MSALPublicClientApplication
Objective-C
@interface MSALPublicClientApplication : NSObject
Swift
class MSALPublicClientApplication : NSObject
Representation of OAuth 2.0 Public client application. Create an instance of this class to acquire tokens. One instance of MSALPublicClientApplication can be used to interact with multiple AAD clouds, and tenants, without needing to create a new instance for each authority. For most apps, one MSALPublicClientApplication instance is sufficient.
To create an instance of the MSALPublicClientApplication, first create an instance MSALPublicClientApplicationConfig
.
Setup MSALPublicClientApplicationConfig
with needed configuration, and pass it to the [MSALPublicClientApplication initWithConfiguration:error:]
initializer.
For example:
NSError *msalError = nil; MSALPublicClientApplicationConfig *config = [[MSALPublicClientApplicationConfig alloc] initWithClientId:@"your-client-id-here"]; MSALPublicClientApplication *application = [[MSALPublicClientApplication alloc] initWithConfiguration:config error:&msalError];
-
A copy of the configuration which was provided in the initializer. Any changes to mutable properties on the configuration object will not affect the behavior of the Public Cilent Application. Parameter to be used to configure MSALPublicClientApplication. It contains all values to be used in the instance and is a superset of all properties known to this class.
Declaration
Objective-C
@property (readonly, nonnull) MSALPublicClientApplicationConfig *configuration;
Swift
var configuration: MSALPublicClientApplicationConfig { get }
-
Deprecated
Use knowAuthorities in MSALPublicClientApplicationConfig instead (create your config and pass it to -initWithConfiguration:error:)
When set to YES (default), MSAL will compare the application’s authority against well-known URLs templates representing well-formed authorities. It is useful when the authority is obtained at run time to prevent MSAL from displaying authentication prompts from malicious pages.
Declaration
Objective-C
@property BOOL validateAuthority;
Swift
var validateAuthority: Bool { get set }
-
Deprecated
Use webviewParameters to configure web view type in MSALInteractiveTokenParameters instead (create parameters object and pass it to -acquireTokenWithParameters:completionBlock:)
The webview type to be used for authorization.
Declaration
Objective-C
@property MSALWebviewType webviewType;
Swift
var webviewType: MSALWebviewType { get set }
-
Deprecated
Use webviewParameters to configure custom web view in MSALInteractiveTokenParameters instead (create parameters object and pass it to -acquireTokenWithParameters:completionBlock:)
Passed in webview to display web content when webviewSelection is set to MSALWebviewTypeWKWebView. For iOS, this will be ignored if MSALWebviewTypeSystemDefault is chosen.
Declaration
Objective-C
@property (nullable) WKWebView *customWebview;
Swift
var customWebview: WKWebView? { get set }
-
Initialize a MSALPublicClientApplication with a given configuration
Note
It is important to configure your MSALPublicClientApplicationConfig object before calling MSALPublicClientApplication’s initializer. MSALPublicClientApplication makes a copy of the configuration object you provide on initialization. Once configured, MSALPublicClientApplication object ignores any changes you make to the MSALPublicClientApplicationConfig object.
Declaration
Objective-C
- (nullable instancetype) initWithConfiguration:(nonnull MSALPublicClientApplicationConfig *)config error:(NSError *_Nullable *_Nullable)error;
Swift
init(configuration config: MSALPublicClientApplicationConfig) throws
Parameters
config
Configuration for PublicClientApplication
error
The error that occurred creating the application object, if any (optional)
-
Initialize a MSALPublicClientApplication with a given clientID
Declaration
Objective-C
- (nullable instancetype)initWithClientId:(nonnull NSString *)clientId error:(NSError *_Nullable *_Nullable)error;
Swift
init(clientId: String) throws
Parameters
clientId
The clientID of your application, you should get this from the app portal.
error
The error that occurred creating the application object, if any (optional)
-
Deprecated
Use -initWithConfiguration:error: instead
Initialize a MSALPublicClientApplication with a given clientID and authority
Declaration
Objective-C
- (nullable instancetype)initWithClientId:(nonnull NSString *)clientId authority:(nullable MSALAuthority *)authority error:(NSError *_Nullable *_Nullable)error;
Swift
init(clientId: String, authority: MSALAuthority?) throws
Parameters
clientId
The clientID of your application, you should get this from the app portal.
authority
Authority indicating a directory that MSAL can use to obtain tokens. In Azure AD it is of the form https://authority_instance/authority_tenant, where authority_instance is the directory host (e.g. https://login.microsoftonline.com) and authority_tenant is a identifier within the directory itself (e.g. a domain associated to the tenant, such as contoso.onmicrosoft.com, or the GUID representing the TenantID property of the directory)
error
The error that occurred creating the application object, if any, if you’re not interested in the specific error pass in nil.
