Use single FRT #1470
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -36,6 +36,10 @@ | |
| #import "MSIDAppMetadataCacheKey.h" | ||
| #import "MSIDAppMetadataCacheQuery.h" | ||
| #import "MSIDExtendedTokenCacheDataSource.h" | ||
| #import "MSIDConfiguration.h" | ||
| #import "MSIDConstants.h" | ||
| #import "MSIDJsonObject.h" | ||
| #import "MSIDFlightManager.h" | ||
|
|
||
| @interface MSIDAccountCredentialCache() | ||
| { | ||
|
|
@@ -382,7 +386,7 @@ - (BOOL)removeCredential:(nonnull MSIDCredentialCacheItem *)credential | |
|
|
||
| BOOL result = [_dataSource removeTokensWithKey:key context:context error:error]; | ||
|
|
||
| if (result && (credential.credentialType == MSIDRefreshTokenType || credential.credentialType == MSIDFamilyRefreshTokenType)) | ||
| { | ||
| [_dataSource saveWipeInfoWithContext:context error:nil]; | ||
| } | ||
|
|
@@ -556,4 +560,159 @@ - (BOOL)removeAppMetadata:(nonnull MSIDAppMetadataCacheItem *)appMetadata | |
| return cacheItems; | ||
| } | ||
|
|
||
| - (MSIDIsFRTEnabledStatus)checkFRTEnabled:(nullable id<MSIDRequestContext>)context | ||
| error:(NSError * _Nullable __autoreleasing * _Nullable)error | ||
| { | ||
| // This block will be used to check feature flags and update FRT settings if needed, depending on the current status | ||
| // of the keychain item, avoiding an unnecessary read or update if status is the same | ||
| MSIDIsFRTEnabledStatus (^checkFeatureFlagsAndReturn)(MSIDIsFRTEnabledStatus) = ^MSIDIsFRTEnabledStatus(MSIDIsFRTEnabledStatus status) { | ||
|
|
||
| // Check if FRT is enabled by feature flight | ||
| MSIDFlightManager *flightManager = [MSIDFlightManager sharedInstance]; | ||
| BOOL flagEnableFRT = [flightManager boolForKey:@"enable_client_sfrt_by_tenant_id"]; // TODO: Replace this by the constant from the other branch, and remove the hardcoded YES | ||
|
There was a problem hiding this comment. nit: do you still need TODO here? There was a problem hiding this comment. Yes, I will replace this when the other PR (#1489) is merged. |
||
| BOOL flagDisableAllFRT = [flightManager boolForKey:@"disable_client_sfrt_for_all"]; | ||
| BOOL shouldEnableFRT = flagEnableFRT && !flagDisableAllFRT; | ||
|
|
||
| switch (status) | ||
| { | ||
| // No entry in cache | ||
| case MSIDIsFRTEnabledStatusNotEnabled: | ||
| if (shouldEnableFRT) | ||
| { | ||
| [self updateFRTSettings:YES context:context error:nil]; | ||
kaisong1990 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| return MSIDIsFRTEnabledStatusActive; | ||
| } | ||
| break; | ||
|
|
||
| // Deserialization error, try to enable/disable if needed | ||
| case MSIDIsFRTEnabledStatusDisabledByDeserializationError: | ||
| if (shouldEnableFRT) | ||
| { | ||
| [self updateFRTSettings:YES context:context error:nil]; | ||
| return MSIDIsFRTEnabledStatusActive; | ||
| } | ||
| else if (flagDisableAllFRT) | ||
| { | ||
| [self updateFRTSettings:NO context:context error:nil]; | ||
| return MSIDIsFRTEnabledStatusDisabledByKeychainItem; | ||
| } | ||
| break; | ||
|
|
||
| // FRT is currently enabled, check to see if should be disabled | ||
| case MSIDIsFRTEnabledStatusActive: | ||
| if (flagDisableAllFRT) | ||
| { | ||
| [self updateFRTSettings:NO context:context error:nil]; | ||
| return MSIDIsFRTEnabledStatusDisabledByKeychainItem; | ||
| } | ||
| break; | ||
|
|
||
| // FRT is disabled, check to see if should be enabled | ||
| case MSIDIsFRTEnabledStatusDisabledByKeychainItem: | ||
| if (shouldEnableFRT) | ||
| { | ||
| [self updateFRTSettings:YES context:context error:nil]; | ||
| return MSIDIsFRTEnabledStatusActive; | ||
| } | ||
| break; | ||
|
|
||
| // Error reading keychain item, do not update settings | ||
| case MSIDIsFRTEnabledStatusDisabledByKeychainError: | ||
| break; | ||
|
|
||
| // Feature is disabled by client app, do nothing with keychain item | ||
