Skip to content

Commit 0a66dc3

Browse files
TylerLeonhardtTylerLeonhardt
authored
Adopt concept of flows in Microsoft Auth (#237006)
And only use Loopback flow when not running in Remote Extension Host.
1 parent 7da68c0 commit 0a66dc3

File tree

2 files changed

+159
-71
lines changed

2 files changed

+159
-71
lines changed

‎extensions/microsoft-authentication/src/node/authProvider.ts

+54-71
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,17 @@
33
* Licensed under the MIT License. See License.txt in the project root for license information.
44
*--------------------------------------------------------------------------------------------*/
55
import { AccountInfo, AuthenticationResult, ClientAuthError, ClientAuthErrorCodes, ServerError } from '@azure/msal-node';
6-
import { AuthenticationGetSessionOptions, AuthenticationProvider, AuthenticationProviderAuthenticationSessionsChangeEvent, AuthenticationProviderSessionOptions, AuthenticationSession, AuthenticationSessionAccountInformation, CancellationError, env, EventEmitter, ExtensionContext, l10n, LogOutputChannel, Uri, window } from 'vscode';
6+
import { AuthenticationGetSessionOptions, AuthenticationProvider, AuthenticationProviderAuthenticationSessionsChangeEvent, AuthenticationProviderSessionOptions, AuthenticationSession, AuthenticationSessionAccountInformation, CancellationError, EventEmitter, ExtensionContext, ExtensionKind, l10n, LogOutputChannel, window } from 'vscode';
77
import { Environment } from '@azure/ms-rest-azure-env';
88
import { CachedPublicClientApplicationManager } from './publicClientCache';
9-
import { UriHandlerLoopbackClient } from '../common/loopbackClientAndOpener';
109
import { UriEventHandler } from '../UriEventHandler';
1110
import { ICachedPublicClientApplication } from '../common/publicClientCache';
1211
import { MicrosoftAccountType, MicrosoftAuthenticationTelemetryReporter } from '../common/telemetryReporter';
13-
import { loopbackTemplate } from './loopbackTemplate';
1412
import { ScopeData } from '../common/scopeData';
1513
import { EventBufferer } from '../common/event';
1614
import { BetterTokenStorage } from '../betterSecretStorage';
1715
import { IStoredSession } from '../AADHelper';
16+
import { ExtensionHost, getMsalFlows } from './flows';
1817

1918
const redirectUri = 'https://vscode.dev/redirect';
2019
const MSA_TID = '9188040d-6c67-4c5b-b112-36a304b66dad';
@@ -187,86 +186,70 @@ export class MsalAuthProvider implements AuthenticationProvider {
187186

188187
this._logger.info('[createSession]', `[${scopeData.scopeStr}]`, 'starting');
189188
const cachedPca = await this.getOrCreatePublicClientApplication(scopeData.clientId, scopeData.tenant);
190-
let result: AuthenticationResult | undefined;
191-
192-
try {
193-
const windowHandle = window.nativeHandle ? Buffer.from(window.nativeHandle) : undefined;
194-
result = await cachedPca.acquireTokenInteractive({
195-
openBrowser: async (url: string) => { await env.openExternal(Uri.parse(url)); },
196-
scopes: scopeData.scopesToSend,
197-
// The logic for rendering one or the other of these templates is in the
198-
// template itself, so we pass the same one for both.
199-
successTemplate: loopbackTemplate,
200-
errorTemplate: loopbackTemplate,
201-
// Pass the label of the account to the login hint so that we prefer signing in to that account
202-
loginHint: options.account?.label,
203-
// If we aren't logging in to a specific account, then we can use the prompt to make sure they get
204-
// the option to choose a different account.
205-
prompt: options.account?.label ? undefined : 'select_account',
206-
windowHandle
207-
});
208-
} catch (e) {
209-
if (e instanceof CancellationError) {
210-
const yes = l10n.t('Yes');
211-
const result = await window.showErrorMessage(
212-
l10n.t('Having trouble logging in?'),
213-
{
214-
modal: true,
215-
detail: l10n.t('Would you like to try a different way to sign in to your Microsoft account? ({0})', 'protocol handler')
216-
},
217-
yes
218-
);
219-
if (!result) {
220-
this._telemetryReporter.sendLoginFailedEvent();
221-
throw e;
222-
}
189+
190+
// Used for showing a friendlier message to the user when the explicitly cancel a flow.
191+
let userCancelled: boolean | undefined;
192+
const yes = l10n.t('Yes');
193+
const no = l10n.t('No');
194+
const promptToContinue = async (mode: string) => {
195+
if (userCancelled === undefined) {
196+
// We haven't had a failure yet so wait to prompt
197+
return;
223198
}
224-
// This error comes from the backend and is likely not due to the user's machine
225-
// failing to open a port or something local that would require us to try the
226-
// URL handler loopback client.
227-
if (e instanceof ServerError) {
228-
this._telemetryReporter.sendLoginFailedEvent();
229-
throw e;
199+
const message = userCancelled
200+
? l10n.t('Having trouble logging in? Would you like to try a different way? ({0})', mode)
201+
: l10n.t('You have not yet finished authorizing this extension to use your Microsoft Account. Would you like to try a different way? ({0})', mode);
202+
const result = await window.showWarningMessage(message, yes, no);
203+
if (result !== yes) {
204+
throw new CancellationError();
230205
}
206+
};
231207

