You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn about the differences between the Microsoft Authentication Library for ObjectiveC (MSAL for iOS and macOS) and Azure AD Authentication Library for ObjectiveC (ADAL.ObjC) and how to migrate between them.
3
+
description: Learn about the differences between the Microsoft Authentication Library for Objective-C (MSAL for iOS and macOS) and Azure AD Authentication Library for Objective-C (ADAL.ObjC) and how to migrate between them.
4
4
services: active-directory
5
5
author: henrymbuguakiarie
6
6
manager: CelesteDG
@@ -9,73 +9,73 @@ ms.service: active-directory
9
9
ms.subservice: develop
10
10
ms.topic: how-to
11
11
ms.workload: identity
12
-
ms.date: 08/28/2019
12
+
ms.date: 01/18/2023
13
13
ms.author: henrymbugua
14
14
ms.reviewer: jak
15
15
ms.custom: aaddev, has-adal-ref
16
16
#Customer intent: As an application developer, I want to learn about how to use redirect URIs.
17
17
---
18
18
19
-
# Using redirect URIs with the Microsoft authentication library for iOS and macOS
19
+
# Using redirect URIs with the Microsoft Authentication Library (MSAL) for iOS and macOS
20
20
21
21
When a user authenticates, Azure Active Directory (Azure AD) sends the token to the app by using the redirect URI registered with the Azure AD application.
22
22
23
-
The Microsoft Authentication library (MSAL) requires that the redirect URI be registered with the Azure AD app in a specific format. MSAL uses a default redirect URI, if you don't specify one. The format is `msauth.[Your_Bundle_Id]://auth`.
23
+
The MSAL requires that the redirect URI be registered with the Azure AD app in a specific format. MSAL uses a default redirect URI, if you don't specify one. The format is `msauth.[Your_Bundle_Id]://auth`.
24
24
25
25
The default redirect URI format works for most apps and scenarios, including brokered authentication and system web view. Use the default format whenever possible.
26
26
27
-
However, you may need to change the redirect URI for advanced scenarios, as described below.
27
+
However, you may need to change the redirect URI for advanced scenarios, as described in the following section.
28
28
29
29
## Scenarios that require a different redirect URI
30
30
31
-
### Cross-app single signon (SSO)
31
+
### Cross-app single sign-on (SSO)
32
32
33
-
For the Microsoft Identity platform to share tokens across apps, each app needs to have the same client ID or application ID. This is the unique identifier provided when you registered your app in the portal (not the application bundle ID that you register per app with Apple).
33
+
For the Microsoft identity platform to share tokens across apps, each app needs to have the same client ID or application ID. The client ID is the unique identifier provided when you registered your app in the Azure portal (not the application bundle ID that you register per app with Apple).
34
34
35
35
The redirect URIs need to be different for each iOS app. This allows the Microsoft identity service to uniquely identify different apps that share an application ID. Each application can have multiple redirect URIs registered in the Azure portal. Each app in your suite will have a different redirect URI. For example:
36
36
37
37
Given the following application registration in the Azure portal:
38
38
39
-
* Client ID: `ABCDE-12345` (this is a single client ID)
When migrating code that used the Azure AD Authentication Library (ADAL) to MSAL, you may already have a redirect URI configured for your app. You can continue using the same redirect URI as long as your ADAL app was configured to support brokered scenarios and your redirect URI satisfies the MSAL redirect URI format requirements.
48
+
When migrating code that used the Azure Active Directory Authentication Library (ADAL) to MSAL, you may already have a redirect URI configured for your app. You can continue using the same redirect URI as long as your ADAL app was configured to support brokered scenarios and your redirect URI satisfies the MSAL redirect URI format requirements.
49
49
50
50
## MSAL redirect URI format requirements
51
51
52
-
* The MSAL redirect URI must be in the form `<scheme>://host`
52
+
- The MSAL redirect URI must be in the form `<scheme>://host`
53
53
54
-
Where `<scheme>` is a unique string that identifies your app. It's primarily based on the Bundle Identifier of your application to guarantee uniqueness. For example, if your app's Bundle ID is `com.contoso.myapp`, your redirect URI would be in the form: `msauth.com.contoso.myapp://auth`.
54
+
Where `<scheme>` is a unique string that identifies your app. It's primarily based on the Bundle Identifier of your application to guarantee uniqueness. For example, if your app's Bundle ID is `com.contoso.myapp`, your redirect URI would be in the form: `msauth.com.contoso.myapp://auth`.
