openid / openid/AppAuth-iOS

AppAuth browser sometimes is not getting the approval from Microsoft Authenticator when user goes back to the app that was in the background

Open
#750 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug triage
Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

Describe the bug
Our app has the following login flow:

  1. Call authState method so the login page is opened in a web view (will call it like this for simplicity).
  2. Enter user and password, then the page waits for approval from Microsoft Authenticator.
  3. The user opens Microsoft Authenticator, a dialog asking for approval appears, the user taps on "Approve".
  4. The user goes back to our app.
  5. When the user opens our app, the page in the browser should be updated automatically, then the page should ask the user whether he wants to stay signed in or not, whatever the user answer is, the web view is closed and the AppAuth callback is called with the access token, refresh token, etc.

The problem is that step 5 doesn't always work. Sometimes (it happens randomly), when the user goes back to our app after approving access from Authenticator, the page is not updated so the user gets stuck in the auth flow and have to try it again, after 2 to 4 attempts, the login works (sometimes it works on the first time).

It looks like the issue is related to the fact of our app being in the background when the user approves access in the Authenticator app, because if we follow the login flow, and approve access in the Microsoft Authenticator app in a different device, the login always works.

Is there any workaround to ensure the page always receives the approval from Authenticator despite our app being in the background?

Thanks in advance.

Expected behavior
The login flow should always work.

Environment

  • Device: iPhone X but our users have reported this from different devices.
  • OS: iOS 15, iOS 16
  • Browser: The one opened by default by AppAuth.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the authState login flow and the AppAuth callback, reproducing the issue on iOS 15 and iOS 16 while the app is backgrounded during Microsoft Authenticator approval. Compare returning from Authenticator with approving on a different device; done means the browser page updates and the callback consistently receives the access and refresh tokens.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.