Comments (11)
Thanks for that PR, we'll give it a look and get into an upcoming release if it all looks good (likely this week or next week)
We target Java 8 and above: Java 8 is the default in our internal tests/pipelines so it's just what I usually use, plus 11 and the latest versions to ensure everything works with newer versions. It looks like we're still using a version of Lombok from 2019 which is around when most of the original development happened. In the past we've mainly update dependencies when CVEs are found or we need a specific new feature, but we're planning on being more proactive about it going forward.
from microsoft-authentication-library-for-java.
The fix made by @crimsonvspurple in #797 has now been released in version 1.15.0 of msal4j. Thanks again for the fix, and if anyone is still having issues or faces new ones feel free to re-open this thread or start a new one.
from microsoft-authentication-library-for-java.
Hello @rijami00 : I haven't run into this problem before. Just to clarify some things:
- By "the token acquisition was a success for this call and all subsequent calls", does that mean the pop only happens once, and later calls don't cause a popup?
- Does that popup happen right before the browser opens, or when you first start your application?
- Have you tried any other flow other than interactive?
- Do you see any error logs, stack traces, etc.?
By default, MSAL Java just uses some built-in Java functionality to open the default system browser:
It seems like there are some security settings that don't trust Java applications doing any network calls, unrelated to what MSAL specifically is doing.
You could try making a simple app that just does the same browser stuff that MSAL does (like a main method with just Desktop.getDesktop().browse(URI.create("https://some-real-or-fake-domain.com"));
), that will at least help narrow down what part of the program your security settings don't trust.
from microsoft-authentication-library-for-java.
Hi.
You can try the sample I have provided in #789 (except dont set the broker).
I'm not talking about silent acquire. I'm talking about calling interactive repeatedly (just for the sake of it).
So in a plain java file, if you call interactive flow, it will open browser and once logged in, will redirect to localhost:xyz.
However, while the browser opens, MSAL also starts listening on localhost:xyz and that triggers windows firewall.
It doens't matter if you allow or block it, the token acquisation is successful (since we are only listening on local).
Now if you run the same plain java file again and again (which is calling interactive), it will succeed without the firewall popup regardless if you have previously allowed it or not. Ofc, browser popup will come up as usual.
If I delete the entries in windows firewall, then the firewall popup will trigger again.
Here you can see I ignored the firewall popup and it blocked java.exe from listening on ports (on network). I don't think it can (or wont) block on purely local.
I dont think the issue is with opening browser. the issue is listening on a port.
from microsoft-authentication-library-for-java.
Does that popup happen right before the browser opens, or when you first start your application?
Right when browser opens, as that's when MSAL starts to listen to port. For the sake of testing, I'm not bringing up my app at all; just a plain java file.
Have you tried any other flow other than interactive?
Silent doesn't trigger anything; so all good there.
Do you see any error logs, stack traces, etc.?
Nothing out of ordinary as MSAL works perfectly in this case regardless if the user allows or blocks the application (here: java.exe). It is the popup that I want to avoid as it can create panic to the user and needless friction.
from microsoft-authentication-library-for-java.
I have tried the Desktop open browser
code, it opens the browser just fine and no firewall popup.
from microsoft-authentication-library-for-java.
So I tried some sample code in plain java.
Firewall does not trigger for:
- localhost
- 127.0.0.1
but triggers for:
- 192.168.1.xxx
here's the sample code:
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.net.ServerSocket;
import java.net.Socket;
import java.io.*;
import java.net.*;
public class SimpleServer {
public static void main(String[] args) {
int port = 12345; // The port number to listen on
String ipAddress = "localhost";
// String ipAddress = "127.0.0.1";
// String ipAddress = "192.168.1.xxx";
try {
InetAddress address = InetAddress.getByName(ipAddress);
try (ServerSocket serverSocket = new ServerSocket(port, 50, address)) {
System.out.println("Server is listening on IP " + ipAddress + " and port " + port);
while (true) {
try (Socket socket = serverSocket.accept()) {
System.out.println("New client connected");
BufferedReader input = new BufferedReader(new InputStreamReader(socket.getInputStream()));
String line = input.readLine(); // Read a line of text
System.out.println("Received: " + line);
} catch (IOException e) {
System.out.println("I/O error: " + e.getMessage());
}
}
}
} catch (IOException ex) {
System.out.println("Server exception: " + ex.getMessage());
ex.printStackTrace();
}
}
}
from microsoft-authentication-library-for-java.
I tried your sample code and couldn't get any firewall popup, so it does seem to be a security configuration issue.
Since that sample code doesn't trigger the pop-up for you for localhost but using localhost in MSAL triggers it, then I'm not sure the listening is the issue.
The only other thing I can think of is you can try disabling instance discovery by setting PublicClientApplication's instanceDiscovery field to false. Instance discovery is a call to a Microsoft endpoint (something similar to https://login.microsoftonline.com/common/discovery/instance) that occurs in parallel with the token acquisition, so that could be the call that's causing the popup.
Other than that, I'm not sure if there's any other advice than to lower your security settings or whitelist Java. I don't suppose you have another device with different security to test the code on?
from microsoft-authentication-library-for-java.
If you ensure firewall is not blocking or allowing java, then you will get prompt (if you have your firewall configured properly) because java is trying to listen on 192.168.x.x which is on the network, not on localhost.
The issue here is binding to all available interfaces in
from microsoft-authentication-library-for-java.
This will solve the issue: #797
On a side note, which JDK are you using for development? I had to fall back to 11 until I was actually able to build the project. Lombok version seemed really old.
from microsoft-authentication-library-for-java.
No problem. While it is mentioned this library works on Java 8+, I think it should be mentioned somewhere that to actually build the project, we need 8 or 11. I tried with 21, 17; took me a while to realize what was going on and fall back to 11.
from microsoft-authentication-library-for-java.
Related Issues (20)
- [Bug] DefaultHttpClient ignores supplied SSLSocketFactory HOT 4
- [Feature Request] Expose refreshOn in IAuthenticationResult HOT 9
- [Bug] http://127.0.0.1 does not work as redirect URI for AcquireTokenInteractive HOT 4
- [Bug] Release notes and git tag for version released on Maven Central is missing HOT 3
- Move to OneBranch
- [BUG] AcquireTokenSilentSupplier failed: Token not found in the cache HOT 3
- [Feature Request] Add an option to bypass User Discovery when using UsernamePasswordParameters with acquireToken
- [Bug] Cannot call the OIDC endpoint with access token from the broker HOT 19
- [Bug] RefreshOn info isn't wired in AcquireTokenByTokenProvider supplier. HOT 1
- AcquireTokenForManagedIdentity should throw if a user-assigned managed identity clientID or resourceID is supplied when not supported HOT 1
- [Engineering task] Implement Claims API to Bypass Cache When Claims are Present in MSAL with Managed Identity HOT 1
- [Feature Request] Add file based detection to azure arc
- Ensure, refreshOn is computed to half the token lifetime for Managed Identity Tokens HOT 2
- [Bug] Fail to run in native image HOT 4
- [Bug] NoSuchMethodError: 'com.microsoft.aad.msal4j.AbstractClientApplicationBase$Builder com.microsoft.aad.msal4j.ConfidentialClientApplication$Builder.proxy(java.net.Proxy)' HOT 5
- CIAM CUD support HOT 1
- Add Support for Object ID in Managed Identity Client HOT 2
- Deprecate ClaimsRequest API
- Refactor to avoid HTTP calls in app creation
- [Bug] MSAL is failing to parse an error response from the server
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from microsoft-authentication-library-for-java.