Merge pull request #1027 from AzureAD/release/1.6.9

oldalton · web-flow · commit 4e5e3b4105cc · 2021-08-20T15:34:07.000-07:00
Merge release 1.6.9 back to master
diff --git a/IdentityCore/IdentityCore.xcodeproj/project.pbxproj b/IdentityCore/IdentityCore.xcodeproj/project.pbxproj
@@ -1187,6 +1187,8 @@
 		B286BA03238A091B007833AD /* MSIDDefaultInteractiveTokenRequestTests.m in Sources */ = {isa = PBXBuildFile; fileRef = B2BE923621A0F99C00F5AB8C /* MSIDDefaultInteractiveTokenRequestTests.m */; };
 		B286BA06238A110A007833AD /* MSIDOIDCSignoutRequestTests.m in Sources */ = {isa = PBXBuildFile; fileRef = B286BA05238A110A007833AD /* MSIDOIDCSignoutRequestTests.m */; };
 		B286BA07238A110A007833AD /* MSIDOIDCSignoutRequestTests.m in Sources */ = {isa = PBXBuildFile; fileRef = B286BA05238A110A007833AD /* MSIDOIDCSignoutRequestTests.m */; };
+		B287C4CE26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m in Sources */ = {isa = PBXBuildFile; fileRef = B287C4CD26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m */; };
+		B287C4CF26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m in Sources */ = {isa = PBXBuildFile; fileRef = B287C4CD26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m */; };
 		B2893CB11FCF6A8C00E348E9 /* NSMutableDictionary+MSIDExtensions.m in Sources */ = {isa = PBXBuildFile; fileRef = 23BDA66D1FC78B7E00FE14BE /* NSMutableDictionary+MSIDExtensions.m */; };
 		B28AC66421A0BB9D00A1FC4A /* MSIDTestBrokerResponseHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = B28AC66221A0BB9D00A1FC4A /* MSIDTestBrokerResponseHelper.h */; };
 		B28AC66521A0BB9D00A1FC4A /* MSIDTestBrokerResponseHelper.m in Sources */ = {isa = PBXBuildFile; fileRef = B28AC66321A0BB9D00A1FC4A /* MSIDTestBrokerResponseHelper.m */; };
@@ -2621,6 +2623,7 @@
 		B286B9F3238A002E007833AD /* MSIDTestParametersProvider.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MSIDTestParametersProvider.h; sourceTree = "<group>"; };
 		B286B9F4238A002E007833AD /* MSIDTestParametersProvider.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MSIDTestParametersProvider.m; sourceTree = "<group>"; };
 		B286BA05238A110A007833AD /* MSIDOIDCSignoutRequestTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MSIDOIDCSignoutRequestTests.m; sourceTree = "<group>"; };
+		B287C4CD26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MSIDSSOExtensionRequestDelegateTests.m; sourceTree = "<group>"; };
 		B2893CAE1FCF68B200E348E9 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS11.0.sdk/System/Library/Frameworks/Security.framework; sourceTree = DEVELOPER_DIR; };
 		B28AC66221A0BB9D00A1FC4A /* MSIDTestBrokerResponseHelper.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MSIDTestBrokerResponseHelper.h; sourceTree = "<group>"; };
 		B28AC66321A0BB9D00A1FC4A /* MSIDTestBrokerResponseHelper.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MSIDTestBrokerResponseHelper.m; sourceTree = "<group>"; };
@@ -3202,6 +3205,7 @@
 				B217861023A57E0700839CE8 /* MSIDSSOExtensionSignoutRequestIntegrationTests.m */,
 				B216825B23AB069900F4897A /* MSIDSSOExtensionGetAccountsRequestIntegrationTests.m */,
 				B253153C23DD759400432133 /* MSIDSSOExtensionDeviceInfoRequestIntegrationTests.m */,
+				B287C4CD26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m */,
 			);
 			path = integration;
 			sourceTree = "<group>";
@@ -6281,6 +6285,7 @@
 				B27CCDD5229EF2C000CAD565 /* MSIDDictionaryExtensionsTests.m in Sources */,
 				B2DD4B3120A8DA0B0047A66E /* MSIDLegacyCacheQueryTests.m in Sources */,
 				B20E3CB21FC4FA550029C097 /* MSIDVersion.m in Sources */,
+				B287C4CE26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m in Sources */,
 				B29A36BB20AFAB0200427B63 /* MSIDDefaultAccessorSSOIntegrationTests.m in Sources */,
 				B2DD4B3820A922170047A66E /* MSIDDefaultAccountCacheQueryTests.m in Sources */,
 				B2936F4A20AA8E1F0050C585 /* MSIDCacheItemJsonSerializerTests.m in Sources */,
@@ -6719,6 +6724,7 @@
 				A08D0A3E24A85C9900C9193D /* MSIDDevicePopManagerTest.m in Sources */,
 				B2807FFC204CB16B00944D89 /* MSIDHelperTests.m in Sources */,
 				B26A0B9A2072BABE006BD95A /* MSIDAADV2Oauth2FactoryTests.m in Sources */,
+				B287C4CF26A132FA004303F1 /* MSIDSSOExtensionRequestDelegateTests.m in Sources */,
 				60BF06052051F9A200DE7C1C /* MSIDTelemetryTestDispatcher.m in Sources */,
 				233E970622656EB0007FCE2A /* MSIDTelemetryAggregatedTests.m in Sources */,
 				B2DD4B3E20A9270B0047A66E /* MSIDDefaultCredentialCacheQueryTests.m in Sources */,
diff --git a/IdentityCore/src/MSIDError.h b/IdentityCore/src/MSIDError.h
@@ -43,6 +43,8 @@ extern NSString * _Nonnull MSIDOAuthErrorDomain;
 extern NSString * _Nonnull MSIDKeychainErrorDomain;
 extern NSString * _Nonnull MSIDHttpErrorCodeDomain;
 
