Add passkey registration support for WebView, Fixes AB#3385532 #2769
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
p3dr0rv
changed the title
|
❌ Work item link check failed. Description does not contain AB#{ID}. Click here to Learn more. |
- Set project-level archives name in build.gradle - Improve PasskeyWebListener to set up WebView message listener - Refactor WebViewAuthorizationFragment to handle console messages with logging levels - Update request headers management in WebViewAuthorizationFragment for passkey protocol - Clean up WebViewMessageListener by removing unused default listener
…oved script handling and logging; add JsScriptRecord for script management; update CommonFlight to disable passkey feature by default.
…rieval logging; streamline credential request handling.
- Added PasskeyReplyChannel for communication between JavaScript and native code. - Updated CredentialManagerHandler to create and retrieve passkeys. - Enhanced PasskeyWebListener to handle WebAuthn requests and responses. - Introduced js-bridge.js for JavaScript integration with WebAuthn. - Created unit tests for PasskeyReplyChannel to ensure correct message formatting and error handling. - Removed unnecessary logging statements and improved error handling.
…r handling and message formatting; enhance test coverage for success and error scenarios.
…te Logger class to disable Logcat logging by default; improve logging conditions in Logger.java; ensure proper newline at end of files in CredentialManagerHandler and JsScriptRecord.
…d clean up request headers
…nstructions for modifying js-bridge.js
…ract Passkey protocol header injection logic into a separate method for improved readability and maintainability.
… with project property for better version management. Refactor FidoChallengeField to support multiple Passkey protocol versions; improve error handling for unsupported versions. Clean up CredentialManagerHandler by removing unnecessary exception handling; streamline credential creation and retrieval logic. Add unit tests for PasskeyWebListener; cover message handling, credential flows, and error scenarios. Add webkitVersion variable in versions.gradle for centralized version management.
…abled by default.
…ent; streamline logic for injecting headers based on flight feature and broker requests.
p3dr0rv
changed the title
p3dr0rv
changed the title
|
✅ Work item link check complete. Description contains link AB#3385532 to an Azure Boards work item. |
github-actions
bot
changed the title
…dler for improved readability; format code for better clarity.
…ureAD/microsoft-authentication-library-common-for-android into pedroro/passkey-reg-prototype
...va/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java
Show resolved
Hide resolved
...src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyReplyChannel.kt
Outdated
Show resolved
Hide resolved
...ava/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java
Show resolved
Hide resolved
...va/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java
Outdated
Show resolved
Hide resolved
.../src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyWebListener.kt
Outdated
Show resolved
Hide resolved
common/src/main/java/com/microsoft/identity/common/internal/fido/FidoChallengeField.kt
Outdated
Show resolved
Hide resolved
common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/js-bridge.js
Outdated
Show resolved
Hide resolved
…oviders/oauth2/PasskeyReplyChannel.kt Co-authored-by: Copilot <[email protected]>
…do/FidoChallengeField.kt Co-authored-by: Copilot <[email protected]>
…oviders/oauth2/js-bridge.js Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
…fido' in the path for specific cases
fadidurah
reviewed
Nov 6, 2025
...ain/java/com/microsoft/identity/common/internal/providers/oauth2/CredentialManagerHandler.kt
Show resolved
Hide resolved
fadidurah
reviewed
Nov 6, 2025
...va/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java
Outdated
Show resolved
Hide resolved
fadidurah
reviewed
Nov 6, 2025
common/src/main/java/com/microsoft/identity/common/internal/ui/webview/JsScriptRecord.kt
Outdated
Show resolved
Hide resolved
fadidurah
reviewed
Nov 6, 2025
...ava/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java
Show resolved
Hide resolved
fadidurah
reviewed
Nov 6, 2025
.../src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyWebListener.kt
Show resolved
Hide resolved
fadidurah
reviewed
Nov 6, 2025
...va/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java
Show resolved
Hide resolved
fadidurah
reviewed
Nov 6, 2025
...src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyReplyChannel.kt
Show resolved
Hide resolved
fadidurah
reviewed
Nov 6, 2025
common/src/main/java/com/microsoft/identity/common/internal/ui/webview/JsScriptRecord.kt
Outdated
Show resolved
Hide resolved
fadidurah
approved these changes
Nov 6, 2025
p3dr0rv
added
the
Skip-Consumers-Check
… against each allowed URL
fadidurah
approved these changes
Nov 6, 2025
p3dr0rv
added a commit
to AzureAD/microsoft-authentication-library-for-android
that referenced
this pull request
Nov 6, 2025
[AB#3385532](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3385532) https://identitydivision.visualstudio.com/DevEx/_git/AuthLibrariesApiReview/pullrequest/20357 ### Add WebAuthn Version Support and Passkey Headers This PR adds support for handling the WebAuthn protocol version in the app configuration and authentication flow for broker-less scenarios. also enables testing on WEBVIEW PPE MSA **Changes:** - Added a new `webauthn_version` field to `PublicClientApplicationConfiguration`, including serialization, accessors, and merge logic, allowing apps to define and retrieve the WebAuthn version from configuration files. - Updated `CommandParametersAdapter` to include passkey protocol headers in authentication requests when WebAuthn is enabled, supported (Android 9+), Authorization agent is Webview and the version is 1.1. - Updated the test app (`MsalWrapper`) to append the `msaoauth2=true` parameter to query strings when running in the pre-production environment with WebAuthn 1.1 enabled, enabling proper testing of WebAuthn flows. Related PR: AzureAD/microsoft-authentication-library-common-for-android#2769 Test 1- create account https://signup.live-int.com/?lic=1 2 - Install msal test app, (ensure no broker is installed) 3 - change config to MSA_WEBVIEW_PPE 4- Click acquire token and complete auth flow (username, password) 5 - User is presented with the option to register a passkey, complete the flow, and you will end up with a token and a passkey. 6 - try again with no user selected and use the passkey. --------- Co-authored-by: Copilot <[email protected]>
chaoz-MS
added a commit
to chaoz-MS/microsoft-authentication-library-common-for-android
that referenced
this pull request
Dec 2, 2025
AzureAD#2769)" This reverts commit e447086.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
AB#3385532
https://identitydivision.visualstudio.com/DevEx/_git/AuthLibrariesApiReview/pullrequest/20357
This PR implements passkey registration support for MSAL/Broker/OneAuth on Android WebView through a WebMessageListener bridge. It extends the existing authentication-only passkey functionality to include full registration capabilities, leveraging the standard Android Credential Manager.
🎯 Key Features
Protocol Version Update
Passkey and Credential Manager Integration:
CredentialManagerHandlerclass to encapsulate passkey creation and retrieval using the Android Credential Manager API, including version checks and logging. This simplifies and centralizes interactions with the credential APIs.PasskeyReplyChannelclass to standardize communication of WebAuthn responses (success and error) back to JavaScript viaJavaScriptReplyProxy, with detailed error mapping to DOMException types per the WebAuthn specification.Protocol Version Handling:
FidoChallengeFieldto accept both1.0and1.1as supported passkey protocol versions, improving compatibility with newer protocol versions.Dependency Management:
androidx.webkit:webkitas a dependency to support enhanced WebView and JavaScript interaction features.