Native auth: SMS OTP MFA/JIT implementation, Fixes AB#3313635

changelog

@@ -3,6 +3,8 @@ MSAL Wiki : https://github.com/AzureAD/microsoft-authentication-library-for-andr
 vNext
 ----------
 - [MAJOR] Update proguard rules (#2372)
+- [MINOR] SDK now handles SMS as strong authentication method (#2382)
+- [MINOR] Awaiting MFA Delegate now automatically returns the AuthMethods to be used when calling MFA Challenge (#2380)
 
 Version 7.1.0
 ----------

msal/src/main/java/com/microsoft/identity/nativeauth/AuthMethod.kt

@@ -26,8 +26,6 @@ import android.os.Parcel
 import android.os.Parcelable
 import com.microsoft.identity.common.java.nativeauth.providers.responses.signin.AuthenticationMethodApiResult
 import com.microsoft.identity.common.java.nativeauth.util.ILoggable
-import com.microsoft.identity.nativeauth.statemachine.states.AwaitingMFAState
-import com.microsoft.identity.nativeauth.utils.serializable
 
 /**
  * AuthMethod represents a user's authentication methods.
@@ -40,9 +38,9 @@ data class AuthMethod(
     val challengeType: String,
 
     // Auth method login hint (e.g. [email protected])
-    val loginHint: String,
+    val loginHint: String?,
 
-    // Auth method challenge channel (email, etc.)
+    // Auth method challenge channel (email, sms, etc.)
     val challengeChannel: String,
 ) : ILoggable, Parcelable {
     override fun toUnsanitizedString(): String = "AuthMethod(id=$id, " +

msal/src/main/java/com/microsoft/identity/nativeauth/NativeAuthPublicClientApplication.kt

@@ -682,6 +682,7 @@ class NativeAuthPublicClientApplication(
                                 nextState = SignInCodeRequiredState(
                                     continuationToken = result.continuationToken,
                                     correlationId = result.correlationId,
+                                    username = username,
                                     scopes = scopes,
                                     config = nativeAuthConfig,
                                     claimsRequestJson = params.claimsRequestJson
@@ -719,6 +720,7 @@ class NativeAuthPublicClientApplication(
                                     nextState = SignInPasswordRequiredState(
                                         continuationToken = result.continuationToken,
                                         correlationId = result.correlationId,
+                                        username = username,
                                         scopes = scopes,
                                         config = nativeAuthConfig,
                                         claimsRequestJson = params.claimsRequestJson
@@ -778,6 +780,7 @@ class NativeAuthPublicClientApplication(
                                 nextState = RegisterStrongAuthState(
                                     continuationToken = result.continuationToken,
                                     correlationId = result.correlationId,
+                                    username = username,
                                     config = nativeAuthConfig
                                 ),
                                 authMethods = result.authMethods.toListOfAuthMethods()

msal/src/main/java/com/microsoft/identity/nativeauth/parameters/NativeAuthChallengeAuthMethodParameters.kt

@@ -36,7 +36,7 @@ class NativeAuthChallengeAuthMethodParameters(
 ) {
 
     /**
-     * email to contact to register a new strong authentication method
+     * email or phone number to contact to register a new strong authentication method
      */
     var verificationContact: String? = null
 }

msal/src/main/java/com/microsoft/identity/nativeauth/statemachine/errors/Error.kt

@@ -23,23 +23,14 @@
 
 package com.microsoft.identity.nativeauth.statemachine.errors
 
-import com.microsoft.identity.nativeauth.statemachine.results.GetAccessTokenResult
 import com.microsoft.identity.nativeauth.statemachine.results.GetAccountResult
 import com.microsoft.identity.nativeauth.statemachine.results.ResetPasswordResendCodeResult
-import com.microsoft.identity.nativeauth.statemachine.results.ResetPasswordResult
-import com.microsoft.identity.nativeauth.statemachine.results.ResetPasswordStartResult
 import com.microsoft.identity.nativeauth.statemachine.results.ResetPasswordSubmitCodeResult
-import com.microsoft.identity.nativeauth.statemachine.results.ResetPasswordSubmitPasswordResult
 import com.microsoft.identity.nativeauth.statemachine.results.SignInResendCodeResult
-import com.microsoft.identity.nativeauth.statemachine.results.SignInResult
 import com.microsoft.identity.nativeauth.statemachine.results.SignInSubmitCodeResult
-import com.microsoft.identity.nativeauth.statemachine.results.SignInSubmitPasswordResult
 import com.microsoft.identity.nativeauth.statemachine.results.SignOutResult
 import com.microsoft.identity.nativeauth.statemachine.results.SignUpResendCodeResult
-import com.microsoft.identity.nativeauth.statemachine.results.SignUpResult
-import com.microsoft.identity.nativeauth.statemachine.results.SignUpSubmitAttributesResult
 import com.microsoft.identity.nativeauth.statemachine.results.SignUpSubmitCodeResult
-import com.microsoft.identity.nativeauth.statemachine.results.SignUpSubmitPasswordResult
 
