Remember the UPN across a broker-install interruption to pre-fill login_hint, Fixes AB#3676213

changelog.txt

@@ -4,6 +4,7 @@ vNext
 - [MINOR] Promote finalizeBlob() onto the IOnboardingTelemetryRecorder interface (as a binary-compatible default method) so callers finalize the onboarding telemetry blob through the interface instead of downcasting to the concrete OnboardingTelemetryRecorder (#3180)
 - [PATCH] Security: validate the target of WebView broker-install intent-scheme redirects against an allow-list (Google Play Store only), clearing any explicit component/selector and stripping URI-permission grant flags so resolution is driven solely by the validated package; gated by ENABLE_BROKER_INSTALL_INTENT_VALIDATION CommonFlight (default off) and recording the launched / blocked outcome via the is_broker_install_intent_blocked span attribute (#3170)
 - [PATCH] Rename WebAppError 'error' field to 'code' in WebApps API error response (#3192)
+- [PATCH] Pre-fill login_hint with the UPN remembered from a MAM Conditional Access broker-install redirect, so users are not asked to retype their address after installing Company Portal; the hint is bound to the authority host it was captured against and is never sent to another, and the pre-fill outcome is recorded via the mam_ca_upn_hint_outcome span attribute; gated by ENABLE_MAM_CA_UPN_HINT CommonFlight (default off) (#3195)
 
 Version 24.5.0
 ----------

common/src/main/java/com/microsoft/identity/common/internal/controllers/BrokerMsalController.java

@@ -105,6 +105,7 @@
 import com.microsoft.identity.common.java.exception.ServiceException;
 import com.microsoft.identity.common.java.exception.UnsupportedBrokerException;
 import com.microsoft.identity.common.java.interfaces.IPlatformComponents;
+import com.microsoft.identity.common.java.providers.MamUpnHintStore;
 import com.microsoft.identity.common.java.providers.microsoft.MicrosoftRefreshToken;
 import com.microsoft.identity.common.java.providers.microsoft.azureactivedirectory.ClientInfo;
 import com.microsoft.identity.common.java.providers.microsoft.microsoftsts.MicrosoftStsAccount;
@@ -349,8 +350,16 @@ private String tryGetNegotiatedProtocolVersionFromHelloCache(
      * @return an {@link AcquireTokenResult}.
      */
     @Override
-    public AcquireTokenResult acquireToken(final @NonNull InteractiveTokenCommandParameters parameters)
+    public AcquireTokenResult acquireToken(final @NonNull InteractiveTokenCommandParameters requestParameters)
             throws BaseException, InterruptedException, ExecutionException {
+        // MAM Conditional Access onboarding: pre-fill the UPN the user gave us before a Conditional
+        // Access "install Company Portal" block interrupted them. This runs on every interactive
+        // request, not only the one that follows an install - it is a no-op unless the flight is on,
+        // the caller left login_hint blank, the caller did not ask the user to pick or create an
+        // account, and a hint stored for this client and authority is still within its TTL.
+        final InteractiveTokenCommandParameters parameters =
+                MamUpnHintStore.applyStoredUpnHintIfAbsent(requestParameters);
+
         final AcquireTokenResult result;
         try {
             //Get the broker interactive parameters intent
@@ -382,6 +391,13 @@ public AcquireTokenResult acquireToken(final @NonNull InteractiveTokenCommandPar
                         .putApiId(TelemetryEventStrings.Api.BROKER_ACQUIRE_TOKEN_INTERACTIVE)
         );
 
+        if (result != null && result.getSucceeded()) {
+            // Signed in, so any remembered UPN has served its purpose and should not linger. This is
+            // where a hint is retired: applying one does not delete it, because the request it was
+            // attached to can still fail.
+            MamUpnHintStore.clearUpnHint(parameters.getPlatformComponents(), parameters.getClientId());
+        }
+
         return result;
     }
 

common/src/main/java/com/microsoft/identity/common/internal/controllers/LocalMSALController.java

