[MAJOR][feature]: Release/1.26.0

IdentityCore/src/MSIDConstants.h

@@ -125,12 +125,15 @@ extern NSString * _Nonnull const MSID_PLATFORM_KEY;//The SDK platform. iOS or OS
 extern NSString * _Nonnull const MSID_SOURCE_PLATFORM_KEY;//The source SDK platform. iOS or OSX
 extern NSString * _Nonnull const MSID_PLATFORM_SEQUENCE_KEY;
 extern NSString * _Nonnull const MSID_VERSION_KEY;
+extern NSString * _Nonnull const MSID_BROKER_VER_KEY;//x-client-brkrver (broker only)
 extern NSString * _Nonnull const MSID_CPU_KEY;//E.g. ARM64
 extern NSString * _Nonnull const MSID_OS_VER_KEY;//iOS/OSX version
 extern NSString * _Nonnull const MSID_DEVICE_MODEL_KEY;//E.g. iPhone 5S
 extern NSString * _Nonnull const MSID_APP_NAME_KEY;
 extern NSString * _Nonnull const MSID_APP_VER_KEY;
+extern NSString * _Nonnull const MSID_APP_CLIENT_ID_KEY;//x-ms-client-id (source app OAuth client ID, broker only)
 extern NSString * _Nonnull const MSID_CCS_HINT_KEY;
+
 extern NSString * _Nonnull const MSID_WEBAUTH_IGNORE_SSO_KEY;
 extern NSString * _Nonnull const MSID_WEBAUTH_REFRESH_TOKEN_KEY;
 extern NSString * _Nonnull const MSID_USER_FEDERATED_IDENTITY_CREDENTIAL_KEY;
@@ -291,4 +294,11 @@ extern NSString * _Nonnull const MSID_FLIGHT_DISABLE_OPEN_NEW_WINDOW_IN_BROWSER;
 /// Default: OFF
 extern NSString * _Nonnull const MSID_FLIGHT_DISABLE_MOBILE_ONBOARDING;
 
+/// Flight key for MDM profile install notification delay (seconds).
+/// Owner: swagup
+extern NSString * _Nonnull const MSID_FLIGHT_MDM_PROFILE_INSTALLED_NOTIFICATION_DELAY;
+
+/// Default delay (in seconds) before the MDM profile install notification fires.
+extern NSTimeInterval const MSIDMDMProfileInstalledNotificationDefaultDelay;
+
 #define METHODANDLINE   [NSString stringWithFormat:@"%s [Line %d]", __PRETTY_FUNCTION__, __LINE__]

IdentityCore/src/MSIDConstants.m

@@ -27,11 +27,13 @@
 NSString *const MSID_SOURCE_PLATFORM_KEY           = @"x-client-src-SKU";
 NSString *const MSID_PLATFORM_SEQUENCE_KEY         = @"x-client-xtra-sku";
 NSString *const MSID_VERSION_KEY                   = @"x-client-Ver";
+NSString *const MSID_BROKER_VER_KEY                = @"x-client-brkrver";
 NSString *const MSID_CPU_KEY                       = @"x-client-CPU";
 NSString *const MSID_OS_VER_KEY                    = @"x-client-OS";
 NSString *const MSID_DEVICE_MODEL_KEY              = @"x-client-DM";
 NSString *const MSID_APP_NAME_KEY                  = @"x-app-name";
 NSString *const MSID_APP_VER_KEY                   = @"x-app-ver";
+NSString *const MSID_APP_CLIENT_ID_KEY            = @"x-ms-client-id";
 NSString *const MSID_CCS_HINT_KEY                  = @"X-AnchorMailbox";
 NSString *const MSID_WEBAUTH_IGNORE_SSO_KEY        = @"x-ms-sso-Ignore-SSO";
 NSString *const MSID_WEBAUTH_REFRESH_TOKEN_KEY     = @"x-ms-sso-RefreshToken";
@@ -133,4 +135,8 @@
 
 NSString *const MSID_FLIGHT_DISABLE_MOBILE_ONBOARDING = @"disable_mobile_onboarding";
 
+NSString *const MSID_FLIGHT_MDM_PROFILE_INSTALLED_NOTIFICATION_DELAY = @"mdm_profile_installed_notification_delay";
+
+NSTimeInterval const MSIDMDMProfileInstalledNotificationDefaultDelay = 75.0;
+
 #define METHODANDLINE   [NSString stringWithFormat:@"%s [Line %d]", __PRETTY_FUNCTION__, __LINE__]

