1768724 - Add support for Microsoft SSO on macOS

Status: RESOLVED FIXED

(Core :: Networking, enhancement, P2)

Description

[Mike Kaply [:mkaply]]

Attachment: Same Code Snippet

We added Microsoft SSO support on Windows and we'd like to do the same for macOS.

On macOS, it would only work on a corporate device.

There is sample code here:

https://github.com/AzureAD/microsoft-authentication-library-common-for-objc/blob/master/IdentityCore/src/requests/broker/MSIDSSOExtensionGetSsoCookiesRequest.m

and here:

https://github.com/AzureAD/microsoft-authentication-library-common-for-objc/blob/master/IdentityCore/src/requests/broker/MSIDSSOExtensionGetDataBaseRequest.m

I'll also attach sample responses and code

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Sample JSON response

Comment 2

[Dragana Damjanovic [:dragana]]

Mike, can you help us prioritize this bug?

Comment 3

[Greg Hess]

Mike please let us know if you have any input on prioritization. Tentatively, we have flagged this enhancement for 2022-H2 roadmap planning.

Comment 4

[Mike Kaply [:mkaply]]

Mike please let us know if you have any input on prioritization. Tentatively, we have flagged this enhancement for 2022-H2 roadmap plannin

I don't have any input. Microsoft requested this and we had already done on Windows, so it's a "nice to have"

What you've set sounds good.

Comment 5

[Mike Kaply [:mkaply]]

Microsoft reached out to us to see if we could prioritize this.

They have customers requesting it.

Comment 6

[Kershaw Chang [:kershaw]]

We should do the similar as we did for windows here.

Comment 8

[Sean Kim]

Attachment: Bug 1768724 - Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=mkaply

Comment 9

[Sean Kim]

Taking on this bug a few hours ago, I have a few questions regarding it.

1. How should the bug be tested? (I am mainly referring to the past patch for Microsoft SSO on Windows: https://phabricator.services.mozilla.com/D114540)

2. In the attached code, queryItems is used for authorizationOptions. What are the specific options being passed here?

3. How would the implementation vary compared to the SSO support in Windows? Any considerations?

4. Are there any interfaces like IProofOfPossessionCookieInfoManager for MacOS?

Comment 10

[Mike Kaply [:mkaply]]

The Company Portal app stores Microsoft credentials:

https://learn.microsoft.com/en-us/mem/intune/apps/apps-company-portal-macos

The API documentation is here:

https://developer.apple.com/documentation/authenticationservices/asauthorizationsinglesignonrequest

on macOS, we would be using headers only so we should need the cookie stuff.

I'll reach out to Microsoft and ask them to jump in.

Comment 11

[Sean Kim]

Attachment: Bug 1768724 - Part 2: Add MS SSO Authority List and Initialize MicrosoftEntraSSOUtils r=#necko

Comment 12

[Sean Kim]

Attachment: Bug 1768724 - Part 3: Add support for Microsoft SSO on macOS (Necko Part) r=#necko

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/277fe041eda5
Part 2: Add MS SSO Authority List and Initialize MicrosoftEntraSSOUtils r=necko-reviewers,kershaw

Comment 14

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/277fe041eda5

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0f7a7bba955f
Part 3: Add support for Microsoft SSO on macOS (Necko Part) r=necko-reviewers,kershaw

Comment 16

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/0f7a7bba955f

Comment 17

[Sean Kim]

Attachment: Bug 1768724 - Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part)

Original Revision: https://phabricator.services.mozilla.com/D212445

Comment 18

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: This would postpone Microsoft SSO on macOS
• Code covered by automated testing: no
• Fix verified in Nightly: no
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A, we just introduced a policy for other patches in https://bugzilla.mozilla.org/show_bug.cgi?id=1768724
• Risk associated with taking this patch: Minimal
• Explanation of risk level: This patch introduces a policy for existing patches already in beta (https://bugzilla.mozilla.org/show_bug.cgi?id=1768724)
• String changes made/needed: N/A
• Is Android affected?: no

Comment 19

[Mike Kaply [:mkaply]]

So actually, this does have a string change, but on the ESR at least, we've allowed English policy strings. Hoping that can be allowed here.

Comment 20

[Dianna Smith [:diannaS]]

Hi Mike! It's a little late in the cycle for a string change unfortunately. NIing flod though just in case

Comment 21

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: This would postpone Microsoft SSO on macOS
• Code covered by automated testing: no
• Fix verified in Nightly: no
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A, we just introduced a policy for other patches in https://bugzilla.mozilla.org/show_bug.cgi?id=1768724
• Risk associated with taking this patch: Minimal
• Explanation of risk level: This patch introduces a policy for existing patches already in beta (https://bugzilla.mozilla.org/show_bug.cgi?id=1768724)
• String changes made/needed: English policy strings
• Is Android affected?: no

Comment 22

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b5f67647ff55
Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=fluent-reviewers,mkaply,mossop,bolsson

Comment 23

[Sandor Molnar[:smolnar]]