@@ -62,6 +62,7 @@
 import com.microsoft.identity.common.java.util.ThreadUtils;
 import com.microsoft.identity.common.java.flighting.CommonFlight;
 import com.microsoft.identity.common.java.flighting.CommonFlightsManager;
+import com.microsoft.identity.common.java.providers.MamUpnHintStore;
 import com.microsoft.identity.common.java.providers.RawAuthorizationResult;
 import com.microsoft.identity.common.java.providers.microsoft.microsoftsts.MicrosoftStsAuthorizationRequest;
 import com.microsoft.identity.common.java.providers.microsoft.microsoftsts.MicrosoftStsAuthorizationResponse;
@@ -105,10 +106,18 @@ public class LocalMSALController extends BaseController {
 
     @Override
     public AcquireTokenResult acquireToken(
-            @NonNull final InteractiveTokenCommandParameters parameters)
+            @NonNull final InteractiveTokenCommandParameters requestParameters)
             throws ExecutionException, InterruptedException, ClientException, IOException, ArgumentException {
         final String methodTag = TAG + ":acquireToken";
 
+        // MAM broker-install onboarding: pre-fill the UPN the user gave us before a Conditional
+        // Access "install Company Portal" block interrupted them. This runs on every interactive
+        // request, not only the one that follows an install - it is a no-op unless the flight is on,
+        // the caller left login_hint blank, the caller did not ask the user to pick or create an
+        // account, and a hint stored for this client and authority is still within its TTL.
+        final InteractiveTokenCommandParameters parameters =
+                MamUpnHintStore.applyStoredUpnHintIfAbsent(requestParameters);
+
         Logger.verbose(
                 methodTag,
                 "Acquiring token..."
@@ -174,6 +183,19 @@ public AcquireTokenResult acquireToken(
 
         ResultUtil.logResult(TAG, result);
 
+        // MAM Conditional Access onboarding: if Conditional Access blocked this request until
+        // Company Portal is installed, remember the UPN the server sent back. Installing Company
+        // Portal usually kills this process, so the hint is persisted and pre-filled on the
+        // interactive request the user makes once they return. No-op unless the flight is on and
+        // this failure is specifically the MAM-CA install - an ordinary device-registration broker
+        // install stores nothing.
+        MamUpnHintStore.saveUpnHintForMamCaInstall(
+                parametersWithScopes.getPlatformComponents(),
+                parametersWithScopes.getClientId(),
+                parametersWithScopes.getAuthority(),
+                result.getAuthorizationErrorResponse()
+        );
+
         if (result.getAuthorizationStatus().equals(AuthorizationStatus.SUCCESS)) {
             //3) Exchange authorization code for token
             final TokenResult tokenResult = performTokenRequest(
@@ -235,6 +257,13 @@ public AcquireTokenResult acquireToken(
                         .putApiId(TelemetryEventStrings.Api.LOCAL_ACQUIRE_TOKEN_INTERACTIVE)
         );
 
+        if (acquireTokenResult.getSucceeded()) {
+            // Signed in, so any remembered UPN has served its purpose and should not linger. This is
+            // where a hint is retired: applying one does not delete it, because the request it was
+            // attached to can still fail.
+            MamUpnHintStore.clearUpnHint(parameters.getPlatformComponents(), parameters.getClientId());
+        }
+
         return acquireTokenResult;
     }
 

common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java

@@ -95,6 +95,7 @@
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
 
+import static com.microsoft.identity.common.java.AuthenticationConstants.OAuth2.CLIENT_ID;
 import static com.microsoft.identity.common.java.AuthenticationConstants.OAuth2.UTID;
 
 import com.microsoft.identity.common.java.opentelemetry.OTelUtility;
@@ -371,14 +372,62 @@ public void updateLatestUrlStatus(final String loadingError, final String authEr
                     public Map<Integer, UrlStatus> getUrlStatusMap() {
                         return WebViewAuthorizationFragment.this.getUrlLoadTracker();
                     }
-                }
+                },
+                getClientIdFromRequestUrl(mAuthorizationRequestUrl),
+                getAuthorityHostFromRequestUrl(mAuthorizationRequestUrl)
         );
         setUpWebView(view, mAADWebViewClient);
         mAADWebViewClient.initializeAuthUxJavaScriptApi(mWebView, mAuthorizationRequestUrl);
         launchWebView(mAuthorizationRequestUrl, mRequestHeaders);
         return view;
     }
 
