It's also complicated to debug as it's an app running inside an app running on iOS. We have tried code flow with PKCE, but it seems that client running inside MS Teams tab is under restrictions that prevent it from working. We have tried storing the token and refresh token in the local storage, but our application running inside MS Teams tab cannot pick them up. We have tried changing cookie settings including the samesite:none secure but without effect. This problem is present only on iOS devices, inside MS Teams app.

The result is that our application inside MS Teams behaves as if user is not authenticated. Keycloak is using cookies to store current token, but thanks to ITP on iOS these cookies are not reachable in our application context, that is running inside MS Teams tab. The problem is handing over the session to our application running inside MS Teams tab. In Process tab, look for Microsoft Team, right-click on it and select End Task. This is further confirmed by the fact, that if the popup is closed and opened again, there is no need to enter credentials again, our keycloak backend is aware of active valid session. We use Keycloak for identity management and it is clear that session is established and working within the authentication popup. I believe the problem is related to using Face Id to open Authenticator in combination with enforced MFA and/or risk policies. Then you open the Teams application and it should work again. This correctly opens a popup on all platforms where user is able to authenticate with credentials or by using one of the Identity Providers we offer. Then you open only the authenticator and wait until Face ID has authenticated you and you can see your accounts. And I still believe the issue reside within the DNS filtering engine in the first place.We open authentication popup via thenticate, so it doesn’t run in the iframe. I understand the necessity to show the blocked page for human consumption, but for applications/APIs calls this creates issues.

I set some Gateway DNS policies to “ Allow ” the domains ‘.’ and ‘.’, and set an HTTP policy for ‘.’ to ‘ Do Not Inspect ’, and I no longer received the error, but I feel this doesn’t have to be the case… how many other similar tweaks should we do for how many other domains?Īnd I was not getting the ‘custom block page’, but some default CF one (per the first image). The issue seemed to be the resolution treatment for ‘ ’, which seemed to have also checking the alias ‘ ’ and this one was blocked by the CF rule Query categories=Security Risks, Unreachable (why?), with the Resolver decision=Blocked By Query Name, which seems strange at least and I don’t understand this behavior (some abnormal decision in the CF classification logic?).

Microsoft authenticator teams