+extern NSExceptionName const _Nonnull MSIDGenericException;
+
 /*!
  List of scopes that were requested from MSAL, but not granted in the response.
 
@@ -256,3 +258,5 @@ extern MSIDErrorCode MSIDErrorCodeForOAuthError(NSString * _Nullable oauthError,
 extern NSDictionary<NSString *, NSArray *> * _Nonnull MSIDErrorDomainsAndCodes(void);
 
 extern void MSIDFillAndLogError(NSError * _Nullable __autoreleasing * _Nullable error, MSIDErrorCode errorCode, NSString * _Nullable errorDescription, NSUUID * _Nullable correlationID);
+
+#define MSIDException(name, message, info) [NSException exceptionWithName:name reason:[NSString stringWithFormat:@"%@ (function:%s line:%i)", message, __PRETTY_FUNCTION__, __LINE__]  userInfo:info]
diff --git a/IdentityCore/src/MSIDError.m b/IdentityCore/src/MSIDError.m
@@ -43,6 +43,8 @@
 NSString *MSIDInvalidTokenResultKey = @"MSIDInvalidTokenResultKey";
 NSInteger const MSIDSSOExtensionUnderlyingError = -6000;
 
+NSExceptionName const MSIDGenericException = @"MSIDGenericException";
+
 NSError *MSIDCreateError(NSString *domain, NSInteger code, NSString *errorDescription, NSString *oauthError, NSString *subError, NSError *underlyingError, NSUUID *correlationId, NSDictionary *additionalUserInfo, BOOL logErrorDescription)
 {
     id<MSIDErrorConverting> errorConverter = MSIDErrorConverter.errorConverter;
diff --git a/IdentityCore/src/cache/MSIDKeychainTokenCache.m b/IdentityCore/src/cache/MSIDKeychainTokenCache.m
@@ -71,7 +71,7 @@ + (void)setDefaultKeychainGroup:(NSString *)defaultKeychainGroup
     {
         MSID_LOG_WITH_CTX(MSIDLogLevelError, nil, @"Failed to set default keychain group, default keychain cache has already been instantiated.");
         
-        @throw @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.";
+        @throw MSIDException(MSIDGenericException, @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.", nil);
     }
     
     MSID_LOG_WITH_CTX_PII(MSIDLogLevelInfo, nil, @"Setting default keychain group to %@", MSID_PII_LOG_MASKABLE(defaultKeychainGroup));
diff --git a/IdentityCore/src/cache/mac/MSIDMacKeychainTokenCache.m b/IdentityCore/src/cache/mac/MSIDMacKeychainTokenCache.m
@@ -333,7 +333,7 @@ + (void)setDefaultKeychainGroup:(NSString *)defaultKeychainGroup
     {
         MSID_LOG_WITH_CTX(MSIDLogLevelError, nil, @"Failed to set default keychain group, default keychain cache has already been instantiated.");
 
-        @throw @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.";
+        @throw MSIDException(MSIDGenericException, @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.", nil);
     }
 
     MSID_LOG_WITH_CTX_PII(MSIDLogLevelInfo, nil, @"Setting default keychain group to %@", MSID_PII_LOG_MASKABLE(defaultKeychainGroup));
diff --git a/IdentityCore/src/logger/MSIDLogger.m b/IdentityCore/src/logger/MSIDLogger.m
@@ -77,7 +77,7 @@ - (void)setCallback:(MSIDLogCallback)callback
 {
     if (_callback != nil)
     {
-        @throw @"MSID logging callback can only be set once per process and should never changed once set.";
+        @throw MSIDException(MSIDGenericException, @"MSID logging callback can only be set once per process and should never changed once set.", nil);
     }
  
     static dispatch_once_t once;
diff --git a/IdentityCore/src/oauth2/MSIDOauth2Factory.m b/IdentityCore/src/oauth2/MSIDOauth2Factory.m
@@ -52,7 +52,7 @@ @implementation MSIDOauth2Factory
 
 + (MSIDProviderType)providerType
 {
-    @throw @"Abstract method was invoked.";
+    @throw MSIDException(MSIDGenericException, @"Abstract method was invoked.", nil);
 }
 
 #pragma mark - Response
diff --git a/IdentityCore/src/oauth2/MSIDTokenResponse.m b/IdentityCore/src/oauth2/MSIDTokenResponse.m
@@ -123,7 +123,7 @@ - (MSIDErrorCode)oauthErrorCode
 
 + (MSIDProviderType)providerType
 {
-    @throw @"Abstract method was invoked.";
+    @throw MSIDException(MSIDGenericException, @"Abstract method was invoked.", nil);
 }
 
 #pragma mark - Protected
diff --git a/IdentityCore/src/requests/broker/MSIDSSOExtensionGetAccountsRequest.m b/IdentityCore/src/requests/broker/MSIDSSOExtensionGetAccountsRequest.m
@@ -115,14 +115,15 @@ - (void)executeRequestWithCompletion:(nonnull MSIDGetAccountsRequestCompletionBl
     NSError *error;
     ASAuthorizationSingleSignOnRequest *ssoRequest = [self.ssoProvider createSSORequestWithOperationRequest:getAccountsRequest
                                                                                           requestParameters:self.requestParameters
+                                                                                                 requiresUI:NO
                                                                                                       error:&error];
     
     if (!ssoRequest)
     {
         completionBlock(nil, NO, error);
         return;
     }
-    
+        
     self.authorizationController = [self controllerWithRequest:ssoRequest];
     self.authorizationController.delegate = self.extensionDelegate;
     [self.authorizationController performRequests];
diff --git a/IdentityCore/src/requests/broker/MSIDSSOExtensionGetDeviceInfoRequest.m b/IdentityCore/src/requests/broker/MSIDSSOExtensionGetDeviceInfoRequest.m
@@ -100,14 +100,15 @@ - (void)executeRequestWithCompletion:(nonnull MSIDGetDeviceInfoRequestCompletion
     NSError *error;
     ASAuthorizationSingleSignOnRequest *ssoRequest = [self.ssoProvider createSSORequestWithOperationRequest:getDeviceInfoRequest
                                                                                           requestParameters:self.requestParameters
+                                                                                                 requiresUI:NO
                                                                                                       error:&error];
     
     if (!ssoRequest)
     {
         completionBlock(nil, error);
         return;
     }
-    
+        
     self.authorizationController = [self controllerWithRequest:ssoRequest];
     self.authorizationController.delegate = self.extensionDelegate;
     [self.authorizationController performRequests];
diff --git a/IdentityCore/src/requests/broker/MSIDSSOExtensionInteractiveTokenRequest.m b/IdentityCore/src/requests/broker/MSIDSSOExtensionInteractiveTokenRequest.m
@@ -150,6 +150,7 @@ - (void)executeRequestWithCompletion:(MSIDInteractiveRequestCompletionBlock)comp
     
         ASAuthorizationSingleSignOnRequest *ssoRequest = [self.ssoProvider createRequest];
         ssoRequest.requestedOperation = [operationRequest.class operation];
+        [ASAuthorizationSingleSignOnProvider setRequiresUI:YES forRequest:ssoRequest];
         
         NSDictionary *jsonDictionary = [operationRequest jsonDictionary];
         
diff --git a/IdentityCore/src/requests/broker/MSIDSSOExtensionRequestDelegate.m b/IdentityCore/src/requests/broker/MSIDSSOExtensionRequestDelegate.m
@@ -48,29 +48,52 @@ - (void)authorizationController:(__unused ASAuthorizationController *)controller
     NSAssert(NO, @"Abstract method. Should be implemented in a subclass");
 }
 
-- (void)authorizationController:(__unused ASAuthorizationController *)controller didCompleteWithError:(NSError *)error
-{
-    MSID_LOG_WITH_CTX_PII(MSIDLogLevelError, self.context, @"Received error from SSO extension: %@", MSID_PII_LOG_MASKABLE(error));
-    
-    assert(self.completionBlock);
-    if (!self.completionBlock) return;
-    
-    NSError *underlyingError = error.userInfo[NSUnderlyingErrorKey];
-    
-    if ([error.domain isEqualToString:ASAuthorizationErrorDomain] && error.code == MSIDSSOExtensionUnderlyingError && underlyingError)
-    {
-        self.completionBlock(nil, underlyingError);
-    }
-    else if ([error.domain isEqualToString:ASAuthorizationErrorDomain] && error.code == ASAuthorizationErrorCanceled)
-    {
-        NSError *cancelledError = MSIDCreateError(MSIDErrorDomain, MSIDErrorUserCancel, @"SSO extension authorization was canceled", nil, nil, nil, nil, nil, YES);
-        self.completionBlock(nil, cancelledError);
-    }
-    else
-    {
-        self.completionBlock(nil, error);
-    }
-}
+ - (void)authorizationController:(__unused ASAuthorizationController *)controller didCompleteWithError:(NSError *)error
+ {
+     MSID_LOG_WITH_CTX_PII(MSIDLogLevelError, self.context, @"Received error from SSO extension: %@", MSID_PII_LOG_MASKABLE(error));
+     
+     assert(self.completionBlock);
+     if (!self.completionBlock) return;
+     
+     NSError *underlyingError = error.userInfo[NSUnderlyingErrorKey];
+     
+     BOOL isSSOExtensionError = [error.domain isEqualToString:ASAuthorizationErrorDomain];
+     BOOL isSSOExtensionInteractionRequiredError = NO;
+     
+ #if __IPHONE_OS_VERSION_MAX_ALLOWED >= 150000 || __MAC_OS_X_VERSION_MAX_ALLOWED >= 120000
+     if (@available(iOS 15.0, macOS 12.0, *))
+     {
+         isSSOExtensionInteractionRequiredError = isSSOExtensionError && error.code == ASAuthorizationErrorNotInteractive;
+     }
+ #endif
+     
+     if (isSSOExtensionError && error.code == MSIDSSOExtensionUnderlyingError)
+     {
+         if (underlyingError)
+         {
+             self.completionBlock(nil, underlyingError);
+         }
+         else
+         {
+             NSError *unexpectedError = MSIDCreateError(MSIDErrorDomain, MSIDErrorBrokerCorruptedResponse, @"SSO extension returned corrupted error. Please upload Microsoft Authenticator logs to investigate.", nil, nil, nil, nil, nil, YES);
+             self.completionBlock(nil, unexpectedError);
+         }
+     }
+     else if (isSSOExtensionError && error.code == ASAuthorizationErrorCanceled)
+     {
+         NSError *cancelledError = MSIDCreateError(MSIDErrorDomain, MSIDErrorUserCancel, @"SSO extension authorization was canceled", nil, nil, nil, nil, nil, YES);
+         self.completionBlock(nil, cancelledError);
+     }
+     else if (isSSOExtensionInteractionRequiredError)
+     {
+         NSError *interactionRequiredError = MSIDCreateError(MSIDErrorDomain, MSIDErrorInteractionRequired, @"SSO extension authorization requires interaction", nil, nil, nil, nil, nil, YES);
+         self.completionBlock(nil, interactionRequiredError);
+     }
+     else
+     {
+         self.completionBlock(nil, error);
+     }
+ }
 