-
Deprecated
Use -initWithConfiguration:error: instead
Initialize a MSALPublicClientApplication with a given clientID, authority and redirectUri
Declaration
Objective-C
- (nullable instancetype)initWithClientId:(nonnull NSString *)clientId authority:(nullable MSALAuthority *)authority redirectUri:(nullable NSString *)redirectUri error:(NSError *_Nullable *_Nullable)error;
Swift
init(clientId: String, authority: MSALAuthority?, redirectUri: String?) throws
Parameters
clientId
The clientID of your application, you should get this from the app portal.
authority
Authority indicating a directory that MSAL can use to obtain tokens. In Azure AD it is of the form https://authority_instance/authority_tenant, where authority_instance is the directory host (e.g. https://login.microsoftonline.com) and authority_tenant is a identifier within the directory itself (e.g. a domain associated to the tenant, such as contoso.onmicrosoft.com, or the GUID representing the TenantID property of the directory)
redirectUri
The redirect URI of the application
error
The error that occurred creating the application object, if any, if you’re not interested in the specific error pass in nil.
-
Deprecated
Use -initWithConfiguration:error: instead
Initialize a MSALPublicClientApplication with a given clientID, authority, keychain group and redirect uri
Declaration
Objective-C
- (nullable instancetype)initWithClientId:(nonnull NSString *)clientId keychainGroup:(nullable NSString *)keychainGroup authority:(nullable MSALAuthority *)authority redirectUri:(nullable NSString *)redirectUri error:(NSError *_Nullable *_Nullable)error;
Swift
init(clientId: String, keychainGroup: String?, authority: MSALAuthority?, redirectUri: String?) throws
Parameters
clientId
The clientID of your application, you should get this from the app portal.
keychainGroup
The keychain sharing group to use for the token cache. (optional) If you provide this key, you MUST add the capability to your Application Entilement.
authority
Authority indicating a directory that MSAL can use to obtain tokens. In Azure AD it is of the form https://
, where is the directory host (e.g. https://login.microsoftonline.com) and is a identifier within the directory itself (e.g. a domain associated to the tenant, such as contoso.onmicrosoft.com, or the GUID representing the TenantID property of the directory) redirectUri
The redirect URI of the application
error
The error that occurred creating the application object, if any, if you’re not interested in the specific error pass in nil.
-
Returns an array of all accounts visible to this application.
Declaration
Objective-C
- (nullable NSArray<MSALAccount *> *)allAccounts: (NSError *_Nullable *_Nullable)error;
Swift
func allAccounts() throws -> [MSALAccount]
Parameters
error
The error that occured trying to retrieve accounts, if any, if you’re not interested in the specific error pass in nil.
-
Deprecated
Use -accountForIdentifier:error: instead
Returns account for the given home identifier (received from an account object returned in a previous acquireToken call)
Declaration
Objective-C
- (nullable MSALAccount *) accountForHomeAccountId:(nonnull NSString *)homeAccountId error:(NSError *_Nullable *_Nullable)error;
Swift
func account(forHomeAccountId homeAccountId: String) throws -> MSALAccount
Parameters
error
The error that occured trying to get the accounts, if any, if you’re not interested in the specific error pass in nil.
-
Returns account for the given account identifier (received from an account object returned in a previous acquireToken call)
Declaration
Objective-C
- (nullable MSALAccount *)accountForIdentifier:(nonnull NSString *)identifier error:(NSError *_Nullable *_Nullable) error;
Swift
func account(forIdentifier identifier: String) throws -> MSALAccount
Parameters
error
The error that occured trying to get the accounts, if any, if you’re not interested in the specific error pass in nil.
-
Returns account for the given account identifying parameters (received from an account object returned in a previous acquireToken call)
Declaration
Objective-C
- (nullable NSArray<MSALAccount *> *) accountsForParameters:(nonnull MSALAccountEnumerationParameters *)parameters error:(NSError *_Nullable *_Nullable)error;
Swift
func accounts(for parameters: MSALAccountEnumerationParameters) throws -> [MSALAccount]
Parameters
error
The error that occured trying to get the accounts, if any, if you’re not interested in the specific error pass in nil.
-
Returns account for for the given username (received from an account object returned in a previous acquireToken call or ADAL)
Declaration
Objective-C
- (nullable MSALAccount *)accountForUsername:(nonnull NSString *)username error: (NSError *_Nullable *_Nullable)error;
Swift
func account(forUsername username: String) throws -> MSALAccount
Parameters
username
The displayable value in UserPrincipleName(UPN) format
error
The error that occured trying to get the accounts, if any, if you’re not interested in the specific error pass in nil.
-
Deprecated
Use other synchronous account retrieval API instead.
Returns an array of accounts visible to this application and filtered by authority.
Declaration
Objective-C
- (void)allAccountsFilteredByAuthority: (nonnull MSALAccountsCompletionBlock)completionBlock;
Swift
func allAccountsFilteredByAuthority() async throws -> [MSALAccount]
Parameters
completionBlock
The completion block that will be called when accounts are loaded, or MSAL encountered an error.
-
Returns account for the given account identifying parameters including locally cached accounts and accounts from the SSO extension Accounts from SSO extension are only available on iOS 13+ and macOS 10.15+. On earlier versions, this method will return same results as a local account query.
Declaration
Objective-C
- (void)accountsFromDeviceForParameters: (nonnull MSALAccountEnumerationParameters *)parameters completionBlock:(nonnull MSALAccountsCompletionBlock) completionBlock;
Swift
func accountsFromDevice(for parameters: MSALAccountEnumerationParameters) async throws -> [MSALAccount]
Parameters
completionBlock
The completion block that will be called when accounts are loaded, or MSAL encountered an error.
-
Deprecated
Use -handleMSALResponse:sourceApplication: method instead.
Ask MSAL to handle a URL response.
Declaration
Objective-C
+ (BOOL)handleMSALResponse:(nonnull NSURL *)response;
Swift
class func handleMSALResponse(_ response: URL) -> Bool
Parameters
response
URL response from your application delegate’s openURL handler into MSAL for web authentication sessions
Return Value
YES if URL is a response to a MSAL web authentication session and handled, NO otherwise.
-
Ask MSAL to handle a URL response.
Declaration
Objective-C
+ (BOOL)handleMSALResponse:(nonnull NSURL *)response sourceApplication:(nullable NSString *)sourceApplication;
Swift
class func handleMSALResponse(_ response: URL, sourceApplication: String?) -> Bool
Parameters
response
URL response from your application delegate’s openURL handler for MSAL web or brokered authentication sessions
sourceApplication
The application that opened your app with that URL. Can be retrieved from options by UIApplicationOpenURLOptionsSourceApplicationKey key. See more info here: https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1623112-application?language=objc
Return Value
YES if URL is a response to a MSAL web or brokered session and handled, NO otherwise.
-
Cancels any currently running interactive web authentication session, resulting in the authorization UI being dismissed and the acquireToken request ending in a cancelation error.
Declaration
Objective-C
+ (BOOL)cancelCurrentWebAuthSession;
Swift
class func cancelCurrentWebAuthSession() -> Bool
-
Acquire a token for a provided parameters using interactive authentication.
Declaration
Objective-C
- (void)acquireTokenWithParameters: (nonnull MSALInteractiveTokenParameters *)parameters completionBlock:(nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireToken(with parameters: MSALInteractiveTokenParameters) async throws -> MSALResult
Parameters
parameters
Parameters used for interactive authentication.
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Deprecated
Use -acquireTokenWithParameters:completionBlock instead
Acquire a token for a new account using interactive authentication
Declaration
Objective-C
- (void)acquireTokenForScopes:(nonnull NSArray<NSString *> *)scopes completionBlock:(nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireToken(forScopes scopes: [String]) async throws -> MSALResult
Parameters
scopes
Permissions you want included in the access token received in the result in the completionBlock. Not all scopes are guaranteed to be included in the access token returned.
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Deprecated
Use -acquireTokenWithParameters:completionBlock instead
Acquire a token for a new account using interactive authentication
Declaration
Objective-C
- (void)acquireTokenForScopes:(nonnull NSArray<NSString *> *)scopes loginHint:(nullable NSString *)loginHint completionBlock:(nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireToken(forScopes scopes: [String], loginHint: String?) async throws -> MSALResult
Parameters
scopes
Permissions you want included in the access token received in the result in the completionBlock. Not all scopes are guaranteed to be included in the access token returned.
loginHint
A loginHint (usually an email) to pass to the service at the beginning of the interactive authentication flow. The account returned in the completion block is not guaranteed to match the loginHint.
