You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/develop/msal-android-single-sign-on.md
+25-28Lines changed: 25 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.workload: identity
11
11
ms.tgt_pltfrm: android
12
12
ms.devlang: java
13
13
ms.topic: how-to
14
-
ms.date: 10/15/2020
14
+
ms.date: 01/17/2023
15
15
ms.author: henrymbugua
16
16
---
17
17
@@ -25,20 +25,17 @@ In this how-to, you'll learn how to configure the SDKs used by your application
25
25
26
26
## Prerequisites
27
27
28
-
This how-to assumes you know how to:
29
-
30
28
- Provision your app using the Azure portal. For more information about app provision, see the instructions for creating an app in [the Android tutorial](./tutorial-v2-android.md#create-a-project)
31
29
- Integrate your application with the [MSAL for Android](https://github.com/AzureAD/microsoft-authentication-library-for-android)
32
30
33
31
## Methods for single sign-on
34
32
35
33
There are two ways for applications using MSAL for Android to achieve SSO:
36
34
37
-
* Through a [broker application](#sso-through-brokered-authentication)
38
-
* Through the [system browser](#sso-through-system-browser)
39
-
35
+
- Through a [broker application](#sso-through-brokered-authentication)
36
+
- Through the [system browser](#sso-through-system-browser)
40
37
41
-
It's recommended to use a broker application for benefits like device-wide SSO, account management, and conditional access. However, it requires your users to download additional applications.
38
+
It's recommended to use a broker application for benefits like device-wide SSO, account management, and conditional access. However, it requires your users to download additional applications.
42
39
43
40
## SSO through brokered authentication
44
41
@@ -50,7 +47,7 @@ We recommend that you use one of Microsoft's authentication brokers to participa
50
47
- Device Registration (Workplace Join)
51
48
- Mobile Device Management
52
49
- Device-wide Account Management
53
-
-via Android AccountManager & Account Settings
50
+
- via Android AccountManager & Account Settings
54
51
- "Work Account" - custom account type
55
52
56
53
On Android, the Microsoft Authentication Broker is a component that's included in the [Microsoft Authenticator](https://play.google.com/store/apps/details?id=com.azure.authenticator) and [Intune Company Portal](https://play.google.com/store/apps/details?id=com.microsoft.windowsintune.companyportal) apps.
@@ -87,7 +84,7 @@ Installing a broker doesn't require the user to sign in again. Only when the use
87
84
88
85
If there's only one broker hosting app installed, and it's removed, then the user will need to sign in again. Uninstalling the active broker removes the account and associated tokens from the device.
89
86
90
-
If Intune Company Portal is installed and is operating as the active broker, and Microsoft Authenticator is also installed, then if the Intune Company Portal (active broker) is uninstalled the user will need to sign in again. Once they sign in again, the Microsoft Authenticator app becomes the active broker.
87
+
If Intune Company Portal is installed and is operating as the active broker, and Microsoft Authenticator is also installed, then if the Intune Company Portal (active broker) is uninstalled the user will need to sign in again. Once they sign in again, the Microsoft Authenticator app becomes the active broker.
Once you've generated a signature hash with *keytool*, use the Azure portal to generate the redirect URI:
111
+
Once you've generated a signature hash with _keytool_, use the Azure portal to generate the redirect URI:
115
112
116
113
1. Sign in to the <ahref="https://portal.azure.com/"target="_blank">Azure portal</a>.
117
114
1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="/azure/active-directory/develop/media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you registered your application.
@@ -154,7 +151,7 @@ If you get an `MsalClientException` with error code `"BROKER_BIND_FAILURE"`, the
154
151
It might not be immediately clear that broker integration is working, but you can use the following steps to check:
155
152
156
153
1. On your Android device, complete a request using the broker.
157
-
1. In the settings on your Android device, look for a newly created account corresponding to the account that you authenticated with. The account should be of type *Work account*.
154
+
1. In the settings on your Android device, look for a newly created account corresponding to the account that you authenticated with. The account should be of type _Work account_.
158
155
159
156
You can remove the account from settings if you want to repeat the test.
160
157
@@ -166,7 +163,7 @@ Android applications have the option to use the WebView, system browser, or Chro
166
163
167
164
Choosing a specific strategy for authorization agents is optional and represents additional functionality apps can customize. Most apps will use the MSAL defaults (see [Understand the Android MSAL configuration file](msal-configuration.md) to see the various defaults).
