD tenant state and configuration
PowerShell
727
star
6

microsoft-identity-web

Helps creating protected web apps and web APIs with Microsoft identity platform and Azure AD B2C
C#
682
star
7

azure-activedirectory-library-for-js

The code for ADAL.js and ADAL Angular has been moved to the MSAL.js repo. Please open any issues or PRs at the link below.
JavaScript
625
star
8

passport-azure-ad

The code for Passport Azure AD has been moved to the MSAL.js repo. Please open any issues or PRs at the link below.
JavaScript
422
star
9

Azure-AD-Incident-Response-PowerShell-Module

The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response.
PowerShell
405
star
10

azure-activedirectory-library-for-dotnet

ADAL authentication libraries for .net
C#
358
star
11

microsoft-authentication-library-for-java

Microsoft Authentication Library (MSAL) for Java http://aka.ms/aadv2
Java
285
star
12

azure-activedirectory-library-for-python

ADAL for Python
Python
259
star
13

microsoft-authentication-library-for-objc

Microsoft Authentication Library (MSAL) for iOS and macOS
Objective-C
256
star
14

MSIdentityTools

Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities.
PowerShell
230
star
15

microsoft-authentication-library-for-go

The MSAL library for Go is part of the Microsoft identity platform for developers (formerly named Azure AD) v2.0. It enables you to acquire security tokens to call protected APIs. It uses industry standard OAuth2 and OpenID Connect.
Go
229
star
16

azure-activedirectory-library-for-nodejs

The code for ADAL Node has been moved to the MSAL.js repo. Please open any issues or PRs at the link below.
JavaScript
208
star
17

azure-activedirectory-library-for-android

The ADAL SDK for Android gives you the ability to add support for Work Accounts to your application with just a few lines of additional code. This SDK gives your application the full functionality of Microsoft Azure AD, including industry standard protocol support for OAuth2, Web API integration with user level consent, and two factor authentication support.
Java
177
star
18

azure-activedirectory-library-for-objc

The ADAL SDK for Objective C gives you the ability to add support for Work Accounts to your iOS and macOS applications with just a few lines of additional code. This SDK gives your application the full functionality of Microsoft Azure AD, including industry standard protocol support for OAuth2, Web API integration with user level consent, and two factor authentication support.
Objective-C
177
star
19

Deployment-Plans

Step by step guidance to deploy Azure Active Directory capabilities such as Conditional Access, Multi Factor Authentication, Self Service Password, and more.
PowerShell
173
star
20

MSAL.PS

PowerShell
164
star
21

SCIMReferenceCode

Reference code to build a SCIM endpoint to automate provisioning
C#
162
star
22

azure-activedirectory-library-for-java

Java
161
star
23

microsoft-authentication-extensions-for-dotnet

Secure cross-platform token cache for MSAL public client apps
C#
83
star
24

IdentityProtectionTools

Sample PowerShell module and scripts for managing Azure AD Identity Protection service
PowerShell
71
star
25

azure-activedirectory-library-for-cordova

ADAL for Cordova
59
star
26

Apple-SSO-Tools

Apple Enterprise SSO troubleshooting script
Shell
54
star
27

omniauth-azure-activedirectory

Ruby
50
star
28

microsoft-authentication-cli

A command line utility for Azure authentication.
C#
42
star
29

microsoft-authentication-library-common-for-android

Common code used by both the Active Directory Authentication Library (ADAL) and the Microsoft Authentication Library (MSAL)
Java
41
star
30

azure-activedirectory-library-for-ruby

The ADAL for Ruby library makes it easy for Ruby applications to authenticate to AAD in order to access AAD protected web resources.
Ruby
36
star
31

active-directory-b2c-wordpress-plugin-openidconnect

A plugin for WordPress that allows users to authenticate with Azure AD B2C using OpenID Connect.
PHP
31
star
32

microsoft-authentication-library-common-for-objc

Common code used by both the Active Directory Authentication Library (ADAL) and the Microsoft Authentication Library (MSAL)
Objective-C
30
star
33

azure-activedirectory-powershell

This is a repo for Azure AD PowerShell scrips and samples
PowerShell
30
star
34

rms-sdk-for-cpp

RMS SDK for C++
C
29
star
35

microsoft-authentication-extensions-for-python

Microsoft Authentication Library extensions (MSAL EX) provides a persistence API that can save your data on disk, encrypted on Windows, macOS and Linux. Concurrent data access will be coordinated by a file lock mechanism.
Python
29
star
36

entra-id-inbound-provisioning

Samples, scripts and resources to help you get started with Microsoft Entra API-driven inbound provisioning
PowerShell
24
star
37

azure-activedirectory-powershell-for-admins

PowerShell
11
star
38

AzureAD-Governance-Assessment

Scripts to run an AAD Governance Assessment
PowerShell
10
star
39

microsoft-identity-abstractions-for-dotnet

Contains interfaces and data classes used in the .NET Microsoft authentication libraries (MSAL, IdentityModel, Microsoft.Identity.Web, ...)
C#
9
star
40

azure-activedirectory-powershell-tokenkey

Scripts to override the Azure Active Directory token signing key.
PowerShell
8
star
41

rms-sdk-ui-for-ios

RMS SDK UI Components for iOS
Objective-C
8
star
42

MSCloudIDUtils

Sample PowerShell logic for interacting with Azure Active Directory identity and resources using the Microsoft Identity Platform
PowerShell
7
star
43

availability-proxy-for-rest-services

C#
6
star
44

azure-activedirectory-cordova-plugin-graph

JavaScript
5
star
45

microsoft-authentication-extensions-for-java

Microsoft Authentication extensions for MSAL.Java
Java
4
star
46

Cross-tenant-synchronization

3
star
47

rms-sdk-ui-for-android

RMS SDK UI Components for Android
Java
3
star
48

docs

API Documentation
HTML
2
star
49

declaredaccess

Collection of experimental projects for simplifying the use of identity by moving from imperative programming models to declarative programming models.
HTML
2
star
50

rms-sdk-ui-for-windowsstore

RMS SDK for Windows Store Applications
C#
2
star
51

rms-sdk-ui-for-winphone

C#
2
star
52

microsoft-authentication-extensions-for-go

Secure cross-platform token cache for MSAL public client apps
1
star
53

ADALLoginKit

A Helper Library to bootstrap AzureAD Samples
Objective-C
1
star
54

java-flavors-plugin

Plugin to support configuration of "flavors" for java projects.
Groovy
1
star