You can support me by purchasing a coffee if this package has been helpful to you.

• 1 Platform Support
• 2 Features
• 3 Authentication Flow
• 4 Getting started
  • 4.1 Installation
  • 4.2 Import
  • 4.3 Android Settings
    • 4.3.1 Networking
    • 4.3.2 Cleartext traffic
  • 4.4 iOS Settings
    • 4.4.1 Networking
    • 4.4.2 Cleartext traffic
  • 4.5 macOS Settings
    • 4.5.1 Networking
    • 4.5.2 Cleartext traffic
  • 4.6 Windows Settings
  • 4.7 Linux Settings
• 5 Usage
  • 5.1 AzureSignIn instance creation and configuration
    • 5.1.1 Creating an instance without parameters (using az cli default settings)
    • 5.1.2 Creating an instance with parameters
  • 5.2 Sign In
    • 5.2.1 Get the Microsoft Sign-In page URL
    • 5.2.2 Start the Sign In process
  • 5.3 Cancel the Sign In process
  • 5.4 Refresh a Token
    • 5.4.1 Refresh Token with an existing Token
    • 5.4.2 Refresh Token with the Refresh-Token String
  • 5.5 AzureSignIn Variables
  • 5.6 The Token-Entity
• 6 Where to go from here
• 7 Bugs and issues

dart_azure_ad_sign_in allows Flutter and Dart apps to obtain authentication tokens for authorized access to protected resources like Azure web APIs. The package can simply be used without any configuration to gain the same access you would have with the az cli, or it can be configurated to modify the access.

Check out the Dart and Flutter example app to have a quick view of how this package could be used. dart_azure_ad_sign_in_poc

Go to Installing to get the newest version.

Import the package:

import 'package:dart_azure_ad_sign_in/dart_azure_ad_sign_in.dart';

As this app uses the internet, networking needs to be enabled in the AndroidManifest.xml.

<manifest xmlns:android...>
  ...
  <uses-permission android:name="android.permission.INTERNET" />
  <application ...
</manifest>

This app will open a local HTTP Server, which accepts cleartext traffic, allowing an insecure connection to only the localhost by creating res/xml/network_security_config.xml and configuring it as follows.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">localhost</domain>
    </domain-config>
</network-security-config>

Then load the file into your AndroidManifest.xml.

<?xml version="1.0" encoding="utf-8"?>
<manifest ...>
    <application
        ...
        android:networkSecurityConfig="@xml/network_security_config"
        ...>
        ...
    </application>
</manifest>

Not necessary for iOS.

This app will open a local HTTP Server, which accepts cleartext traffic, allowing an insecure connection to only the localhost by creating a specific rule as following info.plist.

<key>NSAppTransportSecurity</key>
<dict>
      <key>NSAllowsArbitraryLoads</key> 
      <false/>
       <key>NSExceptionDomains</key>
       <dict>
            <key>localhost</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
                <true/>
                <key>NSTemporaryExceptionMinimumTLSVersion</key>
                <string>TLSv1.1</string>
            </dict>
       </dict>
</dict>

As this app uses the internet, networking needs to be enabled in the .entitlements.

<key>com.apple.security.network.client</key>
<true/>

This app will open a local HTTP Server, which accepts cleartext traffic, allowing an insecure connection to only the localhost by creating a specific rule as following info.plist.

<key>NSAppTransportSecurity</key>
<dict>
      <key>NSAllowsArbitraryLoads</key> 
      <false/>
       <key>NSExceptionDomains</key>
       <dict>
            <key>localhost</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
                <true/>
                <key>NSTemporaryExceptionMinimumTLSVersion</key>
                <string>TLSv1.1</string>
            </dict>
       </dict>
</dict>

No further settings are required.

No further settings are required.

The class itself is very flexible, no parameters need to be set and it will use the az cli configuration. For information on all available variables in this class, refer to 5.5 AzureSignIn Variables

final azureSignIn = AzureSignIn();

Parameters for the Authentication and local Http-Server can be set if needed.

final azureSignIn = AzureSignIn(
  // The Application (client) ID that the Azure portal – App registrations page assigned to your app.
  // Optional, uses the az cli client id: '04b07795-8ddb-461a-bbee-02f9e1bf7b46'
  clientId: '04b07795-8ddb-461a-bbee-02f9e1bf7b46',
  // A list of scopes that you want the user to consent to.
  // Optional, uses the az cli scope: ['https://management.core.windows.net//.default', 'offline_access', 'openid', 'profile']
  scope: [
    'https://management.core.windows.net//.default',
    'offline_access',
    'openid',
    'profile',
  ],
  // Port of the Local HttpServer which will receive the code after sign in.
  // Optional, uses the port 5000
  port: 5000,
  // Response of the Local HttpServer, which the user will see in the browser after successful sign in.
  // Optional, uses 'Sign In successful. This window can now be closed.'
  serverSuccessResponse: '<h1>Sign In successful.</h1><p>This window can now be closed.</p>',
  // Response of the Local HttpServer, which the user will see in the browser after sign in failure.
  // Optional, uses 'Sign In failed. Close this window and try again.'
  serverErrorResponse: '<h1>Sign In failed.</h1><p>Close this window and try again.</p>',
  // Duration on how long the local HttpServer waits, for the user to sign in before creating a cancelled-token and closing.
  // Optional, uses Duration(minutes: 5)
  signInTimeoutDuration: Duration(minutes: 5),
);

The user needs to sign-in to the Browser, to do so the Sign In URL can be received. If Flutter is being used, this URL could be opened with the url_launcher

// Print the SignIn URL, the user has to open in the browser.
print(azureSignIn.signInUri);

The sign-in will return a new Token. In the background an HttpServer is started and waits for the code to be received after the sign-in in the Browser, then the Microsoft token Endpoint will be called with the code and a token is returned. The Token will always be created, but depending on success or error, different values will be set, see the variable token.status in 5.6. The Token-Entity.

Token token = await azureSignIn.signIn();

The Sign In Process itself has the defined timeout set in the variable azureSignIn.signInTimeoutDuration, but with the following function the user could cancel the Sign in if needed. The azureSignIn.signIn() will then receive a Token with the information of cancellation in the variable token.status (See more: 5.6. The Token-Entity).

// Cancels the sign-in process.
async azureSignIn.cancelSignIn();

Once the token expires it can be either refreshed by giving it the existing Token or just giving it a refresh-token String. One of the Values needs to be sent, else a Token with an error status will be returned, see token.status in 5.6. The Token-Entity.

The Token can be refreshed by using the existing Token

// refresh a token by giving the previous aquired token object.
token = await azureSignIn.refreshToken(token: token);

Or if the Token is not available anymore the refresh token can be sent as a String.

// refresh a token by giving the refresh-token as a string.
token = await azureSignIn.refreshToken(refreshToken: refreshTokenString);

Some class variables can be modified while running, some others are read-only.

The Token has multiple fields, some are set in case of success, some in case of failure.

With the token.accessToken you now have access to the Microsoft APIs. Read more on the Azure Rest API reference, or check out the Application IDs of commonly used Microsoft applications to add some pre-existing azureSignIn.clientId.

Please file feature requests and bugs at the issue tracker