Fix: Don't dismiss ASWebAuthenticationSession after successful completion

- Removed dismissExternalSession call after successful callback
- ASWebAuthenticationSession completion handler already cleans up the session
- After successful callback (msauth://profileInstalled), just set externalSessionHandler = nil
- Prevents attempting to cancel an already-completed session
- dismissExternalSession should only be called for error/cancellation scenarios
- Updated documentation to clarify when to use dismiss vs nil assignment
- Updated log messages to indicate dismissal is for active session cancellation
- cleanup method still dismisses if session is somehow still active (safety net)

Co-authored-by: Veena11 <9446116+Veena11@users.noreply.github.com>

Author: Copilot

IdentityCore/src/controllers/MSIDLocalInteractiveController.m

@@ -341,8 +341,10 @@ - (void)handleProfileInstallationCompletion:(NSURL *)callbackURL
         MSID_LOG_WITH_CTX(MSIDLogLevelInfo, self.requestParameters, 
                          @"Profile installation completed successfully (msauth://profileInstalled)");
 
-        // Dismiss the ASWebAuthenticationSession
-        [self.transitionCoordinator dismissExternalSession];
+        // ASWebAuthenticationSession has already completed successfully
+        // Its completion handler has fired, and the session has cleaned itself up
+        // We should NOT call dismiss (which would try to cancel it) - just release our reference
+        self.transitionCoordinator.externalSessionHandler = nil;
 
         // Resume the suspended embedded webview
         [self.transitionCoordinator resumeSuspendedEmbeddedWebview];
@@ -356,7 +358,7 @@ - (void)handleProfileInstallationCompletion:(NSURL *)callbackURL
         MSID_LOG_WITH_CTX(MSIDLogLevelWarning, self.requestParameters, 
                          @"Unexpected callback URL from profile installation: %@", callbackURL);
 
-        // Clean up
+        // Clean up - this will dismiss the session if still active
         [self.transitionCoordinator cleanup];
 
         // Create error for unexpected callback

IdentityCore/src/webview/MSIDWebviewTransitionCoordinator.h

@@ -78,6 +78,9 @@ NS_ASSUME_NONNULL_BEGIN
 
 /**
  * Dismisses the ASWebAuthenticationSession if active
+ * NOTE: Only call this if the session needs to be canceled (error, timeout, user cancellation).
+ * If the session has already completed successfully (completion handler fired with callback URL),
+ * the session has already cleaned itself up - just set externalSessionHandler = nil instead.
  */
 - (void)dismissExternalSession;
 

IdentityCore/src/webview/MSIDWebviewTransitionCoordinator.m

@@ -159,9 +159,11 @@ - (void)dismissExternalSession
 {
     if (self.externalSessionHandler)
     {
-        MSID_LOG_WITH_CTX(MSIDLogLevelInfo, nil, @"[MSIDWebviewTransitionCoordinator] Dismissing external session");
+        MSID_LOG_WITH_CTX(MSIDLogLevelInfo, nil, @"[MSIDWebviewTransitionCoordinator] Dismissing external session (canceling active session)");
 
-        // Dismiss the ASWebAuthenticationSession
+        // Cancel the ASWebAuthenticationSession
+        // NOTE: Only call this if the session is still active and needs to be canceled
+        // If the session has already completed (completion handler fired), it has cleaned itself up
         [self.externalSessionHandler dismiss];
         self.externalSessionHandler = nil;
     }
@@ -173,8 +175,11 @@ - (void)cleanup
 
     self.suspendedEmbeddedWebview = nil;
 
+    // Dismiss external session if still active (e.g., on error or cancellation)
+    // If the session completed successfully, it should already be nil
     if (self.externalSessionHandler)
     {
+        MSID_LOG_WITH_CTX(MSIDLogLevelVerbose, nil, @"[MSIDWebviewTransitionCoordinator] Dismissing active external session during cleanup");
         [self.externalSessionHandler dismiss];
         self.externalSessionHandler = nil;
     }