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Deprecated
Use -acquireTokenWithParameters:completionBlock instead
Acquire a token interactively for an existing account. This is typically used after receiving a MSALErrorInteractionRequired error.
Declaration
Objective-C
- (void)acquireTokenForScopes:(nonnull NSArray<NSString *> *)scopes account:(nullable MSALAccount *)account completionBlock:(nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireToken(forScopes scopes: [String], account: MSALAccount?) async throws -> MSALResult
Parameters
scopes
Permissions you want included in the access token received in the result in the completionBlock. Not all scopes are guaranteed to be included in the access token returned.
account
An account object retrieved from the application object that the interactive authentication flow will be locked down to.
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Deprecated
Use -acquireTokenWithParameters:completionBlock instead
Acquire a token interactively for an existing account. This is typically used after receiving a MSALErrorInteractionRequired error.
Declaration
Objective-C
- (void)acquireTokenForScopes:(nonnull NSArray<NSString *> *)scopes account:(nullable MSALAccount *)account promptType:(MSALPromptType)promptType extraQueryParameters:(nullable NSDictionary<NSString *, NSString *> *) extraQueryParameters completionBlock:(nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireToken(forScopes scopes: [String], account: MSALAccount?, promptType: MSALPromptType, extraQueryParameters: [String : String]?) async throws -> MSALResult
Parameters
scopes
Permissions you want included in the access token received in the result in the completionBlock. Not all scopes are guaranteed to be included in the access token returned.
account
An account object retrieved from the application object that the interactive authentication flow will be locked down to.
promptType
A prompt type for the interactive authentication flow
extraQueryParameters
Key-value pairs to pass to the authentication server during the interactive authentication flow. This should not be url-encoded value.
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Acquire a token silently for a provided parameters.
Declaration
Objective-C
- (void)acquireTokenSilentWithParameters: (nonnull MSALSilentTokenParameters *)parameters completionBlock: (nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireTokenSilent(with parameters: MSALSilentTokenParameters) async throws -> MSALResult
Parameters
parameters
Parameters used for silent authentication.
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Deprecated
Use -acquireTokenSilentWithParameters:completionBlock instead
Acquire a token silently for an existing account.
Declaration
Objective-C
- (void)acquireTokenSilentForScopes:(nonnull NSArray<NSString *> *)scopes account:(nonnull MSALAccount *)account completionBlock: (nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireTokenSilent(forScopes scopes: [String], account: MSALAccount) async throws -> MSALResult
Parameters
scopes
Permissions you want included in the access token received in the result in the completionBlock. Not all scopes are guaranteed to be included in the access token returned.
account
An account object retrieved from the application object that the interactive authentication flow will be locked down to.
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Deprecated
Use -acquireTokenSilentWithParameters:completionBlock instead
Acquire a token silently for an existing account.
Declaration
Objective-C
- (void)acquireTokenSilentForScopes:(nonnull NSArray<NSString *> *)scopes account:(nonnull MSALAccount *)account authority:(nullable MSALAuthority *)authority completionBlock: (nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireTokenSilent(forScopes scopes: [String], account: MSALAccount, authority: MSALAuthority?) async throws -> MSALResult
Parameters
scopes
Permissions you want included in the access token received in the result in the completionBlock. Not all scopes are guaranteed to be included in the access token returned.
account
An account object retrieved from the application object that the interactive authentication flow will be locked down to.
authority
Authority indicating a directory that MSAL can use to obtain tokens. Azure AD it is of the form https://authority_instance/authority_tenant, where authority_instance is the directory host (e.g. https://login.microsoftonline.com) and authority_tenant is a identifier within the directory itself (e.g. a domain associated to the tenant, such as contoso.onmicrosoft.com, or the GUID representing the TenantID property of the directory)
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
-acquireTokenSilentForScopes:
account: authority: claimsRequest: forceRefresh: correlationId: completionBlock: Deprecated
Use -acquireTokenSilentWithParameters:completionBlock instead
Acquire a token silently for an existing account.
