dotnet / dotnet/macios

Xamarin iOS CFNetwork issue with Apple's SSO Extension

Open
#9,994 3 comments 0 reactions 0 assignees View on GitHub
bug iOS networking
Dominant language
C#
Stars
2.9k
Forks
576
Avg merge
2d 12h
Merged PRs (30d)
123

Description

We are using Apple's SSO Extension on managed iOS devices to provide SSO functionality : [SSO Extension](https://developer.apple.com/documentation/authenticationservices?language=objc)

In iOS, on work place joined devices, sign in network requests to obtain tokens from Microsoft endpoints go through our SSO extension first to provide SSO for the managed account. Since the extension is present within our trusted broker (Microsoft Authenticator) it can immediately handle the network request and issue tokens or decide to not handle the request and pass it on to underlying System CFNetwork to handle the request. From the calling app’s perspective these requests are regular network requests and it doesn’t know they pass through our SSO extension.

The SSO extension decides not to handle the request by calling [doNotHandle](https://developer.apple.com/documentation/authenticationservices/asauthorizationproviderextensionauthorizationrequest/3180397-donothandle?language=objc) and the request should be passed on to CFNetwork like a regular network request. This seems to happen for native iOS apps, however for Xamarin built iOS apps the network request gets a timeout error and system logs indicate that the request was cancelled as evidenced by :

Task .<1> finished with error [-999] Error Domain=NSURLErrorDomain Code=-999 UserInfo={NSErrorFailingURLStringKey=, NSErrorFailingURLKey=, _NSURLErrorRelatedURLSessionTaskErrorKey=, _NSURLErrorFailingURLSessionTaskErrorKey=, NSLocalizedDescription=}

NSURLErrorDomain Code=-999 : https://developer.apple.com/documentation/foundation/1508628-url_loading_system_error_codes/nsurlerrorcancelled?language=objc

This issue is only specific to Xamarin iOS apps and not iOS native apps. The xamarin version used is : **13.20.2.2**

### Expected Behavior
CFNetwork requests to go through and return their response when the flow goes through SSO Extension.

### Actual Behavior
CFNetwork requests are being cancelled and a timeout exception is being returned when the flow goes through SSO extension.

### Steps to Reproduce
Steps to reproduce involve work place joining device. The configuration profile downloaded post work place join contains config for SSO extension. Since it would involve specific account credentials, I've shared repro steps with @mandel-macaque

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the reproduction steps shared with @mandel-macaque and compare the Xamarin iOS request path with a native iOS app when the SSO extension calls doNotHandle. Use the system logs showing NSURLErrorDomain Code -999 to investigate the cancellation; done means CFNetwork requests complete and return their responses instead of timing out.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, ios
Domain
mobile-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.