 /**
  * ErrorTypes class holds the possible error type values that are shared between the errors
@@ -89,6 +80,12 @@ internal class ErrorTypes {
          */
         const val INVALID_INPUT = "invalid_input"
 
+        /*
+         * The VERIFICATION_CONTACT_BLOCKED value indicates the verification contact provided has been blocked.
+         * Try using another email or phone number, or select an alternative authentication method.
+         */
+        const val VERIFICATION_CONTACT_BLOCKED = "verification_contact_blocked"
+
         /*
          * The INVALID_STATE value indicates a misconfigured or expired state, or an internal error
          * in state transitions. If this occurs, the flow should be restarted.

msal/src/main/java/com/microsoft/identity/nativeauth/statemachine/errors/JITErrors.kt

@@ -13,6 +13,12 @@ class RegisterStrongAuthChallengeError(
 ): BrowserRequiredError, RegisterStrongAuthChallengeResult, Error(errorType = errorType, error = error, errorMessage= errorMessage, correlationId = correlationId, errorCodes = errorCodes, exception = exception)
 {
     fun isInvalidInput(): Boolean = this.errorType == ErrorTypes.INVALID_INPUT
+
+    /*
+     * Returns true if the verification contact provided has been blocked.
+     * Try using another email or phone number, or select an alternative authentication method.
+     */
+    fun isVerificationContactBlocked(): Boolean = this.errorType == ErrorTypes.VERIFICATION_CONTACT_BLOCKED
 }
 
 class RegisterStrongAuthSubmitChallengeError(

msal/src/main/java/com/microsoft/identity/nativeauth/statemachine/results/MFAResult.kt

@@ -37,7 +37,7 @@ interface MFARequiredResult: Result {
      * @param nextState [com.microsoft.identity.nativeauth.statemachine.states.MFARequiredState] the current state of the flow with follow-on methods.
      * @param codeLength the length of the challenge required by the server.
      * @param sentTo the email/phone number the challenge was sent to.
-     * @param channel the channel(email/phone) the challenge was sent through.
+     * @param channel the channel(email/sms) the challenge was sent through.
      */
     class VerificationRequired(
         override val nextState: MFARequiredState,

msal/src/main/java/com/microsoft/identity/nativeauth/statemachine/results/SignInResult.kt

@@ -84,7 +84,7 @@ interface SignInResult : Result {
     class MFARequired(
         override val nextState: AwaitingMFAState,
         val authMethods: List<AuthMethod>
-    ) : Result.SuccessResult(nextState = nextState), SignInResult, SignInSubmitPasswordResult
+    ) : Result.SuccessResult(nextState = nextState), SignInResult, SignInSubmitPasswordResult, SignInSubmitCodeResult
 
     /**
      * StrongAuthMethodRegistration Result, which indicates that a registration of a strong authentication method is required to continue.
@@ -95,7 +95,7 @@ interface SignInResult : Result {
     class StrongAuthMethodRegistrationRequired(
         override val nextState: RegisterStrongAuthState,
         val authMethods: List<AuthMethod>
-    ) : Result.SuccessResult(nextState = nextState), SignInResult, SignInSubmitPasswordResult
+    ) : Result.SuccessResult(nextState = nextState), SignInResult, SignInSubmitPasswordResult, SignInSubmitCodeResult
 }
 
 /**

msal/src/main/java/com/microsoft/identity/nativeauth/statemachine/states/JITStates.kt