55
55
56
-
If you're migrating from ADAL, your redirect URI will likely have this format: `<scheme>://[Your_Bundle_Id]`, where `scheme` is a unique string. This format will continue to work when you use MSAL.
56
+
If you're migrating from ADAL, your redirect URI will likely have this format: `<scheme>://[Your_Bundle_Id]`, where `scheme` is a unique string. The format will continue to work when you use MSAL.
57
57
58
-
*`<scheme>` must be registered in your app's Info.plist under `CFBundleURLTypes > CFBundleURLSchemes`. In this example, Info.plist has been opened as source code:
58
+
-`<scheme>` must be registered in your app's Info.plist under `CFBundleURLTypes > CFBundleURLSchemes`. In this example, Info.plist has been opened as source code:
59
59
60
-
```xml
61
-
<key>CFBundleURLTypes</key>
62
-
<array>
63
-
<dict>
64
-
<key>CFBundleURLSchemes</key>
65
-
<array>
66
-
<string>msauth.[BUNDLE_ID]</string>
67
-
</array>
68
-
</dict>
69
-
</array>
70
-
```
60
+
```xml
61
+
<key>CFBundleURLTypes</key>
62
+
<array>
63
+
<dict>
64
+
<key>CFBundleURLSchemes</key>
65
+
<array>
66
+
<string>msauth.[BUNDLE_ID]</string>
67
+
</array>
68
+
</dict>
69
+
</array>
70
+
```
71
71
72
72
MSAL will verify if your redirect URI registers correctly, and return an error if it's not.
73
-
74
-
* If you want to use universal links as a redirect URI, the `<scheme>` must be `https` and doesn't need to be declared in `CFBundleURLSchemes`. Instead, configure the app and domain per Apple's instructions at [Universal Links for Developers](https://developer.apple.com/ios/universal-links/) and call the `handleMSALResponse:sourceApplication:` method of `MSALPublicClientApplication` when your application is opened through a universal link.
73
+
74
+
- If you want to use universal links as a redirect URI, the `<scheme>` must be `https` and doesn't need to be declared in `CFBundleURLSchemes`. Instead, configure the app and domain per Apple's instructions at [Universal Links for Developers](https://developer.apple.com/ios/universal-links/) and call the `handleMSALResponse:sourceApplication:` method of `MSALPublicClientApplication` when your application is opened through a universal link.
75
75
76
76
## Use a custom redirect URI
77
77
78
-
To use a custom redirect URI, pass the `redirectUri` parameter to `MSALPublicClientApplicationConfig` and pass that object to `MSALPublicClientApplication` when you initialize the object. If the redirect URI is invalid, the initializer will return `nil` and set the `redirectURIError`with additional information. For example:
78
+
To use a custom redirect URI, pass the `redirectUri` parameter to `MSALPublicClientApplicationConfig` and pass that object to `MSALPublicClientApplication` when you initialize the object. If the redirect URI is invalid, the initializer will return `nil` and set the `redirectURIError`with additional information. For example:
79
79
80
80
Objective-C:
81
81
@@ -97,14 +97,12 @@ let config = MSALPublicClientApplicationConfig(clientId: "your-client-id",
97
97
authority: authority)
98
98
do {
99
99
let application = try MSALPublicClientApplication(configuration: config)
100
-
// continue on with application
100
+
// continue on with application
101
101
} catch let error as NSError {
102
102
// handle error here
103
-
}
103
+
}
104
104
```
105
105
106
-
107
-
108
106
## Handle the URL opened event
109
107
110
108
Your application should call MSAL when it receives any response through URL schemes or universal links. Call the `handleMSALResponse:sourceApplication:` method of `MSALPublicClientApplication` when your application is opened. Here's an example for custom schemes:
As an Azure Active Directory (Azure AD) [B2B collaboration](what-is-b2b.md) or [B2B direct connect](b2b-direct-connect-overview.md) user, you can leave an organization at any time if you no longer need to use apps from that organization, or maintain any association.
25
+
As an Azure Active Directory (Azure AD) B2B collaboration or B2B direct connect user, you can leave an organization at any time if you no longer need to use apps from that organization, or maintain any association.
26
26
27
-
You can usually leave an organization on your own without having to contact an administrator. However, in some cases this option won't be available and you'll need to contact your tenant admin, who can delete your account in the external organization. This article is intended for administrators. If you're a user looking for information about how to manage and leave an organization, see the [Manage organizations article.](https://support.microsoft.com/account-billing/manage-organizations-for-a-work-or-school-account-in-the-my-account-portal-a9b65a70-fec5-4a1a-8e00-09f99ebdea17)
You can usually leave an organization on your own without having to contact an administrator. However, in some cases this option won't be available and you'll need to contact your tenant admin, who can delete your account in the external organization. This article is intended for administrators. If you're a user looking for information about how to manage and leave an organization, see the [Manage organizations article.](https://support.microsoft.com/account-billing/manage-organizations-for-a-work-or-school-account-in-the-my-account-portal-a9b65a70-fec5-4a1a-8e00-09f99ebdea17)
30
30
31
31
## What organizations do I belong to?
32
32
33
33
1. To view the organizations you belong to, first open your **My Account** page. You either have a work or school account created by an organization or a personal account such as for Xbox, Hotmail, or Outlook.com.
34
34
35
35
- If you're using a work or school account, go to https://myaccount.microsoft.com and sign in.
36
-
- If you're using a personal account or email one-time passcode, you'll need to use a My Account URL that includes your tenant name or tenant ID, for example: https://myaccount.microsoft.com?tenantId=wingtiptoys.onmicrosoft.com or https://myaccount.microsoft.com?tenantId=ab123456-cd12-ef12-gh12-ijk123456789.
36
+
- If you're using a personal account or email one-time passcode, you'll need to use a My Account URL that includes your tenant name or tenant ID.
1. Select **Organizations** from the left navigation pane or select the **Manage organizations** link from the **Organizations** block.
39
43
@@ -66,7 +70,6 @@ In the **Home organization** section, there's no link to **Leave** your organiza
66
70
67
71
For the external organizations listed under **Other organizations you collaborate with**, you might not be able to leave on your own, for example when:
68
72
69
-
70
73
- the organization you want to leave doesn’t allow users to leave by themselves
71
74
- your account has been disabled
72
75
@@ -88,7 +91,6 @@ Administrators can use the **External user leave settings** to control whether e
88
91
-**Yes**: Users can leave the organization themselves without approval from your admin or privacy contact.
89
92
-**No**: Users can't leave your organization themselves. They'll see a message guiding them to contact your admin, or privacy contact to request removal from your organization.
90
93
91
-
92
94
:::image type="content" source="media/leave-the-organization/external-user-leave-settings.png" alt-text="Screenshot showing External user leave settings in the portal.":::
93
95
94
96
### Account removal
@@ -105,12 +107,12 @@ If desired, a tenant administrator can permanently delete the account at any tim
105
107
106
108
1. Select the check box next to a deleted user, and then select **Delete permanently**.
107
109
108
-
Permanent deletion can be initiated by the admin, or it happens at the end of the soft deletion period. Permanent deletion can take up to an extra 30 days for data removal ([learn more](/compliance/regulatory/gdpr-dsr-azure#step-5-delete)).
110
+
Permanent deletion can be initiated by the admin, or it happens at the end of the soft deletion period. Permanent deletion can take up to an extra 30 days for data removal.
111
+
112
+
For B2B direct connect users, data removal begins as soon as the user selects **Leave** in the confirmation message and can take up to 30 days to complete.
109
113
110
-
> [!NOTE]
111
-
> For B2B direct connect users, data removal begins as soon as the user selects **Leave** in the confirmation message and can take up to 30 days to complete ([learn more](/compliance/regulatory/gdpr-dsr-azure#delete-a-users-data-when-there-is-no-account-in-the-azure-tenant)).
112
114
113
115
## Next steps
114
116
115
-
- Learn more about [Azure AD B2B collaboration](what-is-b2b.md) and [Azure AD B2B direct connect](b2b-direct-connect-overview.md)
116
-
-[Use audit logs and access reviews](auditing-and-reporting.md)
117
+
- Learn more about [user deletion](/compliance/regulatory/gdpr-dsr-azure#step-5-delete) and about how to delete a user's data when there's [no account in the Azure tenant](/compliance/regulatory/gdpr-dsr-azure#delete-a-users-data-when-there-is-no-account-in-the-azure-tenant).
118
+
-For more information about GDPR, see the GDPR section of the [Service Trust portal](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted).
0 commit comments