ADAL.NET Version 5.2.9

Version 5.2.9

Enhancements:
This release updates some .NET dependencies to a newer version.

ADAL.NET Version 5.2.7

Version 5.2.7

Bug Fixes:
Starting in ADAL.NET version 4.0.0, for ADFS, the string literal /adfs/ was getting dropped from the authority url. This caused the endpoints to be incorrect for ADFS. This issue has been resolved.

ADAL.NET Version 5.2.6

Version 5.2.6

Bug Fixes:
Due to incorrect parameters sent in brokered authentication requests on Android, the broker may fail to sign the user in silently ADAL.NET now sends the correct parameters during brokered authentication on Android. Issue

ADAL.NET Version 5.2.5

Version 5.2.5

Bug Fixes:
Due to network timeouts, hitting the instance discovery endpoint may time out. ADAL.NET now returns a more explicit error message. Issue
On iOS 13, the IsBrokerResponse method can return true if SourceApplication is null, which later resulted in a null ref on non-broker related calls. ADAL.NET now checks the openUrl is a broker response before proceeding. Issue
On Android with embedded webview, when setting up the password reset, the security information drop boxes were not active. ADAL.NET now uses the correct Activity context in the embedded webview. Issue

ADAL.NET Version 5.2.4

MSAL .NET now stores the application token returned from the iOS broker (Authenticator). This may result in the user experiencing less prompts. See #1676

ADAL.NET Version 5.2.3

Version 5.2.3

Bug Fixes:

• Customers reported issues signing in with the Authenticator App on iOS devices < 13 with ADAL.NET. The issue has been resolved and increased logging included in the iOS broker scenario. See issue for more details.

ADAL.NET Version 5.2.2

Version 5.2.2

Bug Fixes:

• Ensures that ADAL.NET works with brokers on iOS 13. On iOS 13, the iOS broker, may or may not return the source application, which will be used by ADAL.NET to verify that the response is coming from the iOS broker. To maintain secure calls, ADAL.NET will now also create a nonce to send in the broker request and will verify the same nonce is returned in the broker response in the case of a missing source application. Issue

ADAL.NET Version 5.2.1

Version 5.2.1

Bug fix:

• When using integrated Windows authentication in hybrid environments, managed (cloud) users were not able to sign-in. Now, ADAL.NET sends the correct header information to enable seamless SSO in hybrid environments for managed users.
  Additional info:
  MSDOCS on Seamless SSO
  Seamless SSO Wiki
  Integrated Windows Auth Wiki
  Issue 1478

ADAL.NET Version 5.2.0

Version 5.2.0

Bug fix:

• For Web Apps and Web APIs, we recommend the serialization of one cache per account, as noted in the wiki. If this recommendation was not followed, starting in ADAL.NET Version 5.0.0-preview, some scenarios involving the On-Behalf-Of flow and specific use cases of the UserAssertion, could result in an elevation of privilege in specific problem scenarios. ADAL.NET now skips the MSAL.NET shared cache look up for On-Behalf-Of scenarios. Please refer to the CVE-2019-1258 for more details.

ADAL.NET Version 5.1.1

Version 5.1.1

Bug fixes:

• When specifying a port, ADAL.NET would always make the call on port 443. ADAL.NET now honors the port specified by the developer. Issue 1627
• On Android, using embedded webview, during log-in, when the screen orientation changed, ADAL.NET lost the information the user typed into the login screen. ADAL.NET now maintains information typed into the log in screen during screen orientation changes. See issue for more details
• ADAL.NET was not correctly catching a network down exception. ADAL.NET now catches the exception and sets it on the correct TaskCompletionSource object. See PR for more information