update new var in configuration to allow user by pass URI check (#1013)

* update new var in configuration to allow user by pass URI check
AzureAD · Jul 25, 2020 · a3098a8 · a3098a8
1 parent 3b3d623
commit a3098a8
Show file tree

Hide file tree

Showing 8 changed files with 66 additions and 10 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,6 @@
+## [TBD] - TBD
+* update new variable in configuration to allow user by pass URI check #1013
+
 ## [1.1.5] - 2020-06-19
 
 ### Added

diff --git a/MSAL/src/MSALPublicClientApplication.m b/MSAL/src/MSALPublicClientApplication.m
@@ -204,6 +204,7 @@ - (instancetype)initWithConfiguration:(MSALPublicClientApplicationConfig *)confi
     NSError *msidError = nil;
     MSALRedirectUri *msalRedirectUri = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:config.redirectUri
                                                                                     clientId:config.clientId
+                                                                    bypassRedirectValidation:config.bypassRedirectURIValidation
                                                                                        error:&msidError];
 
     if (!msalRedirectUri)

diff --git a/MSAL/src/public/configuration/MSALPublicClientApplicationConfig.h b/MSAL/src/public/configuration/MSALPublicClientApplicationConfig.h
@@ -95,6 +95,12 @@ to target MSAL at a specific test slice & flight. These apply to all requests ma
  */
 - (nonnull instancetype)initWithClientId:(NSString *)clientId;
 
+/**
+ For client that wants to bypass redirectURI check in MSAL, set this to YES. NO by default.
+ If set to YES, MSAL will skip the verification of redirectURI. Brokered authentication will be disabled in this case.
+ */
+@property BOOL bypassRedirectURIValidation;
+
 /**
  Initialize a MSALPublicClientApplicationConfig with a given clientId
  

diff --git a/MSAL/src/util/MSALRedirectUriVerifier.h b/MSAL/src/util/MSALRedirectUriVerifier.h
@@ -33,6 +33,7 @@
 
 + (MSALRedirectUri *)msalRedirectUriWithCustomUri:(NSString *)customRedirectUri
                                          clientId:(NSString *)clientId
+                         bypassRedirectValidation:(BOOL)bypassRedirectValidation
                                             error:(NSError * __autoreleasing *)error;
 
 + (BOOL)verifyAdditionalRequiredSchemesAreRegistered:(NSError **)error;

diff --git a/MSAL/src/util/ios/MSALRedirectUriVerifier.m b/MSAL/src/util/ios/MSALRedirectUriVerifier.m
@@ -34,6 +34,7 @@ @implementation MSALRedirectUriVerifier
 
 + (MSALRedirectUri *)msalRedirectUriWithCustomUri:(NSString *)customRedirectUri
                                          clientId:(NSString *)clientId
+                         bypassRedirectValidation:(BOOL)bypassRedirectValidation
                                             error:(NSError * __autoreleasing *)error
 {
 #if AD_BROKER
@@ -50,13 +51,13 @@ + (MSALRedirectUri *)msalRedirectUriWithCustomUri:(NSString *)customRedirectUri
     if (![NSString msidIsStringNilOrBlank:customRedirectUri])
     {
         NSURL *redirectURI = [NSURL URLWithString:customRedirectUri];
-
-        if (![self verifySchemeIsRegistered:redirectURI error:error])
+        
+        if (!bypassRedirectValidation && ![self verifySchemeIsRegistered:redirectURI error:error])
         {
             return nil;
         }
 
-        BOOL brokerCapable = [MSALRedirectUri redirectUriIsBrokerCapable:redirectURI];
+        BOOL brokerCapable = !bypassRedirectValidation && [MSALRedirectUri redirectUriIsBrokerCapable:redirectURI];
 
         MSALRedirectUri *redirectUri = [[MSALRedirectUri alloc] initWithRedirectUri:redirectURI
                                                                       brokerCapable:brokerCapable];

diff --git a/MSAL/src/util/mac/MSALRedirectUriVerifier.m b/MSAL/src/util/mac/MSALRedirectUriVerifier.m
@@ -32,6 +32,7 @@ @implementation MSALRedirectUriVerifier
 
 + (MSALRedirectUri *)msalRedirectUriWithCustomUri:(NSString *)customRedirectUri
                                          clientId:(__unused NSString *)clientId
+                         bypassRedirectValidation:(BOOL)bypassRedirectValidation
                                             error:(__unused NSError * __autoreleasing *)error
 {
     if (![NSString msidIsStringNilOrBlank:customRedirectUri])

diff --git a/MSAL/test/unit/MSALPublicClientApplicationTests.m b/MSAL/test/unit/MSALPublicClientApplicationTests.m
@@ -3112,6 +3112,29 @@ - (void)testSignoutWithAccount_whenNonNilAccount_andSignoutFromBrowserTrue_andBr
     [self waitForExpectations:@[expectation] timeout:1];
 }
 