232-
// The user closed the modal window
233-
if ((e as ClientAuthError).errorCode === ClientAuthErrorCodes.userCanceled) {
234-
this._telemetryReporter.sendLoginFailedEvent();
235-
throw e;
236-
}
208+
const flows = getMsalFlows({
209+
extensionHost: typeof navigator === 'undefined'
210+
? this._context.extension.extensionKind === ExtensionKind.UI ? ExtensionHost.Local : ExtensionHost.Remote
211+
: ExtensionHost.WebWorker,
212+
});
237213

238-
// The user wants to try the loopback client or we got an error likely due to spinning up the server
239-
const loopbackClient = new UriHandlerLoopbackClient(this._uriHandler, redirectUri, this._logger);
214+
let lastError: Error | undefined;
215+
for (const flow of flows) {
216+
if (flow !== flows[0]) {
217+
try {
218+
await promptToContinue(flow.label);
219+
} finally {
220+
this._telemetryReporter.sendLoginFailedEvent();
221+
}
222+
}
240223
try {
241-
const windowHandle = window.nativeHandle ? Buffer.from(window.nativeHandle) : undefined;
242-
result = await cachedPca.acquireTokenInteractive({
243-
openBrowser: (url: string) => loopbackClient.openBrowser(url),
224+
const result = await flow.trigger({
225+
cachedPca,
244226
scopes: scopeData.scopesToSend,
245-
loopbackClient,
246227
loginHint: options.account?.label,
247-
prompt: options.account?.label ? undefined : 'select_account',
248-
windowHandle
228+
windowHandle: window.nativeHandle ? Buffer.from(window.nativeHandle) : undefined,
229+
logger: this._logger,
230+
uriHandler: this._uriHandler
249231
});
232+
233+
const session = this.sessionFromAuthenticationResult(result, scopeData.originalScopes);
234+
this._telemetryReporter.sendLoginEvent(session.scopes);
235+
this._logger.info('[createSession]', `[${scopeData.scopeStr}]`, 'returned session');
236+
this._onDidChangeSessionsEmitter.fire({ added: [session], changed: [], removed: [] });
237+
return session;
250238
} catch (e) {
251-
this._telemetryReporter.sendLoginFailedEvent();
252-
throw e;
239+
lastError = e;
240+
if (e instanceof ServerError || (e as ClientAuthError)?.errorCode === ClientAuthErrorCodes.userCanceled) {
241+
this._telemetryReporter.sendLoginFailedEvent();
242+
throw e;
243+
}
244+
// Continue to next flow
245+
if (e instanceof CancellationError) {
246+
userCancelled = true;
247+
}
253248
}
254249
}
255250

256-
if (!result) {
257-
this._telemetryReporter.sendLoginFailedEvent();
258-
throw new Error('No result returned from MSAL');
259-
}
260-
261-
const session = this.sessionFromAuthenticationResult(result, scopeData.originalScopes);
262-
this._telemetryReporter.sendLoginEvent(session.scopes);
263-
this._logger.info('[createSession]', `[${scopeData.scopeStr}]`, 'returned session');
264-
// This is the only scenario in which we need to fire the _onDidChangeSessionsEmitter out of band...
265-
// the badge flow (when the client passes no options in to getSession) will only remove a badge if a session
266-
// was created that _matches the scopes_ that that badge requests. See `onDidChangeSessions` for more info.
267-
// TODO: This should really be fixed in Core.
268-
this._onDidChangeSessionsEmitter.fire({ added: [session], changed: [], removed: [] });
269-
return session;
251+
this._telemetryReporter.sendLoginFailedEvent();
252+
throw lastError ?? new Error('No auth flow succeeded');
270253
}
271254

