Wrapped IOS app using custom AAD client not working

Question

Wrapped IOS app using custom AAD client not working

Closed this issue 3 years ago · 17 comments

We have a in-house IOS app that uses a custom Azure AD client app to authenticate. The AAD client app is configured for MSAL. It has Graph and MAM api delegates. The app on its own can successfully connect and authenticate using the AAD client app.

Next we wrap the app using the Intune App wrapping tool for iOS (version 12.7.0) and specify the AAD client id and related parameters using -aa, -ac and -ar options. Ref: https://docs.microsoft.com/en-us/mem/intune/developer/app-wrapper-prepare-ios

When the wrapped app is launched, we get a Sign In popup - "To protect its data, your organization needs to manage this app. To complete this action, sign in with your work or school account." and then a white screen. The app is unable to connect to Azure and keeps spinning on the white screen.

Any idea what's going on? All help is appreciated.

Thanks,

Answer 1 · 2020-09-11T15:07:46.000Z

Hi @PushpitaPawar - question: When you open the "Frameworks" directory inside of the app bundle, do you see both ADAL.framework and MSAL.framework?

Answer 2 · 2020-09-11T15:51:52.000Z

Hi @Kyle-Reis,

Yes, I do see both the frameworks. There are 3 in total: ADAL.framework, MSAL.framework and IntuneMAM.framework. Guess the presence of ADAL.framework is causing the conflict. How do I get rid of it? The pre-wrapped IPA has only MSAL.framework. The other 2 are added by the IntuneWrapper sdk.

Thanks,
Pushpita

Answer 3 · 2020-09-11T16:52:43.000Z

@PushpitaPawar, we will need to make a fix on our end to check for existence of MSAL and not inject the ADAL framework in this scenario. In the meantime, one thing you could try is to remove the ADAL framework from the bundle and resign using the codesign command.

Answer 4 · 2020-09-11T19:43:14.000Z

@Kyle-Reis , thanks. I will try to resign after removing ADAL framework. Will keep you posted. Do you have a timeline for the fix in the sdk?

Thanks,
Pushpita

Answer 5 · 2020-09-22T14:16:37.000Z

@Kyle-Reis , the re-signing after removing the ADAL framework did not work. Do you have a new version with the fix for MSAL? We need the fix urgently. This is a production app affecting a couple of thousand users and the delay is getting difficult to manage. Please prioritize this fix.

Thanks,
Pushpita

Answer 6 · 2020-09-22T15:03:58.000Z

Hey @PushpitaPawar, may I ask why you are trying to wrap this app instead of integrating the SDK and calling registerAndEnrollAccount to silently enroll in MAM after the app has authenticated?

Answer 7 · 2020-09-22T15:22:22.000Z

@Kyle-Reis, this is how we were told to wrap apps so that the apps are managed by Intune a few years back by Microsoft Support. In fact, I had worked with Aasawari Navathe at that time. Are you saying we should not use the app wrapping tool anymore? This is a cordova/Ionic app. I do not see SDK for cordova.

Answer 8 · 2020-09-22T16:04:32.000Z

@PushpitaPawar, that makes sense. I was under the impression that this was a native Objective-C/Swift app. How does the app integrate MSAL? Did you develop a Cordova plugin for the native MSAL SDK?

Answer 9 · 2020-09-22T17:39:25.000Z

@Kyle-Reis, app uses cordova-plugin-msal and connects to client app in our AAD tenant.

Answer 10 · 2020-09-23T16:45:04.000Z

Hi @PushpitaPawar, which version of MSAL is your app linking to?

Answer 11 · 2020-09-23T17:29:25.000Z

@Kyle-Reis, App is using cordova-plugin-msal, version 2.5.0; @azure/msal-angular, version 1.0.0 and msal 1.3.3

Answer 12 · 2020-09-23T18:27:11.000Z

@PushpitaPawar, does your app have these schemes listed under LSApplicationQueriesSchemes in its Info.plist?

Answer 13 · 2020-09-23T19:16:38.000Z

@Kyle-Reis, Yes both schemes are present under LSApplicationQueriesSchemes in its Info.plist

Answer 14 · 2020-09-30T20:40:56.000Z

Hey @Kyle-Reis, how is the MSAL integration coming along? If you have a test version ready, I can help test it.
Thanks, Pushpita

Answer 15 · 2021-03-09T15:11:45.000Z

Hi @PushpitaPawar - checking in to see if your issue has been resolved?

Answer 16 · 2021-03-09T15:30:08.000Z

Hey Kyle, honestly we haven’t gone back to re-using the app wrapping sdk after the issues. Most of our users got used to the non-wrapped behavior. Will try again soon. Thanks, Pushpita From: Kyle Reis <notifications@github.com> Reply-To: msintuneappsdk/intune-app-wrapping-tool-ios <reply@reply.github.com> Date: Tuesday, March 9, 2021 at 10:14 AM To: msintuneappsdk/intune-app-wrapping-tool-ios <intune-app-wrapping-tool-ios@noreply.github.com> Cc: PUSHPITA PAWAR <Pushpita.R.Pawar@scana.com>, Mention <mention@noreply.github.com> Subject: Re: [msintuneappsdk/intune-app-wrapping-tool-ios] Wrapped IOS app using custom AAD client not working (#45) ***This is an EXTERNAL email from Kyle Reis (noreply@github.com). Please do not click on a link or open any attachments unless you are confident it is from a trusted source.

…

________________________________ Hi @PushpitaPawar<https://urldefense.com/v3/__https:/github.com/PushpitaPawar__;!!KQQRbYJqkXCDY_8FAQ!VBTwJ8IXmMP6OMEFE-ZePQd_9yk7-uJOztx63ZHUyvHDJTZe42UtXgyETpl_Qd1LFxDXm4My5Q$> - checking in to see if your issue has been resolved? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://urldefense.com/v3/__https:/github.com/msintuneappsdk/intune-app-wrapping-tool-ios/issues/45*issuecomment-794025827__;Iw!!KQQRbYJqkXCDY_8FAQ!VBTwJ8IXmMP6OMEFE-ZePQd_9yk7-uJOztx63ZHUyvHDJTZe42UtXgyETpl_Qd1LFxChGovY8A$>, or unsubscribe<https://urldefense.com/v3/__https:/github.com/notifications/unsubscribe-auth/AIGKDORRVPJXWFO4MTUIUXTTCYUDJANCNFSM4QTQWWIQ__;!!KQQRbYJqkXCDY_8FAQ!VBTwJ8IXmMP6OMEFE-ZePQd_9yk7-uJOztx63ZHUyvHDJTZe42UtXgyETpl_Qd1LFxAupKdZTg$>. CONFIDENTIALITY NOTICE: This electronic message contains information which may be legally confidential and or privileged and does not in any case represent a firm ENERGY COMMODITY bid or offer relating thereto which binds the sender without an additional express written confirmation to that effect. The information is intended solely for the individual or entity named above and access by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.

Answer 17 · 2021-09-01T14:24:08.000Z

Closing this issue due to inactivity. Feel free to open again if issue persists.