 #pragma mark - Protected
 
diff --git a/IdentityCore/src/requests/broker/MSIDSSOExtensionSignoutRequest.m b/IdentityCore/src/requests/broker/MSIDSSOExtensionSignoutRequest.m
@@ -126,6 +126,7 @@ - (void)executeRequestWithCompletion:(nonnull MSIDSignoutRequestCompletionBlock)
     
     ASAuthorizationSingleSignOnRequest *ssoRequest = [self.ssoProvider createRequest];
     ssoRequest.requestedOperation = [signoutRequest.class operation];
+    [ASAuthorizationSingleSignOnProvider setRequiresUI:NO forRequest:ssoRequest];
     
     NSDictionary *jsonDictionary = [signoutRequest jsonDictionary];
     
diff --git a/IdentityCore/src/requests/broker/MSIDSSOExtensionSilentTokenRequest.m b/IdentityCore/src/requests/broker/MSIDSSOExtensionSilentTokenRequest.m
@@ -202,6 +202,7 @@ - (void)executeRequestImplWithCompletionBlock:(MSIDRequestCompletionBlock _Nonnu
     ssoRequest.requestedOperation = [self.operationRequest.class operation];
     __auto_type queryItems = [jsonDictionary msidQueryItems];
     ssoRequest.authorizationOptions = queryItems;
+    [ASAuthorizationSingleSignOnProvider setRequiresUI:NO forRequest:ssoRequest];
     
     self.authorizationController = [[ASAuthorizationController alloc] initWithAuthorizationRequests:@[ssoRequest]];
     self.authorizationController.delegate = self.extensionDelegate;
diff --git a/IdentityCore/src/util/ASAuthorizationSingleSignOnProvider+MSIDExtensions.h b/IdentityCore/src/util/ASAuthorizationSingleSignOnProvider+MSIDExtensions.h
@@ -33,8 +33,11 @@ NS_ASSUME_NONNULL_BEGIN
 
 + (ASAuthorizationSingleSignOnProvider *)msidSharedProvider;
 
++ (void)setRequiresUI:(BOOL)requiresUI forRequest:(ASAuthorizationSingleSignOnRequest *)ssoRequest;
+
 - (nullable ASAuthorizationSingleSignOnRequest *)createSSORequestWithOperationRequest:(MSIDBrokerOperationRequest *)operationRequest
                                                                     requestParameters:(MSIDRequestParameters *)requestParameters
+                                                                           requiresUI:(BOOL)requiresUI
                                                                                 error:(NSError * _Nullable * _Nullable)error;
 
 @end
diff --git a/IdentityCore/src/util/ASAuthorizationSingleSignOnProvider+MSIDExtensions.m b/IdentityCore/src/util/ASAuthorizationSingleSignOnProvider+MSIDExtensions.m
@@ -38,6 +38,7 @@ + (ASAuthorizationSingleSignOnProvider *)msidSharedProvider
 