+    /**
+     * Reads {@code client_id} off an authorization request URL, so the WebView client can scope
+     * per-app state to the app being authorized.
+     *
+     * @param requestUrl the authorization request URL.
+     * @return the client id, or null when it cannot be determined.
+     */
+    @Nullable
+    @VisibleForTesting
+    static String getClientIdFromRequestUrl(@Nullable final String requestUrl) {
+        final String methodTag = TAG + ":getClientIdFromRequestUrl";
+        if (StringUtil.isNullOrEmpty(requestUrl)) {
+            return null;
+        }
+
+        try {
+            return Uri.parse(requestUrl).getQueryParameter(CLIENT_ID);
+        } catch (final UnsupportedOperationException e) {
+            Logger.warn(methodTag, "Could not read the client id off the request url.");
+            return null;
+        }
+    }
+
+    /**
+     * Reads the host off an authorization request URL, so state captured mid-flow can be bound to
+     * the authority it came from.
+     *
+     * @param requestUrl the authorization request URL.
+     * @return the authority host, or null when it cannot be determined.
+     */
+    @Nullable
+    @VisibleForTesting
+    static String getAuthorityHostFromRequestUrl(@Nullable final String requestUrl) {
+        final String methodTag = TAG + ":getAuthorityHostFromRequestUrl";
+        if (StringUtil.isNullOrEmpty(requestUrl)) {
+            return null;
+        }
+
+        try {
+            return Uri.parse(requestUrl).getHost();
+        } catch (final Exception e) {
+            Logger.warn(methodTag, "Could not read the authority host off the request url.");
+            return null;
+        }
+    }
+
     @Override
     public void handleBackButtonPressed() {
         final String methodTag = TAG + ":handleBackButtonPressed";

common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java

@@ -47,6 +47,7 @@
 import androidx.lifecycle.ViewTreeLifecycleOwner;
 
 import com.microsoft.identity.common.adal.internal.AuthenticationConstants;
+import com.microsoft.identity.common.components.AndroidPlatformComponentsFactory;
 import com.microsoft.identity.common.adal.internal.util.StringExtensions;
 import com.microsoft.identity.common.internal.broker.BrokerData;
 import com.microsoft.identity.common.internal.broker.BrokerValidator;
@@ -86,6 +87,7 @@
 import com.microsoft.identity.common.java.WarningType;
 import com.microsoft.identity.common.java.exception.ClientException;
 import com.microsoft.identity.common.java.exception.ErrorStrings;
+import com.microsoft.identity.common.java.providers.MamUpnHintStore;
 import com.microsoft.identity.common.java.providers.RawAuthorizationResult;
 import static com.microsoft.identity.common.java.telemetry.OnboardingTelemetryConstants.STEP_AUTHENTICATOR_MFA_LINKING_STARTED;
 import static com.microsoft.identity.common.java.telemetry.OnboardingTelemetryConstants.STEP_BROKER_INSTALL_PROMPTED;
@@ -170,6 +172,20 @@ public class AzureActiveDirectoryWebViewClient extends OAuth2WebViewClient {
     private final SpanContext mSpanContext;
     private final String mUtid;
 
+    /**
+     * Client id of the request being authorized, when known. Used to scope the MAM Conditional
+     * Access UPN hint to the app that was interrupted.
+     */
+    @Nullable
+    private final String mClientId;
+
+    /**
+     * Host of the authority this WebView is talking to, so a UPN captured mid-flow can be bound to
+     * it. Null when it could not be determined from the authorization request url.
+     */
+    @Nullable
+    private final String mAuthorityHost;
+
     private String mPasskeyRegistrationScript;
 