272255
async removeSession(sessionId: string): Promise<void> {

‎extensions/microsoft-authentication/src/node/flows.ts

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
/*---------------------------------------------------------------------------------------------
2+
* Copyright (c) Microsoft Corporation. All rights reserved.
3+
* Licensed under the MIT License. See License.txt in the project root for license information.
4+
*--------------------------------------------------------------------------------------------*/
5+
6+
import { AuthenticationResult } from '@azure/msal-node';
7+
import { Uri, LogOutputChannel, env } from 'vscode';
8+
import { ICachedPublicClientApplication } from '../common/publicClientCache';
9+
import { UriHandlerLoopbackClient } from '../common/loopbackClientAndOpener';
10+
import { UriEventHandler } from '../UriEventHandler';
11+
import { loopbackTemplate } from './loopbackTemplate';
12+
13+
const redirectUri = 'https://vscode.dev/redirect';
14+
15+
export const enum ExtensionHost {
16+
WebWorker,
17+
Remote,
18+
Local
19+
}
20+
21+
interface IMsalFlowOptions {
22+
supportsRemoteExtensionHost: boolean;
23+
supportsWebWorkerExtensionHost: boolean;
24+
}
25+
26+
interface IMsalFlowTriggerOptions {
27+
cachedPca: ICachedPublicClientApplication;
28+
scopes: string[];
29+
loginHint?: string;
30+
windowHandle?: Buffer;
31+
logger: LogOutputChannel;
32+
uriHandler: UriEventHandler;
33+
}
34+
35+
interface IMsalFlow {
36+
readonly label: string;
37+
readonly options: IMsalFlowOptions;
38+
trigger(options: IMsalFlowTriggerOptions): Promise<AuthenticationResult>;
39+
}
40+
41+
class DefaultLoopbackFlow implements IMsalFlow {
42+
label = 'default';
43+
options: IMsalFlowOptions = {
44+
supportsRemoteExtensionHost: true,
45+
supportsWebWorkerExtensionHost: true
46+
};
47+
48+
async trigger({ cachedPca, scopes, loginHint, windowHandle, logger }: IMsalFlowTriggerOptions): Promise<AuthenticationResult> {
49+
logger.info('Trying default msal flow...');
50+
return await cachedPca.acquireTokenInteractive({
51+
openBrowser: async (url: string) => { await env.openExternal(Uri.parse(url)); },
52+
scopes,
53+
successTemplate: loopbackTemplate,
54+
errorTemplate: loopbackTemplate,
55+
loginHint,
56+
prompt: loginHint ? undefined : 'select_account',
57+
windowHandle
58+
});
59+
}
60+
}
61+
62+
class UrlHandlerFlow implements IMsalFlow {
63+
label = 'protocol handler';
64+
options: IMsalFlowOptions = {
65+
supportsRemoteExtensionHost: false,
66+
supportsWebWorkerExtensionHost: false
67+
};
68+
69+
async trigger({ cachedPca, scopes, loginHint, windowHandle, logger, uriHandler }: IMsalFlowTriggerOptions): Promise<AuthenticationResult> {
70+
logger.info('Trying protocol handler flow...');
71+
const loopbackClient = new UriHandlerLoopbackClient(uriHandler, redirectUri, logger);
72+
return await cachedPca.acquireTokenInteractive({
73+
openBrowser: (url: string) => loopbackClient.openBrowser(url),
74+
scopes,
75+
loopbackClient,
76+
loginHint,
77+
prompt: loginHint ? undefined : 'select_account',
78+
windowHandle
79+
});
80+
}
81+
}
82+
83+
const allFlows: IMsalFlow[] = [
84+
new DefaultLoopbackFlow(),
85+
new UrlHandlerFlow()
86+
];
87+
88+
export interface IMsalFlowQuery {
89+
extensionHost: ExtensionHost;
90+
}
91+
92+
export function getMsalFlows(query: IMsalFlowQuery): IMsalFlow[] {
93+
return allFlows.filter(flow => {
94+
let useFlow: boolean = true;
95+
switch (query.extensionHost) {
96+
case ExtensionHost.Remote:
97+
useFlow &&= flow.options.supportsRemoteExtensionHost;
98+
break;
99+
case ExtensionHost.WebWorker:
100+
useFlow &&= flow.options.supportsWebWorkerExtensionHost;
101+
break;
102+
}
103+
return useFlow;
104+
});
105+
}

0 commit comments

Comments
 (0)