+- (void)testInitWithConfiguration_WhenBypassRedirectURIIsDefault_ShouldBlockInvalidURI
+{
+    MSALPublicClientApplicationConfig *pcaConfig = [[MSALPublicClientApplicationConfig alloc] initWithClientId:@"test_client_id"
+                                                                                                   redirectUri:@"invalid_uri"
+                                                                                                     authority:nil];
+    NSError *error;
+    MSALPublicClientApplication *application = [[MSALPublicClientApplication alloc] initWithConfiguration:pcaConfig error:&error];
+    XCTAssertTrue(error);
+    XCTAssertNil(application);
+}
+
+- (void)testInitWithConfiguration_WhenBypassRedirectURIIsDYes_ShouldAllowInvalidURI
+{
+    MSALPublicClientApplicationConfig *pcaConfig = [[MSALPublicClientApplicationConfig alloc] initWithClientId:@"test_client_id"
+                                                                                                   redirectUri:@"invalid_uri"
+                                                                                                     authority:nil];
+    pcaConfig.bypassRedirectURIValidation = YES;
+    NSError *error;
+    MSALPublicClientApplication *application = [[MSALPublicClientApplication alloc] initWithConfiguration:pcaConfig error:&error];
+    XCTAssertTrue(application);
+    XCTAssertNil(error);
+}
+
 #endif
 
 #pragma mark - Helpers

diff --git a/MSAL/test/unit/ios/MSALRedirectUriVerifierTests.m b/MSAL/test/unit/ios/MSALRedirectUriVerifierTests.m
@@ -47,7 +47,10 @@ - (void)testMSALRedirectUri_whenCustomRedirectUri_andNotBrokerCapable_shouldRetu
     NSString *clientId = @"msalclient";
 
     NSError *error = nil;
-    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri clientId:clientId error:&error];
+    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri
+                                                                           clientId:clientId
+                                                           bypassRedirectValidation:NO
+                                                                              error:&error];
 
     XCTAssertNotNil(result);
     XCTAssertEqualObjects(result.url.absoluteString, redirectUri);
@@ -65,7 +68,10 @@ - (void)testMSALRedirectUri_whenCustomRedirectUri_andBrokerCapable_shouldReturnU
     NSString *clientId = @"msalclient";
 
     NSError *error = nil;
-    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri clientId:clientId error:&error];
+    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri
+                                                                           clientId:clientId
+                                                           bypassRedirectValidation:NO
+                                                                              error:&error];
 
     XCTAssertNotNil(result);
     XCTAssertEqualObjects(result.url.absoluteString, redirectUri);
@@ -83,7 +89,10 @@ - (void)testMSALRedirectUri_whenCustomRedirectUri_andLegacyBrokerCapable_shouldR
     NSString *clientId = @"msalclient";
 
     NSError *error = nil;
-    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri clientId:clientId error:&error];
+    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri
+                                                                           clientId:clientId
+                                                           bypassRedirectValidation:NO
+                                                                              error:&error];
 
     XCTAssertNotNil(result);
     XCTAssertEqualObjects(result.url.absoluteString, redirectUri);
@@ -101,7 +110,10 @@ - (void)testMSALRedirectUri_whenCustomRedirectUri_andNotRegistered_shouldReturnN
     NSString *clientId = @"msalclient";
 
     NSError *error = nil;
-    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri clientId:clientId error:&error];
+    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:redirectUri
+                                                                           clientId:clientId
+                                                           bypassRedirectValidation:NO
+                                                                              error:&error];
 
     XCTAssertNil(result);
     XCTAssertNotNil(error);
@@ -117,7 +129,10 @@ - (void)testMSALRedirectUri_whenDefaultRedirectUri_andBrokerCapableUrlRegistered
     NSString *clientId = @"msalclient";
 
     NSError *error = nil;
-    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:nil clientId:clientId error:&error];
+    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:nil
+                                                                           clientId:clientId
+                                                           bypassRedirectValidation:NO
+                                                                              error:&error];
 
     XCTAssertNotNil(result);
     XCTAssertEqualObjects(result.url.absoluteString, @"msauth.test.bundle.identifier://auth");
@@ -134,7 +149,9 @@ - (void)testMSALRedirectUri_whenDefaultRedirectUri_andDefaultUrlRegistered_shoul
     NSString *clientId = @"msalclient";
 
     NSError *error = nil;
-    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:nil clientId:clientId error:&error];
+    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:nil
+                                                                           clientId:clientId
+                                                           bypassRedirectValidation:NO error:&error];
 
     XCTAssertNotNil(result);
     XCTAssertEqualObjects(result.url.absoluteString, @"msalmsalclient://auth");
@@ -150,7 +167,10 @@ - (void)testMSALRedirectUri_whenNoRedirectUriRegistered_shouldReturnNilAndFillEr
     NSString *clientId = @"msalclient";
     NSError *error = nil;
 
-    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:nil clientId:clientId error:&error];
+    MSALRedirectUri *result = [MSALRedirectUriVerifier msalRedirectUriWithCustomUri:nil
+                                                                           clientId:clientId
+                                                           bypassRedirectValidation:NO
+                                                                              error:&error];
 
     XCTAssertNil(result);
     XCTAssertNotNil(error);