Backed out for causing xpc failures @ test_sorted_alphabetically.js

Backout link: https://hg.mozilla.org/integration/autoland/rev/e449dddd6538c4b7979d8c1336a4c85ff76d71fa

Push with failures

Failure log -> TEST-UNEXPECTED-FAIL | browser/components/enterprisepolicies/tests/xpcshell/test_sorted_alphabetically.js | test_policies_sorted - [test_policies_sorted : 18] Policies.sys.mjs is alphabetically sorted. - false == true

Comment 24

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c23036c1ed6f
Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=fluent-reviewers,mkaply,mossop,bolsson

Comment 25

[Francesco Lodolo [:flod]]

I'm confused. This patch has been around for a while, what is the urgency? While the string is not highly visible, it will still trigger a warning in console when you open about:policies, so the timing is not great (3 days from freeze for beta and this hasn't landed in mozilla-central yet, no locale will have it).

I would also point out that a completely different version of the string was reviewed and approved

policy-macOSSSO = Allow macOS single sign-on for Microsoft, work, and school accounts.

Now I see this, which would probably benefit from a comment about Entra.

policy-MicrosoftEntraSSO = Allow single sign-on for Microsoft Entra accounts.

P.S. :bolsson is the right person to reach out to for uplift requests, he's the one doing most of Firefox l10n these days

Comment 26

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/c23036c1ed6f

Comment 27

[Mike Kaply [:mkaply]]

flod, you're right, we'll let it ride the trains. And I'll get a comment on that string.

Comment 28

[Ryan VanderMeulen [:RyanVM]]

Did you want to nominate this for the Fx132 relnotes? Please set the relnote-firefox flag to ? and fill out the auto-populated form if so. Though I'm a bit confused by the status of this bug. It looks like the majority of the work landed in Fx131 with just the enterprise policy pref patch landing in Fx132? So does this need to go into the Fx131 relnotes actually?

Comment 29

[Mike Kaply [:mkaply]]

I think I'm just going to cover it in the enterprise release notes.

Comment 30

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Update translation comment. r?flod

Comment 31

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/75aad5e2c99c
Update translation comment. r=flod,fluent-reviewers DONTBUILD

Comment 32

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/75aad5e2c99c

Comment 33

[BugBot [:suhaib / :marco/ :calixte]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)

Comment 34

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=mkaply

Original Revision: https://phabricator.services.mozilla.com/D212445

Comment 35

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=mkaply

Original Revision: https://phabricator.services.mozilla.com/D212445

Comment 36

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: Wanted for feature parity with release
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: Low
• Explanation of risk level: Patch only applies to Msft SSO case
• String changes made/needed: Policy description
• Is Android affected?: no

Comment 37

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=mkaply

Original Revision: https://phabricator.services.mozilla.com/D212445

Comment 38

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 2: Add MS SSO Authority List and Initialize MicrosoftEntraSSOUtils r=#necko

Original Revision: https://phabricator.services.mozilla.com/D216560

Comment 39

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=mkaply

Original Revision: https://phabricator.services.mozilla.com/D212445

Comment 40

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 3: Add support for Microsoft SSO on macOS (Necko Part) r=#necko

Original Revision: https://phabricator.services.mozilla.com/D218355

Comment 41

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 2: Add MS SSO Authority List and Initialize MicrosoftEntraSSOUtils r=#necko

Original Revision: https://phabricator.services.mozilla.com/D216560

Comment 42

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 3: Add support for Microsoft SSO on macOS (Necko Part) r=#necko

Original Revision: https://phabricator.services.mozilla.com/D218355

Comment 43

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 1: Add a preference and policy for Microsoft SSO on macOS (Non-Necko Part) r=mkaply

Original Revision: https://phabricator.services.mozilla.com/D212445

Comment 44

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 2: Add MS SSO Authority List and Initialize MicrosoftEntraSSOUtils r=#necko

Original Revision: https://phabricator.services.mozilla.com/D216560

Comment 45

[Mike Kaply [:mkaply]]

Attachment: Bug 1768724 - Part 3: Add support for Microsoft SSO on macOS (Necko Part) r=#necko

Original Revision: https://phabricator.services.mozilla.com/D218355

Comment 46

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/d7043128e755
https://hg.mozilla.org/releases/mozilla-esr128/rev/529cd650003d
https://hg.mozilla.org/releases/mozilla-esr128/rev/24340b0b0af9

Comment 47

[Francesco Lodolo [:flod]]

When we uplift patches with string changes, we should also pick up updates to localization, similarly to what was done in
https://hg.mozilla.org/releases/mozilla-esr128/rev/4298182958afcf96c6ba2f16aa46db003e041f84

Could someone land a patch for that? There's no real need of review from l10n (in case, flag :bolsson).

Comment 48

[Ryan VanderMeulen [:RyanVM]]

Sorry, I thought I remembered enterprise policies being less strict around that. I'll get it, thanks for the ping.

Comment 49

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/213534997a7c