Skip to content

Native auth: update auth method blocked error handling, Fixes AB#3395876 #2804

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 7, 2025
Merged

Native auth: update auth method blocked error handling, Fixes AB#3395876 #2804

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ca400a6
Update expected error for auth method blocked
nilo-ms Nov 6, 2025
687a50b
update changelog
nilo-ms Nov 6, 2025
be5e2f4
Merge branch 'dev' into danilo/update-blocked-auth-method-
nilo-ms Nov 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ vNext
- [MINOR] WebApps AccountId Registry (#2787)
- [MINOR] Expose WebApps APIs (#2793)
- [MINOR] Add domainHint support to authorization request (#2792)
- [PATCH] Fix auth method blocked error handling (#2804)

Version 23.0.2
----------
Expand Down
1 change: 1 addition & 0 deletions ...main/com/microsoft/identity/common/java/nativeauth/providers/NativeAuthResponseHandler.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -730,6 +730,7 @@ class NativeAuthResponseHandler {
codeLength = null,
interval = null,
errorCodes = null,
subError = null,
correlationId = correlationId
)
} else {
Expand Down
6 changes: 4 additions & 2 deletions ...rosoft/identity/common/java/nativeauth/providers/responses/jit/JITChallengeApiResponse.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,12 @@ import com.google.gson.annotations.Expose
import com.google.gson.annotations.SerializedName
import com.microsoft.identity.common.java.nativeauth.providers.INativeAuthApiResponse
import com.microsoft.identity.common.java.nativeauth.providers.responses.ApiErrorResult
import com.microsoft.identity.common.java.nativeauth.util.isBlockedChallengeTarget
import com.microsoft.identity.common.java.nativeauth.util.isAccessDenied
import com.microsoft.identity.common.java.nativeauth.util.isInvalidChallengeTarget
import com.microsoft.identity.common.java.nativeauth.util.isInvalidRequest
import com.microsoft.identity.common.java.nativeauth.util.isOOB
import com.microsoft.identity.common.java.nativeauth.util.isPreverified
import com.microsoft.identity.common.java.nativeauth.util.isProviderBlocked
import com.microsoft.identity.common.java.nativeauth.util.isRedirect
import java.net.HttpURLConnection

Expand All @@ -51,6 +52,7 @@ class JITChallengeApiResponse(
@SerializedName("error_description") override val errorDescription: String?,
@SerializedName("error_uri") val errorUri: String?,
@SerializedName("error_codes") val errorCodes: List<Int>?,
@SerializedName("suberror") val subError: String?,
@Expose @SerializedName("challenge_type") override val challengeType: String?,
@SerializedName("redirect_reason") override val redirectReason: String?,
) : INativeAuthApiResponse(statusCode, correlationId, continuationToken, challengeType, redirectReason, error, errorDescription) {
Expand Down Expand Up @@ -79,7 +81,7 @@ class JITChallengeApiResponse(
correlationId = correlationId
)
}
error.isInvalidRequest() && errorCodes?.first().isBlockedChallengeTarget() -> {
error.isAccessDenied() && subError.isProviderBlocked() -> {
JITChallengeApiResult.BlockedVerificationContact(
error = error.orEmpty(),
errorDescription = errorDescription.orEmpty(),
Expand Down
6 changes: 3 additions & 3 deletions .../identity/common/java/nativeauth/providers/responses/signin/SignInChallengeApiResponse.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@ import com.google.gson.annotations.Expose
import com.google.gson.annotations.SerializedName
import com.microsoft.identity.common.java.nativeauth.providers.INativeAuthApiResponse
import com.microsoft.identity.common.java.nativeauth.providers.responses.ApiErrorResult
import com.microsoft.identity.common.java.nativeauth.util.isBlockedChallengeTarget
import com.microsoft.identity.common.java.nativeauth.util.isInvalidRequest
import com.microsoft.identity.common.java.nativeauth.util.isAccessDenied
import com.microsoft.identity.common.java.nativeauth.util.isOOB
import com.microsoft.identity.common.java.nativeauth.util.isPassword
import com.microsoft.identity.common.java.nativeauth.util.isProviderBlocked
import com.microsoft.identity.common.java.nativeauth.util.isRedirect
import java.net.HttpURLConnection

Expand Down Expand Up @@ -78,7 +78,7 @@ class SignInChallengeApiResponse(
// Handle 400 errors
HttpURLConnection.HTTP_BAD_REQUEST -> {
return when {
error.isInvalidRequest() && errorCodes?.first().isBlockedChallengeTarget() -> {
error.isAccessDenied() && subError.isProviderBlocked() -> {
SignInChallengeApiResult.BlockedAuthMethod(
error = error.orEmpty(),
errorDescription = errorDescription.orEmpty(),
Expand Down
8 changes: 6 additions & 2 deletions common4j/src/main/com/microsoft/identity/common/java/nativeauth/util/ApiErrorResponseUtil.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,10 @@ internal fun String?.isInvalidRequest(): Boolean {
return this.contentEquals(other = "invalid_request", ignoreCase = true)
}

internal fun String?.isAccessDenied(): Boolean {
return this.contentEquals(other = "access_denied", ignoreCase = true)
}

internal fun String?.isPasswordTooWeak(): Boolean {
return this.contentEquals(other = "password_too_weak", ignoreCase = true)
}
Expand Down Expand Up @@ -117,8 +121,8 @@ internal fun Int?.isInvalidChallengeTarget(): Boolean {
return this == 901001
}

internal fun Int?.isBlockedChallengeTarget(): Boolean {
return this == 550024
fun String?.isProviderBlocked(): Boolean {
return this.contentEquals(other = "provider_blocked_by_rep", ignoreCase = true)
}

fun String?.isMFARequired(): Boolean {
Expand Down
6 changes: 6 additions & 0 deletions .../com/microsoft/identity/common/java/nativeauth/providers/NativeAuthResponseHandlerTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3793,6 +3793,7 @@ class NativeAuthResponseHandlerTest {
challengeTarget = null,
codeLength = null,
interval = null,
subError = null,
correlationId = correlationId
)
val apiResult = jitChallengeApiResponse.toResult()
Expand Down Expand Up @@ -3820,6 +3821,7 @@ class NativeAuthResponseHandlerTest {
challengeTarget = null,
codeLength = null,
interval = null,
subError = null,
correlationId = correlationId
)
val apiResult = jitChallengeApiResponse.toResult()
Expand All @@ -3844,6 +3846,7 @@ class NativeAuthResponseHandlerTest {
challengeTarget = null,
codeLength = null,
interval = null,
subError = null,
correlationId = correlationId
)
val apiResult = jitChallengeApiResponse.toResult()
Expand Down Expand Up @@ -3872,6 +3875,7 @@ class NativeAuthResponseHandlerTest {
challengeTarget = null,
codeLength = null,
interval = null,
subError = null,
correlationId = correlationId
)
val apiResult = jitChallengeApiResponse.toResult()
Expand Down Expand Up @@ -3902,6 +3906,7 @@ class NativeAuthResponseHandlerTest {
challengeTarget = null,
codeLength = null,
interval = null,
subError = null,
correlationId = correlationId
)
val apiResult = jitChallengeApiResponse.toResult()
Expand Down Expand Up @@ -3931,6 +3936,7 @@ class NativeAuthResponseHandlerTest {
challengeTarget = challengeTargetLabel,
codeLength = codeLength,
interval = interval,
subError = null,
correlationId = correlationId
)
val apiResult = jitChallengeApiResponse.toResult()
Expand Down
Loading