@@ -40,23 +40,31 @@ import kotlinx.coroutines.withContext
 abstract class BaseJITSubmitChallengeState(
     override val continuationToken: String,
     override val correlationId: String,
+    internal open val username: String,
     private val config: NativeAuthPublicClientApplicationConfiguration
 ) : BaseState(continuationToken = continuationToken, correlationId = correlationId), State, Parcelable {
     suspend fun internalChallengeAuthMethod(parameters: NativeAuthChallengeAuthMethodParameters, tag: String): RegisterStrongAuthChallengeResult {
         Logger.warn(
             tag,
             "Warning: this API is experimental. It may be changed in the future without notice. Do not use in production applications."
         )
-        // if external developer does not provide a verification contact, we use the login hint
-        val verificationContact: String = parameters.verificationContact.takeIf { !it.isNullOrBlank() } ?: parameters.authMethod.loginHint
-        // Currently, only email is supported for the challengeChannel. Continuation token grant type is used only for "preverified" flow.
-        val challengeChannel = NativeAuthConstants.ChallengeChannel.EMAIL
+        // when SMS auth method is used verification contact can't be nil or empty
+        if (isChallengeChannelSMS(parameters.authMethod.challengeChannel) && parameters.verificationContact.isNullOrBlank()) {
+            return RegisterStrongAuthChallengeError(
+                errorType = ErrorTypes.INVALID_INPUT,
+                errorMessage = "Invalid verification contact",
+                correlationId = correlationId
+            )
+        }
+
+        // if external developer does not provide a verification contact, we use the username
+        val verificationContact: String = parameters.verificationContact.takeIf { !it.isNullOrBlank() } ?: username
         val params =
             CommandParametersAdapter.createJITChallengeAuthMethodCommandParameters(
                 config,
                 config.oAuth2TokenCache,
                 verificationContact,
-                challengeChannel,
+                parameters.authMethod.challengeChannel,
                 parameters.authMethod.challengeType,
                 correlationId,
                 continuationToken,
@@ -108,12 +116,22 @@ abstract class BaseJITSubmitChallengeState(
                         errorCodes = result.errorCodes
                     )
                 }
+                is JITCommandResult.BlockedVerificationContact -> {
+                    RegisterStrongAuthChallengeError(
+                        errorType = ErrorTypes.VERIFICATION_CONTACT_BLOCKED,
+                        error = result.error,
+                        errorMessage = result.errorDescription,
+                        correlationId = result.correlationId,
+                        errorCodes = result.errorCodes
+                    )
+                }
                 is JITCommandResult.VerificationRequired -> {
                     RegisterStrongAuthChallengeResult.VerificationRequired(
                         result = NativeAuthRegisterStrongAuthVerificationRequiredResultParameter(
                             nextState = RegisterStrongAuthVerificationRequiredState(
                                 continuationToken = result.continuationToken,
                                 correlationId = result.correlationId,
+                                username = username,
                                 config = config
                             ),
                             codeLength = result.codeLength,
@@ -134,13 +152,18 @@ abstract class BaseJITSubmitChallengeState(
             }
         }
     }
+
+    private fun isChallengeChannelSMS(challengeChannel: String): Boolean {
+        return challengeChannel.equals(NativeAuthConstants.ChallengeChannel.SMS, ignoreCase = true)
+    }
 }
 
 class RegisterStrongAuthState(
     override val continuationToken: String,
     override val correlationId: String,
+    override val username: String,
     private val config: NativeAuthPublicClientApplicationConfiguration
-) : BaseJITSubmitChallengeState(continuationToken = continuationToken, correlationId = correlationId, config = config), State, Parcelable {
+) : BaseJITSubmitChallengeState(continuationToken = continuationToken, correlationId = correlationId, config = config, username = username), State, Parcelable {
     private val TAG: String = RegisterStrongAuthState::class.java.simpleName
 
     /**
@@ -193,6 +216,7 @@ class RegisterStrongAuthState(
 
     constructor(parcel: Parcel) : this(
         continuationToken = parcel.readString() ?: "",
+        username =  parcel.readString() ?: "",
         correlationId = parcel.readString() ?: "UNSET",
         config = parcel.serializable<NativeAuthPublicClientApplicationConfiguration>() as NativeAuthPublicClientApplicationConfiguration
     )
@@ -221,8 +245,9 @@ class RegisterStrongAuthState(
 class RegisterStrongAuthVerificationRequiredState(
     override val continuationToken: String,
     override val correlationId: String,
+    override val username: String,
     private val config: NativeAuthPublicClientApplicationConfiguration
-) : BaseJITSubmitChallengeState(continuationToken = continuationToken, correlationId = correlationId, config = config) {
+) : BaseJITSubmitChallengeState(continuationToken = continuationToken, correlationId = correlationId, username = username, config = config) {
 
     private val TAG: String = RegisterStrongAuthVerificationRequiredState::class.java.simpleName
 
