ADAL.JS with Mobile App

Question

I'm trying to integrate some Oracle delivered Mobile Application Framework Apps (MAF) mobile apps with Azure AD authentication. I have tried the Java approach, which apparently doesn't work in my case.

So I decided to try using a Javascript login page option using ADAL.JS. Since MAF creates cross-platform compatible code by transpiling to HTML 5/Javascript/Cordova, I reckoned I could make the JS option work without resorting to having multiple SDK specific solutions like ADAL-Android or ADAL-IOS. Since I can wrap it all in an HTML page as I can use the OAUTH implicit flow option that ADAL.JS requires. I have the ADAL.JS part working from my PC using this example with a local Node/Webpack dev server for the redirect URI. (Note, just like that example, I'd prefer to use the strict adal.js option and avoid any angular-js stuff). However, I'm running into an issue when deployed on the Android mobile device. It appears to be due to the reply URI. After being prompted for Azure credentials and supplying those, the following error is produced.

AADSTS50011: Reply address 'file:///data/user/0/com.company.app/storage/assets/FARs/ViewController/public_html/SignOn/login.html' has an invalid scheme.

I found that when deploying to a mobile device the Azure registered app must be set to type "Native" instead of "Web/API" which I have done. And according to an MSFT example (which I cannot include since I don't have enough rep to include more than two links) the redirect URI must be set to "https://login.microsoftonline.com/common/oauth2/nativeclient". But I still get the same error.

UPDATE since @FeiXue Reply

I'm using the original endpoint not 2.0. When I set the redirectURI as such:

redirectURI=https://login.microsoftonline.com/common/oauth2/nativeclient

The browser returns this in the address bar and remains there on a blank screen and does not issue a token. It does this both on the PC browser and mobile browser.

http://login.microsoftonline.com/common/oauth2/nativeclient#id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzUU4wQlpTN3M0bk4tQmRyamJGMFlfTGRNTSIsImtpZCI6ImEzUU4wQlpTN3M0bk4tQmRyamJGMFlfTGRNTSJ9.(shortened for brevity)&state=e1ce94fb-6310-4dec-9e8b-053727ceb9b8&session_state=1beafa4d-af55-415b-85d5-83e8b4035594

However, for the exact same code, on the PC when I set the redirectURI as such it returns an access token:

redirectURI=https://localhost:8443 <-- port to my local node server

I've also tried it with a redirectURI of urn:ietf:wg:oauth:2.0:oob, but that does not work either.

Code

<!DOCTYPE html>
<html>
<head>
    <title>Authenticate User with ADAL JS</title>
    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
    <script src="https://secure.aadcdn.microsoftonline-p.com/lib/1.0.0/js/adal.js"></script>
    <script type="text/javascript">
        $(document).ready(function() {
            "use strict";

            var variables = {
                azureAD: "mytenant.onmicrosoft.com",
                clientId: "cc8ed7e0-56e9-45c9-b01e-xxxxxxxxxx"
            }

            window.config = {
                tenant: variables.azureAD,
                clientId: variables.clientId,
                postLogoutRedirectUri: window.location.origin,
                redirectUri: "https://login.microsoftonline.com/common/oauth2/nativeclient",
                endpoints: {
                    aisApiUri: "cc8ed7e0-56e9-45c9-b01e-xxxxxxxxxx"
                }
                //cacheLocation: "localStorage"
            };

            var authContext = new AuthenticationContext(config);

            var isCallback = authContext.isCallback(window.location.hash);

            authContext.handleWindowCallback();

            if (isCallback && !authContext.getLoginError()) {
                window.location = authContext._getItem(authContext.CONSTANTS.STORAGE.LOGIN_REQUEST);
            }

            var user = authContext.getCachedUser();

            if (!user) {

                authContext.login();
            }

            authContext.acquireToken(config.endpoints.aisApiUri, function (error, token) {
                if (error || !token) {
                    console.log("ADAL error occurred in acquireToken: " + error);
                    return;
                }
                else {

                    var accessToken = "Authorization:" + " Bearer " + token;

                    console.log("SUCCESSFULLY FETCHED TOKEN: " + accessToken);

                }
            });

        });
    </script>
</head>
<body>
    <h1>Test Login</h1>
</body>
</html>

Update

@FeiXue So I guess from what you're saying the id_token IS the access token? I think then the problem is this.

When the redirectURI="https://localhost:8443" it redirects back to my index.html after AAD login and the authContext.acquireToken() works and returns a valid token.

But when the redirectURI="https://login.microsoftonline.com/common/oauth2/nativeclient" it never redirects back from http://login.microsoftonline.com/common/oauth2/nativeclient#id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni......

While it shows the id_token, it never redirects back to my index.html So I can't make a call to authContext.acquireToken() for passing it onto my web API.