168
165
169
-
MSAL supports authorization using a `WebView`, or the system browser. The image below shows how it looks using the `WebView`, or the system browser with CustomTabs or without CustomTabs:
166
+
MSAL supports authorization using a `WebView`, or the system browser. The image below shows how it looks using the `WebView`, or the system browser with CustomTabs or without CustomTabs:
@@ -176,7 +173,7 @@ By default, applications integrated with MSAL use the system browser's Custom Ta
176
173
177
174
If the application uses a `WebView` strategy without integrating Microsoft Authenticator or Company Portal support into their app, users won't have a single sign-on experience across the device or between native apps and web apps.
178
175
179
-
If the application uses MSAL with a broker like Microsoft Authenticator or Intune Company Portal, then users can have a SSO experience across applications if they have an active sign-in with one of the apps.
176
+
If the application uses MSAL with a broker like Microsoft Authenticator or Intune Company Portal, then users can have SSO experience across applications if they have an active sign-in with one of the apps.
180
177
181
178
### WebView
182
179
@@ -186,7 +183,7 @@ To use the in-app WebView, put the following line in the app configuration JSON
186
183
"authorization_user_agent" : "WEBVIEW"
187
184
```
188
185
189
-
When using the in-app `WebView`, the user signs in directly to the app. The tokens are kept inside the sandbox of the app and aren't available outside the app's cookie jar. As a result, the user can't have a SSO experience across applications unless the apps integrate with the Authenticator or Company Portal.
186
+
When using the in-app `WebView`, the user signs in directly to the app. The tokens are kept inside the sandbox of the app and aren't available outside the app's cookie jar. As a result, the user can't have SSO experience across applications unless the apps integrate with the Authenticator or Company Portal.
190
187
191
188
However, `WebView` does provide the capability to customize the look and feel for sign-in UI. See [Android WebViews](https://developer.android.com/reference/android/webkit/WebView) for more about how to do this customization.
192
189
@@ -198,36 +195,36 @@ By default, MSAL uses the browser and a [custom tabs](https://developer.chrome.c
198
195
"authorization_user_agent" : "BROWSER"
199
196
```
200
197
201
-
Use this approach to provide a SSO experience through the device's browser. MSAL uses a shared cookie jar, which allows other native apps or web apps to achieve SSO on the device by using the persist session cookie set by MSAL.
198
+
Use this approach to provide SSO experience through the device's browser. MSAL uses a shared cookie jar, which allows other native apps or web apps to achieve SSO on the device by using the persist session cookie set by MSAL.
202
199
203
200
### Browser selection heuristic
204
201
205
202
Because it's impossible for MSAL to specify the exact browser package to use on each of the broad array of Android phones, MSAL implements a browser selection heuristic that tries to provide the best cross-device SSO.
206
203
207
204
MSAL primarily retrieves the default browser from the package manager and checks if it is in a tested list of safe browsers. If not, MSAL falls back on using the Webview rather than launching another non-default browser from the safe list. The default browser will be chosen regardless of whether it supports custom tabs. If the browser supports Custom Tabs, MSAL will launch the Custom Tab. Custom Tabs have a look and feel closer to an in-app `WebView` and allow basic UI customization. See [Custom Tabs in Android](https://developer.chrome.com/multidevice/android/customtabs) to learn more.
208
205
209
-
If there are no browser packages on the device, MSAL uses the in-app `WebView`. If the device default setting isn't changed, the same browser should be launched for each sign in to ensure a SSO experience.
206
+
If there are no browser packages on the device, MSAL uses the in-app `WebView`. If the device default setting isn't changed, the same browser should be launched for each sign in to ensure SSO experience.
210
207
211
208
#### Tested Browsers
212
209
213
210
The following browsers have been tested to see if they correctly redirect to the `"redirect_uri"` specified in the configuration file:
<sup>1</sup>Samsung's built-in browser is Samsung Internet.<br/>
228
225
<sup>2</sup>Huawei's built-in browser is Huawei Browser.<br/>
229
226
<sup>3</sup>The default browser can't be changed inside the Oppo device setting.
230
227
231
228
## Next steps
232
229
233
-
[Shared device mode for Android devices](msal-android-shared-devices.md) allows you to configure an Android device so that it can be easily shared by multiple employees.
230
+
[Shared device mode for Android devices](msal-android-shared-devices.md) allows you to configure an Android device so that it can be easily shared by multiple employees.
0 commit comments