Implement a WebView handler to facilitate broker app installation via the Play Store, Fixes AB#3277229

[p3dr0rv]

AB#3277229

ON BYOD MFA, there is a flow where users are invited to install the broker app from the Play Store.
This flow is currently broken on WebView as we do not have a handler for this type of URLS.
This PR introduces a handler to facilitate the installation of the broker app via the Play Store

[github-actions]

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

[Copilot]

Pull Request Overview

Adds handling for broker app installation intents in the WebView client.

• Detects intent:// URLs targeting known broker packages
• Parses and launches intents to install or open the broker app
• Introduces INTENT_PREFIX constant and updates changelog

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java	Added intent detection (isIntentRequestForBrokerApp) and processing (processIntentRequestForBrokerApp) methods
common/src/main/java/com/microsoft/identity/common/adal/internal/AuthenticationConstants.java	Defined INTENT_PREFIX constant for intent URI matching
changelog.txt	Documented the new minor feature

Comments suppressed due to low confidence (2)

common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java:45

• Remove the unused PackageHelper import to clean up the code.

import com.microsoft.identity.common.internal.broker.PackageHelper;

common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java:256

• The new intent-handling branch lacks unit tests. Add tests for matching and non-matching URIs, and for successful and failure paths in processIntentRequestForBrokerApp.

} else if (isIntentRequestForBrokerApp(formattedURL)) {

[Copilot]

Pull Request Overview

This PR implements a WebView handler to facilitate broker app installation via the Play Store. Key changes include:

• Adding new error string constants for URI syntax errors, missing activities, and unexpected errors.
• Introducing methods to detect and process intent requests for broker app installation in the WebView client.
• Updating authentication constants to include an intent URI prefix.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
common4j/src/main/com/microsoft/identity/common/java/exception/ErrorStrings.java	Added error strings for URI syntax errors, activity not found, and unexpected errors.
common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java	Added intent request detection and processing logic for broker app installation.
common/src/main/java/com/microsoft/identity/common/adal/internal/AuthenticationConstants.java	Added a new constant (INTENT_PREFIX) to support intent URI handling.
changelog.txt	Updated with a minor changelog entry for the new feature.

[github-actions]

✅ Work item link check complete. Description contains link AB#3277229 to an Azure Boards work item.

[shahzaibj]

I'm a little confused. Didn't we already have handling for PlayStore redirects? I see inside AzureActiveDirectoryWebViewClient we have handling for playstore URL.

Also before the LTW era (no broker preinstalled), we used to be able to ask for deviceid and this would cause eSTS to ask user to install AuthApp (broker) and IIRC, this would take us to playstore and work fine.

Is the issue here that the scheme has changed from market to intent? So essentially this was a regression from server?

[p3dr0rv]

I'm a little confused. Didn't we already have handling for PlayStore redirects? I see inside AzureActiveDirectoryWebViewClient we have handling for playstore URL.

Also before the LTW era (no broker preinstalled), we used to be able to ask for deviceid and this would cause eSTS to ask user to install AuthApp (broker) and IIRC, this would take us to playstore and work fine.

Is the issue here that the scheme has changed from market to intent? So essentially this was a regression from server?

@shahzaibj, Yes, we already handle marketplace URLs, but not intents. Someone from UX mentioned that the instructions page hasn't changed in the past 7 years, so it's unclear if this is actually a regression

https://portal.microsofticm.com/imp/v5/incidents/details/629923998/summary
I don’t have a record of how MFA was handled in the past or which pages were shown. to

[shahzaibj]

I'm a little confused. Didn't we already have handling for PlayStore redirects? I see inside AzureActiveDirectoryWebViewClient we have handling for playstore URL.
Also before the LTW era (no broker preinstalled), we used to be able to ask for deviceid and this would cause eSTS to ask user to install AuthApp (broker) and IIRC, this would take us to playstore and work fine.
Is the issue here that the scheme has changed from market to intent? So essentially this was a regression from server?

@shahzaibj, Yes, we already handle marketplace URLs, but not intents. Someone from UX mentioned that the instructions page hasn't changed in the past 7 years, so it's unclear if this is actually a regression

https://portal.microsofticm.com/imp/v5/incidents/details/629923998/summary I don’t have a record of how MFA was handled in the past or which pages were shown. to

Ok so this is specifically in the MFA setup route? Do we know if the CA page from eSTS (ask for deviceid claim without broker installed) is still sending the older type of redirect?

[p3dr0rv]

I'm a little confused. Didn't we already have handling for PlayStore redirects? I see inside AzureActiveDirectoryWebViewClient we have handling for playstore URL.
Also before the LTW era (no broker preinstalled), we used to be able to ask for deviceid and this would cause eSTS to ask user to install AuthApp (broker) and IIRC, this would take us to playstore and work fine.
Is the issue here that the scheme has changed from market to intent? So essentially this was a regression from server?

@shahzaibj, Yes, we already handle marketplace URLs, but not intents. Someone from UX mentioned that the instructions page hasn't changed in the past 7 years, so it's unclear if this is actually a regression
https://portal.microsofticm.com/imp/v5/incidents/details/629923998/summary I don’t have a record of how MFA was handled in the past or which pages were shown. to

Ok so this is specifically in the MFA setup route? Do we know if the CA page from eSTS (ask for deviceid claim without broker installed) is still sending the older type of redirect?

Yes, this specifically for this MFA setup route, for device id claim-no-broker we go through the other route. (tested)