     /**
@@ -195,6 +211,35 @@ public AzureActiveDirectoryWebViewClient(@NonNull final Activity activity,
                                              @Nullable final String utid,
                                              final boolean isWebViewWebCpEnabledInBrokerlessCase,
                                              @Nullable final IUrlLoadTracker urlLoadTracker) {
+        this(activity, completionCallback, pageLoadedCallback, redirectUrl,
+                switchBrowserProtocolCoordinator, utid, isWebViewWebCpEnabledInBrokerlessCase,
+                urlLoadTracker, null);
+    }
+
+    public AzureActiveDirectoryWebViewClient(@NonNull final Activity activity,
+                                             @NonNull final IAuthorizationCompletionCallback completionCallback,
+                                             @NonNull final OnPageLoadedCallback pageLoadedCallback,
+                                             @NonNull final String redirectUrl,
+                                             @NonNull final SwitchBrowserProtocolCoordinator switchBrowserProtocolCoordinator,
+                                             @Nullable final String utid,
+                                             final boolean isWebViewWebCpEnabledInBrokerlessCase,
+                                             @Nullable final IUrlLoadTracker urlLoadTracker,
+                                             @Nullable final String clientId) {
+        this(activity, completionCallback, pageLoadedCallback, redirectUrl,
+                switchBrowserProtocolCoordinator, utid, isWebViewWebCpEnabledInBrokerlessCase,
+                urlLoadTracker, clientId, null);
+    }
+
+    public AzureActiveDirectoryWebViewClient(@NonNull final Activity activity,
+                                             @NonNull final IAuthorizationCompletionCallback completionCallback,
+                                             @NonNull final OnPageLoadedCallback pageLoadedCallback,
+                                             @NonNull final String redirectUrl,
+                                             @NonNull final SwitchBrowserProtocolCoordinator switchBrowserProtocolCoordinator,
+                                             @Nullable final String utid,
+                                             final boolean isWebViewWebCpEnabledInBrokerlessCase,
+                                             @Nullable final IUrlLoadTracker urlLoadTracker,
+                                             @Nullable final String clientId,
+                                             @Nullable final String authorityHost) {
         super(activity, completionCallback, pageLoadedCallback);
         mRedirectUrl = redirectUrl;
         mCertBasedAuthFactory = new CertBasedAuthFactory(activity);
@@ -203,6 +248,8 @@ public AzureActiveDirectoryWebViewClient(@NonNull final Activity activity,
         mSpanContext = activity instanceof AuthorizationActivity ? ((AuthorizationActivity) getActivity()).getSpanContext() : null;
         mIsWebViewWebCpEnabledInBrokerlessCase = isWebViewWebCpEnabledInBrokerlessCase;
         mUrlLoadTracker = urlLoadTracker;
+        mClientId = clientId;
+        mAuthorityHost = authorityHost;
     }
 
     public AzureActiveDirectoryWebViewClient(@NonNull final Activity activity,
@@ -1350,6 +1397,29 @@ private void processInstallRequest(@NonNull final WebView view, @NonNull final S
         final Map<String, String> parameters = StringExtensions.getUrlParameters(url);
         final String appLink = parameters.get(APP_LINK_KEY);
 
+        // MAM Conditional Access onboarding: the service tells us which account is being onboarded
+        // on this redirect. Installing Company Portal usually kills this process, so remember the UPN
+        // now and pre-fill it on the request the user makes when they come back, instead of asking
+        // them to type their address again. No-op unless the flight is on and the redirect is marked
+        // as the MAM-CA path.
+        //
+        // Written inline on the UI thread, deliberately. This is the last moment the process is
+        // guaranteed to be alive: the completion callback below finishes the authorization activity
+        // and the Play Store install that follows very often kills us. Handing the write to a
+        // background thread would risk losing the hint in exactly the case it exists for, and would
+        // trade a bounded, best-effort write - a single encrypted key/value put, with every failure
+        // caught and swallowed inside the store - for a race it cannot win.
+        final Activity installRequestActivity = getActivity();
+        if (installRequestActivity != null) {
+            MamUpnHintStore.saveUpnHintForMamCaInstall(
+                    AndroidPlatformComponentsFactory.createFromContext(
+                            installRequestActivity.getApplicationContext()),
+                    mClientId,
+                    mAuthorityHost,
+                    parameters
+            );
+        }
+
         Logger.info(methodTag,"Launching the link to app:" + appLink);
         getCompletionCallback().onChallengeResponseReceived(result);