CODEWITHSUNDEEP
androidsingle-sign-onadal
prasad nikumbh
prasad nikumbh

Reputation: 175

sso in android using microsoft azure sdk -ADAL

The code works properly from dev portal of microsoft. But can anyone please tell me how it should behave in following use case

Consider two apps: App1 and App2

I have developed same code and installed both apps simultaneously

App1 as launched first will ask me credentials for the webview. Thats fine. as I have not cache or already logged in till date.

Once I log in successfully, The apps works properly as auto login

Now when I open App2, it still throws me Login page. Ideally it should take cache of App1 and auto login.

Please note: I have provided same 'shared id' in both apps in manifest

Please let me know about thus as i am stuck with internal Single Sign on issue since long

Upvotes: 1

Views: 1400

Answers (1)

Daniel Dobalian
Daniel Dobalian

Reputation: 3237

I see you have tagged the question with ADAL, so I'll assume that's the library you're using. ADAL uses webviews to prompt for sign in. Webviews in Android do not share much state between apps, and are pretty much completely sandboxes (isolated and do not share session cookies, etc).

Now, you most definitely can achieve SSO for Android using ADAL, you have 2 options:

Brokered SSO

Using a broker application, like the Microsoft Authenticator, the end user basically signs in here such that they're able to maintain a session inside the Broker's sandbox. This allows any app that signs in Azure AD users to share state. The article linked above explains how to enable your app to use the broker.

Non-Brokered SSO

You can configure SSO between all of the apps you own. This means an end user will get SSO between App 1, App 2, App N, but not necessarily another App in the Azure AD ecosystem. The article linked above explains how to enable your app to use non-brokered SSO.

Bonus Option: v2 with MSAL

I said earlier ADAL uses webviews for sign in, there's another way to do it that the Microsoft Authentication Library (MSAL) supports using the system's browser. Quite simply, this uses the Chrome or a Chrome custom tab browser on the device rather than the in-app webview. Then, the session cookie is set on the global browser so any app that also uses the browser (or if the end user has used the browser natively to sign in) will get SSO. The stipulation here is MSAL works against the Azure AD v2.0 endpoint which has some limitations, but also supports some sign in with Microsoft Accounts (*.outlook, *.live, etc) out of the box.

If you're interested in trying v2 + MSAL, I recommend trying the Android Guided Walkthrough which walks you through how to build an app that calls the Microsoft Graph.

Upvotes: 1

Related Questions