IdentityCore/src/MSIDFlightManager.m

@@ -34,6 +34,8 @@ @interface MSIDFlightManager()
 
 @implementation MSIDFlightManager
 
+@synthesize flightProvider = _flightProvider;
+
 + (instancetype)sharedInstance
 {
     static MSIDFlightManager *sharedInstance = nil;
@@ -113,35 +115,56 @@ - (dispatch_queue_t)initializeDispatchQueue
 
 - (void)setFlightProvider:(id<MSIDFlightManagerInterface>)flightProvider
 {
-    dispatch_barrier_async(self.synchronizationQueue, ^{
+    dispatch_barrier_sync(self.synchronizationQueue, ^{
         self->_flightProvider = flightProvider;
     });
 }
 
+- (id<MSIDFlightManagerInterface>)flightProvider
+{
+    __block id<MSIDFlightManagerInterface> flightProvider = nil;
+    // Read on the synchronization queue so external callers are serialized against the
+    // barrier write in setFlightProvider:, matching the internal readers below. Capturing
+    // into a strong local keeps the provider alive for the duration of the call.
+    dispatch_sync(self.synchronizationQueue, ^{
+        flightProvider = self->_flightProvider;
+    });
+
+    return flightProvider;
+}
+
 #pragma mark - MSIDFlightManagerInterface
 
-- (BOOL)boolForKey:(nonnull NSString *)flightKey 
+- (BOOL)boolForKey:(nonnull NSString *)flightKey
 {
     __block BOOL result = NO;
-    if (self.flightProvider)
-    {
-        dispatch_sync(self.synchronizationQueue, ^{
-            result = [self.flightProvider boolForKey:flightKey];
-        });
-    }
+    // Read the provider only from within the synchronization queue. Testing it via the
+    // unsynchronized property getter first would race the barrier write in setFlightProvider:,
+    // and capturing it into a strong local keeps it alive for the duration of the call.
+    dispatch_sync(self.synchronizationQueue, ^{
+        id<MSIDFlightManagerInterface> flightProvider = self->_flightProvider;
+        if (flightProvider)
+        {
+            result = [flightProvider boolForKey:flightKey];
+        }
+    });
 
     return result;
 }
 
 - (nullable NSString *)stringForKey:(nonnull NSString *)flightKey
 {
-    __block NSString* result = nil;
-    if (self.flightProvider)
-    {
-        dispatch_sync(self.synchronizationQueue, ^{
-            result = [self.flightProvider stringForKey:flightKey];
-        });
-    }
+    __block NSString *result = nil;
+    // Read the provider only from within the synchronization queue. Testing it via the
+    // unsynchronized property getter first would race the barrier write in setFlightProvider:,
+    // and capturing it into a strong local keeps it alive for the duration of the call.
+    dispatch_sync(self.synchronizationQueue, ^{
+        id<MSIDFlightManagerInterface> flightProvider = self->_flightProvider;
+        if (flightProvider)
+        {
+            result = [flightProvider stringForKey:flightKey];
+        }
+    });
 
     return result;
 }

IdentityCore/src/MSIDOAuth2Constants.h

@@ -60,6 +60,7 @@ extern NSString *const MSID_OAUTH2_CORRELATION_ID_REQUEST;
 extern NSString *const MSID_OAUTH2_CORRELATION_ID_REQUEST_VALUE;
 extern NSString *const MSID_OAUTH2_SAML11_BEARER_VALUE;
 extern NSString *const MSID_OAUTH2_SAML2_BEARER_VALUE;
+extern NSString *const MSID_OAUTH2_JWT_BEARER_VALUE;
 extern NSString *const MSID_OAUTH2_SCOPE_OPENID_VALUE;
 extern NSString *const MSID_OAUTH2_SCOPE_OFFLINE_ACCESS_VALUE;
 extern NSString *const MSID_OAUTH2_SCOPE_PROFILE_VALUE;