Declaration
Objective-C
- (void)acquireTokenSilentForScopes:(nonnull NSArray<NSString *> *)scopes account:(nonnull MSALAccount *)account authority:(nullable MSALAuthority *)authority claimsRequest:(nullable MSALClaimsRequest *)claimsRequest forceRefresh:(BOOL)forceRefresh correlationId:(nullable NSUUID *)correlationId completionBlock: (nonnull MSALCompletionBlock)completionBlock;
Swift
func acquireTokenSilent(forScopes scopes: [String], account: MSALAccount, authority: MSALAuthority?, claimsRequest: MSALClaimsRequest?, forceRefresh: Bool, correlationId: UUID?) async throws -> MSALResult
Parameters
scopes
Scopes to request from the server, the scopes that come back can differ from the ones in the original call
account
An account object retrieved from the application object that the interactive authentication flow will be locked down to.
authority
Authority indicating a directory that MSAL can use to obtain tokens. Azure AD it is of the form https://
, where is the directory host (e.g. https://login.microsoftonline.com) and is a identifier within the directory itself (e.g. a domain associated to the tenant, such as contoso.onmicrosoft.com, or the GUID representing the TenantID property of the directory) claimsRequest
The claims parameter that needs to be sent to token endpoint. When claims is passed, access token will be skipped and refresh token will be tried.
forceRefresh
Ignore any existing access token in the cache and force MSAL/Broker to get a new access token from the service.
correlationId
UUID to correlate this request with the server
completionBlock
The completion block that will be called when the authentication flow completes, or encounters an error.
-
Removes all tokens from the cache for this application for the provided account. MSAL won’t be able to return tokens silently after calling this API, and developer will need to call acquireToken. User might need to enter his credentials again after calling this API
Declaration
Objective-C
- (BOOL)removeAccount:(nonnull MSALAccount *)account error:(NSError *_Nullable *_Nullable)error;
Swift
func remove(_ account: MSALAccount) throws
Parameters
account
The account to remove from the cache
-
Removes all tokens from the cache for this application for the provided account. Additionally, this API will remove account from the system browser or the embedded webView by navigating to the OIDC end session endpoint if requested in parameters (see more https://openid.net/specs/openid-connect-session-1_0.html). Moreover, if device has an SSO extension installed, the signout request will be handled through the SSO extension.
As a result of the signout operation, application will not be able to get tokens for the given account without user entering credentials. However, this will not sign out from other signed in apps on the device, unless it is explicitly enabled by the administrator configuration through an MDM profile.
Declaration
Objective-C
- (void)signoutWithAccount:(nonnull MSALAccount *)account signoutParameters:(nonnull MSALSignoutParameters *)signoutParameters completionBlock: (nonnull MSALSignoutCompletionBlock)signoutCompletionBlock;
Swift
func signout(with account: MSALAccount, signoutParameters: MSALSignoutParameters) async throws -> Bool
-
Reads device information from the authentication broker if present on the device.
Declaration
Objective-C
- (void)getDeviceInformationWithParameters:(nullable MSALParameters *)parameters completionBlock: (nonnull MSALDeviceInformationCompletionBlock) completionBlock;
Swift
func deviceInformation(with parameters: MSALParameters?) async throws -> MSALDeviceInformation
-
Reads WPJ metadata (UPN, tenant ID, deviCe ID) from the authentication broker if present on the device for a specific tenantId
Declaration
Objective-C
- (void)getWPJMetaDataDeviceWithParameters:(nullable MSALParameters *)parameters forTenantId:(nullable NSString *)tenantId completionBlock: (nonnull MSALWPJMetaDataCompletionBlock) completionBlock;
Swift
func wpjMetaDataDevice(with parameters: MSALParameters?, forTenantId tenantId: String?) async throws -> MSALWPJMetaData
-
A boolean indicates if a compatible broker is present in device for AAD requests.
Declaration
Objective-C
@property (readonly) BOOL isCompatibleAADBrokerAvailable;
Swift
var isCompatibleAADBrokerAvailable: Bool { get }
-
A String indicates the version of current MSAL SDK
Declaration
Objective-C
@property (class, readonly, nullable) NSString *sdkVersion;
Swift
class var sdkVersion: String? { get }
-
Gets the current account and return previous account if present. This can be useful to detect if the current account changes. This method must be called whenever the application is resumed or prior to running a scheduled background operation.
If there’re multiple accounts present, MSAL will return an ambiguous account error, and application should do account disambiguation by calling other MSAL Account enumeration APIs.
Declaration
Objective-C
- (void)getCurrentAccountWithParameters:(nullable MSALParameters *)parameters completionBlock: (nonnull MSALCurrentAccountCompletionBlock) completionBlock;
Swift
func currentAccount(with parameters: MSALParameters?) async throws -> (MSALAccount?, MSALAccount?)