Capacitor Plugin MS auth

This plugin contains an implementation of MSAL for Capacitor. It is a forked version of this plugin, which has been amended to include the ability to force a token refresh when calling the MSAL aquireTokenSilent metho via passing of a forceRefresh (boolean) parameter.

Installation

• npm install @dvsa/capacitor-plugin-msauth
• npx cap sync
• Create an app registration
• In the app registration, go to Authentication, and then Add platform, and then iOS/macOS
• You will be asked for a bundle identifier, which you can find in Xcode (under the General tab of your project)
• Do the same for Android. When asked for the package name, use the name defined in AndroidManifest.xml.
• In the Signature section, generate a hash for your key. You will need this key hash later.
• (iOS) Add a new keychain group to your project's Signing & Capabilities. The keychain group should be com.microsoft.adalcache
• (iOS) Configure URL-schemes by adding the following to your Info.plist file:

<key>CFBundleURLTypes</key>
<array>
    <dict>
        <key>CFBundleURLSchemes</key>
        <array>
            <string>msauth.$(PRODUCT_BUNDLE_IDENTIFIER)</string>
        </array>
    </dict>
</array>
<key>LSApplicationQueriesSchemes</key>
<array>
    <string>msauthv2</string>
    <string>msauthv3</string>
</array>

• (iOS) Add import DvsaCapacitorPluginMsauth to the top of the AppDelegate file to ensure that the library is linked
• (iOS) if your app's AppDelegate already implements a application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool function, you should add the following code inside this method:

if MsAuthPlugin.checkAppOpen(url: url, options: options) == true {
    return true
}

• (Android) In the AndroidManifest.xml file, append the following code within the <application> section:

<activity
        android:name="com.microsoft.identity.client.BrowserTabActivity"
        android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:scheme="msauth"
              android:host="<package name>"
              android:path="/<key hash, with prepending slash>" />
    </intent-filter>
</activity>

Note that there are two placeholders, one for you package name and one for the key hash.

• (Android) Add the following snippet to the build.gradle file in the android/ folder

allprojects {
    repositories {
        maven {
            url 'https://pkgs.dev.azure.com/MicrosoftDeviceSDK/DuoSDK-Public/_packaging/Duo-SDK-Feed/maven/v1'
        }
    }
}

• (Android) Register the plugin in the main activity

Usage

Usage of the plugin is fairly simple, as it has just two methods: login and logout.

Login

import {Plugins} from '@capacitor/core';

const {MsAuthPlugin} = Plugins;

const result = await MsAuthPlugin.login({
    clientId: '<client id>',
    tenant: '<tenant, defaults to common>',
    domainHint: '<domainHint>',
    scopes: ['<scopes, defaults to no scopes>'],
    keyHash: '<Android only, the key hash as obtained above>',
    authorityType: '<AAD/B2C/CIAM>',
    authorityUrl: '<To sign the user into a specific CIAM tenant, configure with a specific authority. For example: https://xxx.ciamlogin.com/dddd5555-eeee-6666-ffff-00001111aaaa>', 
    redirectUri: '<Optional web-only redirect URI used for interactive login (acquireTokenPopup)>',
    forceRefresh: '<Optional boolean, forces a fresh token instead of using cached token. Defaults to false>',
});

const accessToken = result.accessToken;

redirectUri is supported in the web implementation for interactive login (acquireTokenPopup) and is ignored on Android and iOS.

Logout

import {Plugins} from '@capacitor/core';

const {MsAuthPlugin} = Plugins;

await MsAuthPlugin.logout({
    clientId: '<client id>',
    tenant: '<tenant, defaults to common>',
    domainHint: '<domainHint>',
    keyHash: '<Android only, the key hash as obtained above>',
});

License and Attribution

This project is licensed under the GNU Lesser General Public License v3.0 (LGPL-3.0).

Original Work

This is a derivative work based on the original capacitor-plugin-msauth by Recognize Group, which is also licensed under LGPL-3.0.

Copyright Notice

• Copyright (C) 2021 Recognize Group (original work)
• Copyright (C) 2026 DVSA (Driver and Vehicle Standards Agency) (derivative work)

Key Modifications in This Fork

• Added forceRefresh support to login options, passed through to MSAL acquireTokenSilent
• Added optional redirectUri support to login options for web interactive sign-in (acquireTokenPopup) only

License Terms

This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with this library; if not, see https://www.gnu.org/licenses/.

LGPL-3.0 Compliance

As required by the LGPL-3.0 license:

• This work retains the original copyright notices
• Source code is available under the same license terms
• Any modifications are clearly documented
• Users are free to modify and redistribute under LGPL-3.0 terms