IdentityCore/src/MSIDOAuth2Constants.m

@@ -61,6 +61,7 @@
 NSString *const MSID_OAUTH2_ASSERTION = @"assertion";
 NSString *const MSID_OAUTH2_SAML11_BEARER_VALUE = @"urn:ietf:params:oauth:grant-type:saml1_1-bearer";
 NSString *const MSID_OAUTH2_SAML2_BEARER_VALUE = @"urn:ietf:params:oauth:grant-type:saml2-bearer";
+NSString *const MSID_OAUTH2_JWT_BEARER_VALUE = @"urn:ietf:params:oauth:grant-type:jwt-bearer";
 NSString *const MSID_OAUTH2_SCOPE_OPENID_VALUE = @"openid";
 NSString *const MSID_OAUTH2_SCOPE_PROFILE_VALUE = @"profile";
 NSString *const MSID_OAUTH2_SCOPE_EMAIL_VALUE = @"email";

IdentityCore/src/MSIDUXCallbackProtocol.h

@@ -0,0 +1,44 @@
+//------------------------------------------------------------------------------
+//
+// Copyright (c) Microsoft Corporation.
+// All rights reserved.
+//
+// This code is licensed under the MIT License.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files(the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and / or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions :
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+//
+//------------------------------------------------------------------------------
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+@protocol MSIDUXCallbackProtocol <NSObject>
+
+/// Called when the webview loads a profile install URL during MDM onboarding.
+/// The host app should schedule a local notification after the given delay.
+- (void)scheduleMDMProfileInstalledNotificationWithDelay:(NSTimeInterval)delay;
+
+/// Called when enrollment completes successfully. The host app should cancel
+/// any previously scheduled MDM profile installed notification.
+- (void)cancelMDMProfileInstalledNotification;
+
+@end
+
+NS_ASSUME_NONNULL_END

IdentityCore/src/MSIDUXCallbackProvider.h

@@ -0,0 +1,39 @@
+//------------------------------------------------------------------------------
+//
+// Copyright (c) Microsoft Corporation.
+// All rights reserved.
+//
+// This code is licensed under the MIT License.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files(the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and / or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions :
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+//
+//------------------------------------------------------------------------------
+
+#import <Foundation/Foundation.h>
+#import "MSIDUXCallbackProtocol.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface MSIDUXCallbackProvider : NSObject
+
+@property (nonatomic, class, nullable) id<MSIDUXCallbackProtocol> uxCallbackProvider;
+
+@end
+
+NS_ASSUME_NONNULL_END

IdentityCore/src/MSIDUXCallbackProvider.m

@@ -0,0 +1,44 @@
+//------------------------------------------------------------------------------
+//
+// Copyright (c) Microsoft Corporation.
+// All rights reserved.
+//
+// This code is licensed under the MIT License.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files(the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and / or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions :
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+//
+//------------------------------------------------------------------------------
+
+#import "MSIDUXCallbackProvider.h"
+
+static id<MSIDUXCallbackProtocol> s_uxCallbackProvider;
+
+@implementation MSIDUXCallbackProvider
+
++ (id<MSIDUXCallbackProtocol>)uxCallbackProvider
+{
+    return s_uxCallbackProvider;
+}
+
++ (void)setUxCallbackProvider:(id<MSIDUXCallbackProtocol>)uxCallbackProvider
+{
+    s_uxCallbackProvider = uxCallbackProvider;
+}
+
+@end

IdentityCore/src/broker_operation/request/interactive_token_request/MSIDBrokerOperationInteractiveTokenRequest.h

@@ -43,9 +43,7 @@ NS_ASSUME_NONNULL_BEGIN
 /// blob via `MSIDBrokerOperationTokenResponse.onboardingBlob`.
 @property (nonatomic, copy, nullable) NSString *onboardingBlob;
 
-/// Mirrors `MSIDInteractiveRequestParameters.isNewMobileOnboardingFlow`.
-/// Round-tripped across the SSO extension IPC boundary so the broker can
-/// branch on whether the request originated from the new mobile onboarding flow.
+// Indicates the new mobile onboarding flow. Serialized across SSO extension IPC.
 @property (nonatomic) BOOL isNewMobileOnboardingFlow;
 
 + (instancetype)tokenRequestWithParameters:(MSIDInteractiveTokenRequestParameters *)parameters

IdentityCore/src/controllers/MSIDLocalInteractiveController.m

@@ -24,6 +24,7 @@
 #import "MSIDLocalInteractiveController+Internal.h"
 #import "MSIDInteractiveTokenRequest+Internal.h"
 #import "MSIDInteractiveTokenRequestParameters.h"
+#import "MSIDWebviewConstants.h"
 #import "MSIDAccountIdentifier.h"
 #import "MSIDTelemetry+Internal.h"
 #import "MSIDTelemetryAPIEvent.h"
@@ -285,7 +286,7 @@ - (void)handleWebMDMEnrollmentCompletionResponse:(MSIDWebMDMEnrollmentCompletion
                           @"Passed nil completionBlock to handleWebMDMEnrollmentCompletionResponse.");
         return;
     }
-
+    
     NSString *status = mdmEnrollmentCompletionResponse.status ?: @"<none>";
 