@@ -402,6 +427,7 @@ class RegisterStrongAuthVerificationRequiredState(
 
     constructor(parcel: Parcel) : this(
         continuationToken = parcel.readString() ?: "",
+        username =  parcel.readString() ?: "",
         correlationId = parcel.readString() ?: "UNSET",
         config = parcel.serializable<NativeAuthPublicClientApplicationConfiguration>() as NativeAuthPublicClientApplicationConfiguration
     )

msal/src/main/java/com/microsoft/identity/nativeauth/statemachine/states/SignInStates.kt

@@ -76,6 +76,7 @@ import kotlinx.coroutines.withContext
 class SignInCodeRequiredState internal constructor(
     override val continuationToken: String,
     override val correlationId: String,
+    private val username: String,
     private val scopes: List<String>?,
     private val claimsRequestJson: String?,
     private val config: NativeAuthPublicClientApplicationConfiguration
@@ -84,6 +85,7 @@ class SignInCodeRequiredState internal constructor(
 
     constructor(parcel: Parcel) : this(
         continuationToken = parcel.readString()  ?: "",
+        username = parcel.readString() ?: "",
         correlationId = parcel.readString() ?: "UNSET",
         scopes = parcel.createStringArrayList(),
         claimsRequestJson = parcel.readString(),
@@ -201,6 +203,28 @@ class SignInCodeRequiredState internal constructor(
                             exception = result.exception
                         )
                     }
+                    is SignInCommandResult.MFARequired -> {
+                        SignInResult.MFARequired(
+                            nextState = AwaitingMFAState(
+                                continuationToken = result.continuationToken,
+                                correlationId = result.correlationId,
+                                scopes = scopes,
+                                config = config
+                            ),
+                            authMethods = result.authMethods.toListOfAuthMethods()
+                        )
+                    }
+                    is SignInCommandResult.StrongAuthMethodRegistrationRequired -> {
+                        SignInResult.StrongAuthMethodRegistrationRequired(
+                            nextState = RegisterStrongAuthState(
+                                continuationToken = result.continuationToken,
+                                correlationId = result.correlationId,
+                                username = username,
+                                config = config
+                            ),
+                            authMethods = result.authMethods.toListOfAuthMethods()
+                        )
+                    }
                 }
             } catch (e: Exception) {
                 SubmitCodeError(
@@ -277,6 +301,7 @@ class SignInCodeRequiredState internal constructor(
                             nextState = SignInCodeRequiredState(
                                 continuationToken = result.continuationToken,
                                 correlationId = result.correlationId,
+                                username = username,
                                 scopes = scopes,
                                 config = config,
                                 claimsRequestJson = claimsRequestJson
@@ -358,13 +383,15 @@ class SignInCodeRequiredState internal constructor(
 class SignInPasswordRequiredState(
     override val continuationToken: String,
     override val correlationId: String,
+    private val username: String,
     private val scopes: List<String>?,
     private val claimsRequestJson: String?,
     private val config: NativeAuthPublicClientApplicationConfiguration
 ) : BaseState(continuationToken = continuationToken, correlationId = correlationId), State, Parcelable {
     private val TAG: String = SignInPasswordRequiredState::class.java.simpleName
     constructor(parcel: Parcel) : this(
         continuationToken = parcel.readString()  ?: "",
+        username = parcel.readString() ?: "",
         correlationId = parcel.readString() ?: "UNSET",
         scopes = parcel.createStringArrayList(),
         claimsRequestJson = parcel.readString(),
@@ -461,6 +488,7 @@ class SignInPasswordRequiredState(
                                 nextState = RegisterStrongAuthState(
                                     continuationToken = result.continuationToken,
                                     correlationId = result.correlationId,
+                                    username = username,
                                     config = config
                                 ),
                                 authMethods = result.authMethods.toListOfAuthMethods()
@@ -715,6 +743,18 @@ class SignInContinuationState(
                             nextState = RegisterStrongAuthState(
                                 continuationToken = result.continuationToken,
                                 correlationId = result.correlationId,
+                                username = username,
+                                config = config
+                            ),
+                            authMethods = result.authMethods.toListOfAuthMethods()
+                        )
+                    }
+                    is SignInCommandResult.MFARequired -> {
+                        SignInResult.MFARequired(
+                            nextState = AwaitingMFAState(
+                                continuationToken = result.continuationToken,
+                                correlationId = result.correlationId,
+                                scopes = parameters.scopes,
                                 config = config
                             ),
                             authMethods = result.authMethods.toListOfAuthMethods()