| case MSIDIsFRTEnabledStatusDisabledByClientApp: | ||
| break; | ||
| } | ||
|
|
||
| return status; | ||
| }; | ||
|
|
||
| // Check if FRT is disabled by client | ||
kaisong1990 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| if (context.disableFRT) | ||
| { | ||
| MSID_LOG_WITH_CTX(MSIDLogLevelInfo, context, @"FRT disabled by MSAL client app, returning NO"); | ||
| return checkFeatureFlagsAndReturn(MSIDIsFRTEnabledStatusDisabledByClientApp); | ||
| } | ||
|
|
||
| NSError *readError = nil; | ||
| NSArray<MSIDJsonObject *> *jsonObjects = [_dataSource jsonObjectsWithKey:[MSIDAccountCredentialCache checkFRTCacheKey] | ||
| serializer:[MSIDCacheItemJsonSerializer new] | ||
| context:context | ||
| error:&readError]; | ||
|
|
||
| if (readError) | ||
| { | ||
| MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Failed to retrieve FRT cache entry, error: %@", readError); | ||
| if (error) | ||
| { | ||
| *error = readError; | ||
| } | ||
| return checkFeatureFlagsAndReturn(MSIDIsFRTEnabledStatusDisabledByKeychainError); | ||
| } | ||
|
|
||
| if (![jsonObjects count]) | ||
| { | ||
| MSID_LOG_WITH_CTX(MSIDLogLevelInfo, context, @"No FRT cache entry found, returning NO"); | ||
| return checkFeatureFlagsAndReturn(MSIDIsFRTEnabledStatusNotEnabled); | ||
| } | ||
|
|
||
| NSDictionary *dict = [jsonObjects[0] jsonDictionary]; | ||
| if (!dict || ![dict isKindOfClass:[NSDictionary class]] || [dict objectForKey:MSID_USE_SINGLE_FRT_KEY] == nil) | ||
| { | ||
| MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Failed to deserialize FRT cache entry, returning NO"); | ||
| return checkFeatureFlagsAndReturn(MSIDIsFRTEnabledStatusDisabledByDeserializationError); | ||
| } | ||
|
|
||
| id useFRT = dict[MSID_USE_SINGLE_FRT_KEY]; | ||
| if(([useFRT isKindOfClass:[NSNumber class]] || [useFRT isKindOfClass:[NSString class]]) && [useFRT boolValue]) | ||
| { | ||
| MSID_LOG_WITH_CTX(MSIDLogLevelInfo, context, @"FRT is enabled"); | ||
| return checkFeatureFlagsAndReturn(MSIDIsFRTEnabledStatusActive); | ||
| } | ||
|
|
||
| MSID_LOG_WITH_CTX(MSIDLogLevelInfo, context, @"FRT is disabled"); | ||
| return checkFeatureFlagsAndReturn(MSIDIsFRTEnabledStatusDisabledByKeychainItem); | ||
| } | ||
|
|
||
| - (void)updateFRTSettings:(BOOL)enableFRT | ||
| context:(nullable id<MSIDRequestContext>)context | ||
| error:(NSError * _Nullable __autoreleasing * _Nullable)error | ||
| { | ||
| MSID_LOG_WITH_CTX(MSIDLogLevelInfo, context, @"Updating UseSingleFRT Item with enableFRT:%@", enableFRT ? @"YES" : @"NO"); | ||
|
|
||
| NSDictionary *settings = @{MSID_USE_SINGLE_FRT_KEY: @(enableFRT)}; | ||
|
|
||
| NSError *saveError = nil; | ||
| MSIDJsonObject *jsonObject = [[MSIDJsonObject alloc] initWithJSONDictionary:settings error:&saveError]; | ||
|
|
||
| [_dataSource saveJsonObject:jsonObject | ||
| serializer:[MSIDCacheItemJsonSerializer new] | ||
| key:[MSIDAccountCredentialCache checkFRTCacheKey] | ||
| context:context | ||
| error:&saveError]; | ||
|
|
||
| if (saveError) | ||
| { | ||
| MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Failed to save FRT cache entry, error: %@", saveError); | ||
| if (error) | ||
| { | ||
| *error = saveError; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| + (MSIDCacheKey *)checkFRTCacheKey | ||
| { | ||
| static MSIDCacheKey *cacheKey = nil; | ||
| static dispatch_once_t onceToken; | ||
| dispatch_once(&onceToken, ^{ | ||
| cacheKey = [[MSIDCacheKey alloc] initWithAccount:MSID_USE_SINGLE_FRT_KEYCHAIN | ||
| service:MSID_USE_SINGLE_FRT_KEYCHAIN | ||
| generic:nil | ||
| type:nil]; | ||
| }); | ||
| return cacheKey; | ||
| } | ||
|
|
||
| @end | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: readwrite is by default I think, can be removed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated