[Major] [Mobile Onboarding]: Mobile Onboarding Framework by swasti29 · Pull Request #1734 · AzureAD/microsoft-authentication-library-common-for-objc

swasti29 · 2026-03-23T02:06:05Z

Proposed changes

Mobile Onboarding Framework Changes

Type of change

Risk

High – Errors could cause MAJOR regression of many scenarios. (Example: new large features or high level infrastructure changes)
Medium – Errors could cause regression of 1 or more scenarios. (Example: somewhat complex bug fixes, small new features)
Small – No issues are expected. (Example: Very small bug fixes, string changes, or configuration settings changes)

Additional information

…ps://github.com/AzureAD/microsoft-authentication-library-common-for-objc into maagubuzo/ufic/introduce_ufic_into_api_contract

ero "exit merge editor" | git merge --continue 2>/dev/null || git log --oneline -3 t branch e branch 'dev' into maagubuzo/ufic/introduce_ufic_into_api_contract

azure-pipelines · 2026-03-23T02:07:12Z

@@ -1873,6 +1873,9 @@
 		B41163B929BAC9BF00E64619 /* MSIDWKNavigationActionMock.m in Sources */ = {isa = PBXBuildFile; fileRef = B41163B829BAC9BF00E64619 /* MSIDWKNavigationActionMock.m */; };


This pull request does not update changelog.txt.

Please consider if this change would be noticeable to a partner or user and either update changelog.txt or resolve this conversation.

Copilot

Pull request overview

Adds new embedded-webview navigation infrastructure to support “Mobile Onboarding” flows, including special msauth:// redirect handling and transitions from WKWebView to ASWebAuthenticationSession with optional iOS 18+ request headers.

Changes:

Extended MSIDASWebAuthenticationSessionHandler to accept iOS 18+/macOS 15+ additionalHeaders and apply them to ASWebAuthenticationSession.
Introduced new navigation helper/action/util types to centralize handling of special redirects and MDM/profile-install flows.
Added a new MSIDWebviewTransitionHandler to coordinate suspend/resume of embedded webviews while launching system webview sessions.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 21 comments.

Show a summary per file

File	Description
IdentityCore/src/webview/systemWebview/session/MSIDASWebAuthenticationSessionHandler.m	Adds support for passing iOS 18+/macOS 15+ additional header fields into ASWebAuthenticationSession.
IdentityCore/src/webview/systemWebview/session/MSIDASWebAuthenticationSessionHandler.h	Adds a new API-available initializer for additional headers.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationDelegateHelper.m	New helper implementation for configuring embedded webviews and handling special redirects/transitions.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationDelegateHelper.h	New helper interface for shared navigation delegate logic.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationDelegate.h	New protocol for controllers to intercept special redirects and transition events.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationActionUtil.m	New URL parsing/routing utility for `msauth://` host actions (enroll/compliance/installprofile).
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationActionUtil.h	Declares the new action resolution utility API.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationAction.m	New navigation-action value object (load request / open ASWebAuth / fail / etc.).
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationAction.h	Declares action types and system webview “purpose” enum.
IdentityCore/src/webview/embeddedWebview/MSIDOAuth2EmbeddedWebviewController.h	Adds a `navigationDelegate` property intended for special redirect handling.
IdentityCore/src/webview/MSIDWebviewTransitionHandler.m	New coordinator to suspend an embedded webview and launch ASWebAuthenticationSession.
IdentityCore/src/webview/MSIDWebviewTransitionHandler.h	Declares the new transition coordinator API.
IdentityCore/IdentityCore.xcodeproj/project.pbxproj	Adds new files to build phases/groups.

Copilot · 2026-03-24T01:22:53Z

+        MSIDAADOAuthEmbeddedWebviewController *aadWebviewController =
+            (MSIDAADOAuthEmbeddedWebviewController *)webviewController;
+
+        aadWebviewController.navigationDelegate = delegate;


The type check is for MSIDOAuth2EmbeddedWebviewController, but the value is cast to MSIDAADOAuthEmbeddedWebviewController. If a non-AAD MSIDOAuth2EmbeddedWebviewController instance is passed, this cast is unsafe. Cast to MSIDOAuth2EmbeddedWebviewController (or check for MSIDAADOAuthEmbeddedWebviewController explicitly) before setting navigationDelegate.

Suggested change

MSIDAADOAuthEmbeddedWebviewController *aadWebviewController =

(MSIDAADOAuthEmbeddedWebviewController *)webviewController;

aadWebviewController.navigationDelegate = delegate;

MSIDOAuth2EmbeddedWebviewController *oauth2WebviewController =

(MSIDOAuth2EmbeddedWebviewController *)webviewController;

oauth2WebviewController.navigationDelegate = delegate;

Copilot · 2026-03-24T01:22:54Z

+- (MSIDWebviewNavigationAction *)resolveActionForMSAuthURL:(NSURL *)url
+                                         webviewController:(id<MSIDWebviewInteracting>)webviewController
+                                           responseHeaders:(NSDictionary<NSString *,NSString *> * _Nullable)responseHeaders
+                                           isBrokerContext:(BOOL)isBrokerContext
+                                   externalNavigationBlock:(MSIDExternalDecidePolicyForBrowserActionBlock)externalNavigationBlock
+{


This PR introduces substantial new URL parsing/routing behavior for msauth:// hosts (enroll/compliance/installprofile) but there are no accompanying unit tests. Given existing webview controller tests in this repo, please add focused tests for MSIDWebviewNavigationActionUtil covering each host, missing params/headers, and the requireASWebAuthenticationSession branch to prevent regressions.

Copilot · 2026-03-24T01:22:54Z

+        _url = url;
+        _purpose = purpose;
+        _error = error;
+        _additionalHeaders = additionalHeaders;


additionalHeaders is stored without copying, so a mutable dictionary passed in could be mutated after the action is created. Consider copying (and ideally declaring the property as copy) to keep MSIDWebviewNavigationAction immutable and safer to share across components.

Suggested change

_additionalHeaders = additionalHeaders;

_additionalHeaders = [additionalHeaders copy];

Copilot · 2026-03-24T01:22:55Z

+typedef NS_ENUM(NSInteger, MSIDSystemWebviewPurpose);
+


typedef NS_ENUM(NSInteger, MSIDSystemWebviewPurpose); is not a valid forward declaration and will not compile. Import the header that defines MSIDSystemWebviewPurpose (e.g., MSIDWebviewNavigationAction.h) or define the enum here instead of trying to forward-declare it with NS_ENUM.

Copilot · 2026-03-24T01:22:55Z

+    return [MSIDWebviewNavigationAction loadRequestAction:request];
+}
+
+- (MSIDWebviewNavigationAction *)actionForInstallProfileURL:(NSURL *)url


actionForInstallProfileURL doesn’t use the url parameter, which will fail the build due to unused-parameter warnings being treated as errors. Mark it __unused or remove it from the signature if it’s not needed.

Suggested change

- (MSIDWebviewNavigationAction *)actionForInstallProfileURL:(NSURL *)url

- (MSIDWebviewNavigationAction *)actionForInstallProfileURL:(__unused NSURL *)url

Copilot · 2026-03-24T01:22:57Z

+                                                   webviewController:(id<MSIDWebviewInteracting>)webviewController
+                                                     responseHeaders:(NSDictionary<NSString *, NSString *> * _Nullable)responseHeaders
+                                                     isBrokerContext:(BOOL)isBrokerContext
+                                             externalNavigationBlock:(MSIDExternalDecidePolicyForBrowserActionBlock)externalNavigationBlock;


externalNavigationBlock is declared nonnull, but callers may legitimately pass nil (and the implementation checks for it). Passing nil to a nonnull parameter will produce a nullability warning (treated as an error). Mark this parameter as _Nullable in the header (and match in the implementation).

Suggested change

externalNavigationBlock:(MSIDExternalDecidePolicyForBrowserActionBlock)externalNavigationBlock;

externalNavigationBlock:(MSIDExternalDecidePolicyForBrowserActionBlock _Nullable)externalNavigationBlock;

externalNavigationBlock is optional param right ? so may be make it nullable ?

Copilot · 2026-03-24T01:22:57Z

+                    brtEvaluator:(nullable BOOL(^)(void))brtEvaluator
+                      brtHandler:(nullable void(^)(void(^)(BOOL success, NSError * _Nullable error)))brtHandler
+                 isBrokerContext:(BOOL)isBrokerContext
+            externalNavigationBlock:(nullable id)externalNavigationBlock;


externalNavigationBlock is typed as id, but it's passed to APIs that expect MSIDExternalDecidePolicyForBrowserActionBlock. This will trigger an incompatible-pointer-types warning (treated as an error) and loses type safety. Change the parameter type in both the header and implementation to MSIDExternalDecidePolicyForBrowserActionBlock _Nullable (or remove it if not needed).

Suggested change

externalNavigationBlock:(nullable id)externalNavigationBlock;

externalNavigationBlock:(nullable MSIDExternalDecidePolicyForBrowserActionBlock)externalNavigationBlock;

Copilot · 2026-03-24T01:22:57Z

 @property (nonatomic, readonly) NSDictionary<NSString *, NSString *> *customHeaders;
 @property (nonatomic, copy) MSIDNavigationResponseBlock navigationResponseBlock;
 @property (nonatomic, copy) MSIDExternalDecidePolicyForBrowserActionBlock externalDecidePolicyForBrowserAction;
+@property (nonatomic, weak) id<MSIDWebviewNavigationDelegate> navigationDelegate;


navigationDelegate is introduced on MSIDOAuth2EmbeddedWebviewController, but there is no usage of this property anywhere in the implementation (only assignments). As-is, it adds API surface without behavior and will likely confuse call sites. Either wire it into decidePolicyForNavigationAction: (and/or response handling) or remove the property until it’s actually used.

Copilot · 2026-03-24T01:22:58Z

+
+@interface MSIDWebviewNavigationDelegateHelper()
+
+@property (nonatomic) id<MSIDRequestContext> context;


Header declares context as weak, readonly, but the class extension redeclares it as strong/readwrite (@property (nonatomic) ...). This defeats the documented retain-cycle avoidance and can also produce attribute-mismatch warnings (warnings are errors in this repo). Redeclare it in the extension as weak, readwrite (or keep it weak and store a separate strong local when needed).

Suggested change

@property (nonatomic) id<MSIDRequestContext> context;

@property (nonatomic, weak, readwrite) id<MSIDRequestContext> context;

Veena11 · 2026-03-25T23:36:23Z

+    MSIDWebviewNavigationActionTypeLoadRequestInWebview,
+
+    /// Open the URL in ASWebAuthenticationSession (system webview)
+    MSIDWebviewNavigationActionTypeOpenInASWebAuthenticationSession,


lets revisit this based on the design discussion we are having for ASWebAuth handoff

Veena11 · 2026-03-25T23:37:10Z

+ * Purpose for opening a system webview.
+ * Used to provide context about for ASWebAuthenticationSession.
+ */
+typedef NS_ENUM(NSInteger, MSIDSystemWebviewPurpose)


you might not need this if we go with the response header logic, lets revisit once we conclude

Veena11 · 2026-03-25T23:43:47Z

+/*!
+ Additional HTTP headers to include when executing the action.
+
+ For OpenASWebAuthenticationSession actions, these headers (e.g., X-Intune-AuthToken)


additional headers could also be used for WKwebiew based requests too

Veena11 · 2026-03-25T23:44:23Z

+ * @param headers Additional HTTP headers (e.g., X-Intune-AuthToken) to pass to the handler
+ * @return Action object with type OpenASWebAuthenticationSession
+ */
+ (instancetype)openInASWebAuthSessionAction:(NSURL *)url


Marking for revisit

Veena11 · 2026-03-25T23:48:14Z

+
+#pragma mark - Validation
+
+- (BOOL)isValid


where is isValid API used ?

Veena11 · 2026-03-25T23:57:30Z

+{
+    // Extract intuneUrl from query parameters
+    // URL format: msauth://enroll?intuneUrl=https://go.microsoft.com/fwlink?LinkId=396941
+    NSString *intuneUrl = params[@"intuneUrl"];


Marking for update based on the qp from CA redirect

Maximus Agubuzo and others added 10 commits January 21, 2026 13:37

first commit

db9014c

update

0f991da

Merge branch 'dev' into maagubuzo/ufic/introduce_ufic_into_api_contract

dd8c52d

nit

ed643b0

Merge branch 'maagubuzo/ufic/introduce_ufic_into_api_contract' of htt…

8322a1b

…ps://github.com/AzureAD/microsoft-authentication-library-common-for-objc into maagubuzo/ufic/introduce_ufic_into_api_contract

updates

f74513e

Merge branch 'dev' into maagubuzo/ufic/introduce_ufic_into_api_contract

caa70e9

Mt log --oneline -3 && git status

d90ad3a

ero "exit merge editor" | git merge --continue 2>/dev/null || git log --oneline -3 t branch e branch 'dev' into maagubuzo/ufic/introduce_ufic_into_api_contract

updates

f2466fa

Mobile onboarding framework

3e09f74

azure-pipelines Bot reviewed Mar 23, 2026

View reviewed changes

swasti29 and others added 5 commits March 22, 2026 19:07

Merge branch 'dev' into swagup/cc/mob_on_framework

cd0d960

Remove ununsed code

927c7e4

remove test code

da7d40f

Remove testing code

dcc4025

Removing response

ba24bae

swasti29 marked this pull request as ready for review March 24, 2026 01:15

swasti29 requested a review from a team as a code owner March 24, 2026 01:15

swasti29 requested review from Copilot, galwarsamy and neha-rsn March 24, 2026 01:15

Copilot started reviewing on behalf of swasti29 March 24, 2026 01:15 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

Veena11 reviewed Mar 25, 2026

View reviewed changes

test pr check

224daeb

Swasti Gupta and others added 3 commits April 10, 2026 02:36

test pr check

4ede9ed

Merge branch 'swagup/pr_size_check_test' into swagup/cc/mob_on_framework

b85e97c

Merge branch 'dev' into swagup/cc/mob_on_framework

32d8912

AzureAD deleted a comment from Copilot AI May 12, 2026

		@@ -1873,6 +1873,9 @@
		B41163B929BAC9BF00E64619 /* MSIDWKNavigationActionMock.m in Sources / = {isa = PBXBuildFile; fileRef = B41163B829BAC9BF00E64619 / MSIDWKNavigationActionMock.m */; };

	_additionalHeaders = additionalHeaders;
	_additionalHeaders = [additionalHeaders copy];

	- (MSIDWebviewNavigationAction )actionForInstallProfileURL:(NSURL )url
	- (MSIDWebviewNavigationAction )actionForInstallProfileURL:(__unused NSURL )url

	externalNavigationBlock:(MSIDExternalDecidePolicyForBrowserActionBlock)externalNavigationBlock;
	externalNavigationBlock:(MSIDExternalDecidePolicyForBrowserActionBlock _Nullable)externalNavigationBlock;

	externalNavigationBlock:(nullable id)externalNavigationBlock;
	externalNavigationBlock:(nullable MSIDExternalDecidePolicyForBrowserActionBlock)externalNavigationBlock;


		@interface MSIDWebviewNavigationDelegateHelper()

		@property (nonatomic) id<MSIDRequestContext> context;

	@property (nonatomic) id<MSIDRequestContext> context;
	@property (nonatomic, weak, readwrite) id<MSIDRequestContext> context;

Uh oh!

Conversation

swasti29 commented Mar 23, 2026

Proposed changes

Type of change

Risk

Additional information

Uh oh!

azure-pipelines Bot Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Veena11 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Veena11 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Veena11 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Veena11 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Veena11 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Veena11 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Veena11 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants