fix(setup): harden device code OAuth flow and secret propagation - #231
Merged
Conversation
JohnDuprey
commented
Aug 10, 2026
JohnDuprey
commented
Contributor
- Fix authority mismatch in New-DeviceLogin where poll used /organizations but request honoured TenantId
- Deduplicate OIDC scopes instead of appending them unconditionally
- Return full token endpoint response so AADSTS codes surface instead of being swallowed
- Add client ID and scope allowlist to ExecDeviceCodeLogon to prevent token brokering
- Expose terminal poll errors (expired code, CA block) instead of reporting everything as pending
- Add ExecSamSecretStatus endpoint to detect AADSTS7000215 secret propagation delays
- Block the sign-in step in CippTenantModeDeploy until the secret is usable
- Fix PKCE to use S256 instead of plain, open popup before async digest to preserve user activation
- Switch authority from /common to /organizations and prompt from select_account to login
- Track device login popup closure and offer restart rather than locking the button
- Cancel grace-period close timer in cleanup to prevent false cancellation on next attempt
- Add sign-in log check in Test-CIPPAccessPermissions to detect device code token families
- Delete unused CIPPDeviceCodeButton.js
- Add crypto.subtle stub and digest mock to test environment for PKCE tests
- Fix authority mismatch in New-DeviceLogin where poll used /organizations but request honoured TenantId - Deduplicate OIDC scopes instead of appending them unconditionally - Return full token endpoint response so AADSTS codes surface instead of being swallowed - Add client ID and scope allowlist to ExecDeviceCodeLogon to prevent token brokering - Expose terminal poll errors (expired code, CA block) instead of reporting everything as pending - Add ExecSamSecretStatus endpoint to detect AADSTS7000215 secret propagation delays - Block the sign-in step in CippTenantModeDeploy until the secret is usable - Fix PKCE to use S256 instead of plain, open popup before async digest to preserve user activation - Switch authority from /common to /organizations and prompt from select_account to login - Track device login popup closure and offer restart rather than locking the button - Cancel grace-period close timer in cleanup to prevent false cancellation on next attempt - Add sign-in log check in Test-CIPPAccessPermissions to detect device code token families - Delete unused CIPPDeviceCodeButton.js - Add crypto.subtle stub and digest mock to test environment for PKCE tests
Adds OpenAPI spec for the ExecSamSecretStatus endpoint used by the setup wizard to poll whether a newly created SAM application secret has replicated in Entra before proceeding. Also adds a 400 response to an existing endpoint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.