 - (ASAuthorizationSingleSignOnRequest *)createSSORequestWithOperationRequest:(MSIDBrokerOperationRequest *)operationRequest
                                                            requestParameters:(MSIDRequestParameters *)requestParameters
+                                                                  requiresUI:(BOOL)requiresUI
                                                                        error:(NSError **)error
 {
     [MSIDBrokerOperationRequest fillRequest:operationRequest
@@ -47,6 +48,7 @@ - (ASAuthorizationSingleSignOnRequest *)createSSORequestWithOperationRequest:(MS
     
     ASAuthorizationSingleSignOnRequest *ssoRequest = [self createRequest];
     ssoRequest.requestedOperation = [operationRequest.class operation];
+    [self.class setRequiresUI:requiresUI forRequest:ssoRequest];
     
     NSDictionary *jsonDictionary = [operationRequest jsonDictionary];
     
@@ -62,5 +64,15 @@ - (ASAuthorizationSingleSignOnRequest *)createSSORequestWithOperationRequest:(MS
     return ssoRequest;
 }
 
++ (void)setRequiresUI:(BOOL)requiresUI forRequest:(ASAuthorizationSingleSignOnRequest *)ssoRequest
+{    
+#if __IPHONE_OS_VERSION_MAX_ALLOWED >= 150000 || __MAC_OS_X_VERSION_MAX_ALLOWED >= 120000
+    if (@available(iOS 15.0, macOS 12.0, *))
+    {
+        ssoRequest.userInterfaceEnabled = requiresUI;
+    }
+#endif
+}
+
 @end
 #endif
diff --git a/IdentityCore/src/util/NSURL+MSIDExtensions.m b/IdentityCore/src/util/NSURL+MSIDExtensions.m
@@ -141,7 +141,7 @@ - (NSURL *)msidURLForHost:(NSString *)preferredHost context:(id<MSIDRequestConte
             {
                 // setPercentEncodedHost and setPort both throw if there's an error, so it's okay for
                 // us to throw here as well to propogate the error
-                @throw [NSException exceptionWithName:@"InvalidNumberFormatException" reason:@"Port is not a valid integer or port" userInfo:nil];
+                @throw MSIDException(MSIDGenericException, @"Port is not a valid integer or port.", nil);
                 MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Port is not a valid integer or port.");
             }
             components.port = [NSNumber numberWithInt:port];
diff --git a/IdentityCore/src/validation/MSIDAadAuthorityCache.m b/IdentityCore/src/validation/MSIDAadAuthorityCache.m
@@ -226,7 +226,7 @@ - (void)addInvalidRecord:(MSIDAADAuthority *)authority
             // setPercentEncodedHost and setPort both throw if there's an error. The validation code runs
             // this function in a try block first to make sure the data is valid, so it's okay for
             // us to throw here as well to propogate the error
-            @throw [NSException exceptionWithName:@"InvalidNumberFormatException" reason:@"Port is not a valid integer or port" userInfo:nil];
+            @throw MSIDException(MSIDGenericException, @"Port is not a valid integer or port.", nil);
         }
         components.port = [NSNumber numberWithInt:port];
     }
diff --git a/IdentityCore/src/webview/embeddedWebview/challangeHandlers/mac/MSIDCertAuthHandler.m b/IdentityCore/src/webview/embeddedWebview/challangeHandlers/mac/MSIDCertAuthHandler.m
@@ -106,6 +106,7 @@ + (void)promptUserForIdentity:(NSArray *)issuers
     NSMutableDictionary *query =
     [@{
        (id)kSecClass : (id)kSecClassIdentity,
+       (id)kSecReturnRef: @YES,
        (id)kSecMatchLimit : (id)kSecMatchLimitAll,
        } mutableCopy];
     
diff --git a/IdentityCore/src/workplacejoin/MSIDPkeyAuthHelper.m b/IdentityCore/src/workplacejoin/MSIDPkeyAuthHelper.m
diff --git a/IdentityCore/tests/MSIDPkeyAuthHelperTests.m b/IdentityCore/tests/MSIDPkeyAuthHelperTests.m
diff --git a/IdentityCore/tests/integration/MSIDSSOExtensionRequestDelegateTests.m b/IdentityCore/tests/integration/MSIDSSOExtensionRequestDelegateTests.m
diff --git a/changelog.txt b/changelog.txt

Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,8 @@`
`43`	`43`	`NSString *MSIDInvalidTokenResultKey = @"MSIDInvalidTokenResultKey";`
`44`	`44`	`NSInteger const MSIDSSOExtensionUnderlyingError = -6000;`
`45`	`45`
	`46`	`+NSExceptionName const MSIDGenericException = @"MSIDGenericException";`
	`47`	`+`
`46`	`48`	`NSError MSIDCreateError(NSString domain, NSInteger code, NSString errorDescription, NSString oauthError, NSString subError, NSError underlyingError, NSUUID correlationId, NSDictionary additionalUserInfo, BOOL logErrorDescription)`
`47`	`49`	`{`
`48`	`50`	`id<MSIDErrorConverting> errorConverter = MSIDErrorConverter.errorConverter;`
Original file line number	Diff line number	Diff line change
`@@ -71,7 +71,7 @@ + (void)setDefaultKeychainGroup:(NSString *)defaultKeychainGroup`
`71`	`71`	`{`
`72`	`72`	`MSID_LOG_WITH_CTX(MSIDLogLevelError, nil, @"Failed to set default keychain group, default keychain cache has already been instantiated.");`
`73`	`73`
`74`		`- @throw @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.";`
	`74`	`+ @throw MSIDException(MSIDGenericException, @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.", nil);`
`75`	`75`	`}`
`76`	`76`
`77`	`77`	`MSID_LOG_WITH_CTX_PII(MSIDLogLevelInfo, nil, @"Setting default keychain group to %@", MSID_PII_LOG_MASKABLE(defaultKeychainGroup));`
Original file line number	Diff line number	Diff line change
`@@ -333,7 +333,7 @@ + (void)setDefaultKeychainGroup:(NSString *)defaultKeychainGroup`
`333`	`333`	`{`
`334`	`334`	`MSID_LOG_WITH_CTX(MSIDLogLevelError, nil, @"Failed to set default keychain group, default keychain cache has already been instantiated.");`
`335`	`335`
`336`		`- @throw @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.";`
	`336`	`+ @throw MSIDException(MSIDGenericException, @"Attempting to change the keychain group once AuthenticationContexts have been created or the default keychain cache has been retrieved is invalid. The default keychain group should only be set once for the lifetime of an application.", nil);`
`337`	`337`	`}`
`338`	`338`
`339`	`339`	`MSID_LOG_WITH_CTX_PII(MSIDLogLevelInfo, nil, @"Setting default keychain group to %@", MSID_PII_LOG_MASKABLE(defaultKeychainGroup));`
Original file line number	Diff line number	Diff line change
`@@ -77,7 +77,7 @@ - (void)setCallback:(MSIDLogCallback)callback`
`77`	`77`	`{`
`78`	`78`	`if (_callback != nil)`
`79`	`79`	`{`
`80`		`- @throw @"MSID logging callback can only be set once per process and should never changed once set.";`
	`80`	`+ @throw MSIDException(MSIDGenericException, @"MSID logging callback can only be set once per process and should never changed once set.", nil);`
`81`	`81`	`}`
`82`	`82`
`83`	`83`	`static dispatch_once_t once;`
Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ @implementation MSIDOauth2Factory`
`52`	`52`
`53`	`53`	`+ (MSIDProviderType)providerType`
`54`	`54`	`{`
`55`		`- @throw @"Abstract method was invoked.";`
	`55`	`+ @throw MSIDException(MSIDGenericException, @"Abstract method was invoked.", nil);`
`56`	`56`	`}`
`57`	`57`
`58`	`58`	`#pragma mark - Response`
Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,7 @@ - (MSIDErrorCode)oauthErrorCode`
`123`	`123`
`124`	`124`	`+ (MSIDProviderType)providerType`
`125`	`125`	`{`
`126`		`- @throw @"Abstract method was invoked.";`
	`126`	`+ @throw MSIDException(MSIDGenericException, @"Abstract method was invoked.", nil);`
`127`	`127`	`}`
`128`	`128`
`129`	`129`	`#pragma mark - Protected`