Answer 1

From my research on this topic here is the gist on ADAL.JS and Native (Mobile) Device Support

As @fei-xue-msft mentioned, ADAL.JS is not intended for nor does it work with native/mobile devices. ADAL.JS was written with the “original” Azure endpoint in mind, not the v2.0 endpoint that provides more functionality for mobile/native devices (see more below on the two different endpoint options). There is however an experimental ADAL.JS branch you can try (uses the v2.0 endpoint), but it is not not being actively updated anymore so you are on your own. The new MSFT approach is to use the new MSAL library, which is written towards the v2.0 endpoints. However there is no MSAL-for-JS library yet but rumor is there will be one at some point. For more on the two different Azure endpoints (“original” versus “v2.0”) see the links below. The confusion over this was a source of frustration in my troubleshooting so I help this helps some others going down this track.

So if you are looking to get Azure Oauth authentication on mobile devices, first decide which Azure Endpoint you want to use (Supporting links on that below as v2.0 does have some restrictions that the original endpoint does not). You can determine what your specific endpoints for your tenant are by viewing the Metadata Doc links listed below, just substitute your tenant name or ID. You should be able to use either.

To register an application for a specific type of endpoint (original versus v2.0) use the appropriate App Registration Portal link cited below. Then, to decide what your options are for creating an Azure auth solution for native/mobile device, see the code samples for each endpoint version, and make sure the sample is for “native” else it probably won’t work on your mobile device. For example, you will not see an ADAL.JS sample for the original endpoint library options, but you will see one for Cordova (which is why @fei-xue-msft suggested that approach). For the v2.0 endpoint samples you will see the MSAL/Xamarin options, and for an Javascript option you can try something like the Hello.JS Sample.

Original Endpoint

https://login.microsoft.com/{tenant id}/oauth2/authorize

App Registration Portal: https://portal.azure.com

Code Samples: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-code-samples#native-application-to-web-api

Native Auth Scenarios: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-authentication-scenarios#native-application-to-web-api

OpenID Metadata Doc: https://login.microsoft.com/{tenant id}/.well-known/openid-configuration

---

V2.0 Endpoint

https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize

App Registration Portal: https://apps.dev.microsoft.com

V2.0 Endpoint Compare: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-compare

Code Sample: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-libraries

OpenID Metadata Doc: https://login.microsoft.com/{tenant id}/v2.0/.well-known/openid-configuration

Answer 2

Are you developing with Azure AD V2.0 endpoint?

If not, we are able to config the redirect URIs as we want on the portal for the native app. However as the error message indicates that the file protocol is not a a validate scheme.

In this scenario, we can use the http or https since you were developing with HTML.

And in the Azure AD V2.0 endpoint, we are not able to set the redirect_Uri for the native app at present. We can use urn:ietf:wg:oauth:2.0:oob or https://login.microsoftonline.com/common/oauth2/nativeclient for the redirect_Uri. The first one is used for the native app for the device and the second we can use for the client which host in browser(web-view).

At last, please ensure that the redirect_uri in the request is using the correct one you register for the portal. You can also test the request on the browser to narrow down whether this issue was cause the incorrect redirect_uri in the request. And for the authorization request, you can refer links below:

Authorize access to web applications using OAuth 2.0 and Azure Active Directory

v2.0 Protocols - OAuth 2.0 Authorization Code Flow

Update(there is no href property if open the HTML from disk which cause the popup page is not closed)

AuthenticationContext.prototype._loginPopup = function (urlNavigate) {
        var popupWindow = this._openPopup(urlNavigate, "login", this.CONSTANTS.POPUP_WIDTH, this.CONSTANTS.POPUP_HEIGHT);
        if (popupWindow == null) {
            this.warn('Popup Window is null. This can happen if you are using IE');
            this._saveItem(this.CONSTANTS.STORAGE.ERROR, 'Error opening popup');
            this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, 'Popup Window is null. This can happen if you are using IE');
            this._saveItem(this.CONSTANTS.STORAGE.LOGIN_ERROR, 'Popup Window is null. This can happen if you are using IE');
            if (this.callback)
                this.callback(this._getItem(this.CONSTANTS.STORAGE.LOGIN_ERROR), null, this._getItem(this.CONSTANTS.STORAGE.ERROR));
            return;
        }
        if (this.config.redirectUri.indexOf('#') != -1)
            var registeredRedirectUri = this.config.redirectUri.split("#")[0];
        else
            var registeredRedirectUri = this.config.redirectUri;
        var that = this;
        var pollTimer = window.setInterval(function () {
            if (!popupWindow || popupWindow.closed || popupWindow.closed === undefined) {
                that._loginInProgress = false;
                window.clearInterval(pollTimer);
            }
            try {
                //there is no href property if open the HTML from disk
                if (popupWindow.location.href.indexOf(registeredRedirectUri) != -1) {
                    if (that.isAngular) {
                        that._onPopUpHashChanged(popupWindow.location.hash);
                    }
                    else {
                        that.handleWindowCallback(popupWindow.location.hash);
                    }
                    window.clearInterval(pollTimer);
                    that._loginInProgress = false;
                    that.info("Closing popup window");
                    popupWindow.close();
                }
            } catch (e) {
            }
        }, 20);
    };

This issue is caused that when we open the HTML page from device(disk), the parent HTML page(login page) is not able to get the location of the popup page. So the parent page is not able to close that page based on the location of popup page. To workaround this issue, I suggest that you developing with azure-activedirectory-library-for-cordova or host the login page on the back end of web API.