Implement Microsoft B2C Authentication in App?

[dman2306]

I'm trying to write an app that makes use of Microsoft's B2C authentication process. I got up to pretty much the last step where it returns the authentication token. The high level code I'm running is:

params = [
	uri: "https://login.microsoftonline.com",
	path: "/konnectkohler.onmicrosoft.com/B2C_1_SignInUp/api/CombinedSigninAndSignup/confirmed",
	query: [
		csrf_token: csrf,
		tx: transId,
		p: "B2C_1_SignInUp"
	],
	headers: [
		"Cookie": cookiesFromJar(cookieJar)		
	]
]
httpGet(params) { resp ->
	log.debug resp.status
	log.debug resp.data
}

I get a org.apache.http.client.ClientProtocolException: null on line 169

First I don't know what the "null" is in reference to, but line 169 is the httpGet. My guess (because I can't see any details) is it doesn't like that MS returns a "weird" Location header like:

Location: msaldee521c5-2a72-4fcd-8c4d-a044e607ca8b://auth/?state=0B3B09A7-FF51-4C39-89E1-E15A1C96D059&code=TOKENINEEDHERE

Is it because of that header? Is there anyway to get more info than just ClientProtocolException? Is there anyway to make this kind of authentication work? Basically I don't want it to actually follow that redirect, I want to extract that token.

Anyone have any thoughts? I'd hate to have to hard code my oauth token in the app when Microsoft has a whole process around this to do it the right way. Can I even see if the location header is the cause of my error? The stack trace is at [org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.jav - Pastebin.com

@chuck.schwer @mike.maxwell any thoughts on how to debug something like this?

Yup, a bit more digging and I'm correct

org.apache.http.HttpException: msaldee521c5-2a72-4fcd-8c4d-a044e607ca8b protocol is not supported

Any way I can work around this from an app?

[cometfish]

Have you tried doing it via a raw lan request? There was a similar thread here:

Can Hubitat talk to a misbehaving HTTP server?

There are a couple way that might work,, Specify the RAW_LAN Procotol or LAN_TYPE_RAW as an option. It depends if you are going to build the request yourself of if you want to pass the various values as parameters and have the platform build it for you. If the request is standard you can do the second, if the request is also non standard you should do the first. https://docs.hubitat.com/index.php?title=HubAction_Object First Option: You'll need to build the entire message yourself as a Stri…

[dman2306]

That was my thread that was for HTTP, my understanding is sendHubCommand only supports HTTP, not HTTPS. Am I miscorrect?

[cometfish]

Haha so it is - no wonder it sounded so similar

I missed the requirement for HTTPS - you're probably right that it won't work as a raw request.
I thought about preventing trying to follow the redirect... but apparently that isn't possible either

Maybe someone else can chime in with an idea...

[dman2306]

Argh. I was thinking the same thing but didn't know it wasn't possible!

[chuck.schwer]

@cometfish

I thought about preventing trying to follow the redirect.

Yes, that seems like it would be the correct way to handle this. I've put in an issue to add an option to disable redirect handling. No idea when that might be but it is logged.