     // Failure path: MDM enrollment did not complete.
@@ -308,7 +309,8 @@ - (void)handleWebMDMEnrollmentCompletionResponse:(MSIDWebMDMEnrollmentCompletion
         return;
     }
 
-    // MDM enrollment complete. Retry the token request through the appropriate controller.
+    // MDM enrollment complete.
+    // Retry the token request through the appropriate controller.
     // If broker is installed and SSO extension is active, the factory returns the SSO controller.
     MSID_LOG_WITH_CTX(MSIDLogLevelInfo, self.requestParameters,
                       @"MDM enrollment complete (status=%@); retrying token request.", status);
@@ -358,11 +360,11 @@ - (void)handleSpecialRedirectURL:(NSURL *)URL
                                           completion:completion];
 }
 
-- (BOOL)processResponseHeadersAndCheckForASWebAuthHandoff:(NSDictionary *)headers
-                                              responseURL:(NSURL *)responseURL
+- (BOOL)processNavigationResponseAndCheckForASWebAuthHandoff:(NSHTTPURLResponse *)response
+                                   embeddedWebviewController:(nullable MSIDOAuth2EmbeddedWebviewController *)embeddedWebviewController
 {
-    return [self.navigationHandler processResponseHeadersAndCheckForASWebAuthHandoff:headers
-                                                                         responseURL:responseURL];
+    return [self.navigationHandler processNavigationResponseAndCheckForASWebAuthHandoff:response
+                                                              embeddedWebviewController:embeddedWebviewController];
 }
 
 #if !MSID_EXCLUDE_SYSTEMWV

IdentityCore/src/controllers/broker/mac/MSIDXpcInteractiveTokenRequestController.h

@@ -24,6 +24,7 @@
 
 
 #import "MSIDLocalInteractiveController.h"
+#import "MSIDXpcCanPerformFailureReason.h"
 
 NS_ASSUME_NONNULL_BEGIN
 
@@ -36,6 +37,11 @@ NS_ASSUME_NONNULL_BEGIN
 
 + (BOOL)canPerformRequest;
 
+// Same as canPerformRequest above, but additionally reports the specific reason for a NO result via the
+// reason out-param, so external callers can surface it to their own telemetry. The reason is left
+// untouched if the caller passes nil.
++ (BOOL)canPerformRequest:(MSIDXpcCanPerformFailureReason * _Nullable)reason;
+
 @end
 
 NS_ASSUME_NONNULL_END

IdentityCore/src/controllers/broker/mac/MSIDXpcInteractiveTokenRequestController.m

@@ -83,10 +83,30 @@ - (void)acquireToken:(MSIDRequestCompletionBlock)completionBlock
 }
 
 + (BOOL)canPerformRequest
+{
+    return [self canPerformRequest:nil];
+}
+
++ (BOOL)canPerformRequest:(MSIDXpcCanPerformFailureReason *)reason
 {
     if (@available(macOS 13, *)) {
-        return [MSIDXpcSingleSignOnProvider canPerformRequest:MSIDXpcProviderCache.sharedInstance];
+        MSIDXpcCanPerformFailureReason failureReason = MSIDXpcCanPerformFailureReasonNone;
+        BOOL canPerform = [MSIDXpcSingleSignOnProvider canPerformRequest:MSIDXpcProviderCache.sharedInstance
+                                                                   reason:&failureReason];
+        if (reason)
+        {
+            *reason = failureReason;
+        }
+        if (!canPerform)
+        {
+            MSID_LOG_WITH_CTX(MSIDLogLevelInfo, nil, @"[MSIDXpcInteractiveTokenRequestController canPerformRequest] returned NO, reason: %@ (%ld)", MSIDXpcCanPerformFailureReasonToString(failureReason), (long)failureReason);
+        }
+        return canPerform;
     } else {
+        if (reason)
+        {
+            *reason = MSIDXpcCanPerformFailureReasonUnsupportedOSVersion;
+        }
         return NO;
     }
 }