Add SilentAuthReceiver for Doze network-block reproduction, Fixes AB#3612535 by rpdome · Pull Request #2516 · AzureAD/microsoft-authentication-library-for-android

rpdome · 2026-05-20T20:44:47Z

Summary

Add a BroadcastReceiver to MsalTestApp that triggers acquireTokenSilent from a background process context (PROCESS_STATE_RECEIVER). This enables reliable reproduction of the Doze network-block issue that affects background broker auth triggered by FCM notifications.

Root Cause (from investigation)

When a foreground app binds to Broker via IPC, Android's NetworkPolicyManagerService adds a \dozable-allow\ firewall rule for the Broker's UID — masking the Doze network block during UI testing.

When the caller is in a background context (BroadcastReceiver/Service handling FCM), the IPC binding does NOT elevate the Broker enough for \dozable-allow. The Broker's network call to eSTS fails with \UnknownHostException.

Evidence

Confirmed via \dumpsys netpolicy\ firewall rule logs (UID 11697 dozable-allow toggling)
Confirmed via AOSP \DeviceIdleController.java\ and \NetworkPolicyManagerService\ source
Successfully reproduced: \io_error: Unable to resolve host login.microsoftonline.com\

Files

SilentAuthReceiver.java — BroadcastReceiver that calls acquireTokenSilent with forceRefresh + powerOptCheckEnabled=false
AndroidManifest.xml — Receiver registration with exported=true

Usage

\\�ash

Prerequisites: broker + MsalTestApp installed, account signed in

adb shell dumpsys battery unplug
adb shell dumpsys deviceidle force-idle
adb shell am broadcast -a com.microsoft.identity.client.testapp.SILENT_AUTH -n com.msft.identity.client.sample.local/com.microsoft.identity.client.testapp.SilentAuthReceiver
adb logcat -s SilentAuthReceiver:*

Cleanup:

adb shell dumpsys deviceidle unforce && adb shell dumpsys battery reset
\\

Test script

A companion script \scripts/doze-repro-test.sh\ in android-complete automates the full sequence.

Add a BroadcastReceiver to MsalTestApp that triggers acquireTokenSilent from a background process context (PROCESS_STATE_RECEIVER). This enables reliable reproduction of the Doze network-block issue that affects background broker auth triggered by FCM notifications. Key findings from investigation: - When a foreground app binds to Broker via IPC, Android's NetworkPolicyManagerService adds a dozable-allow firewall rule for the Broker's UID. This masks the Doze network block during UI testing. - When the caller is in a background context (BroadcastReceiver/Service), the IPC binding does NOT elevate the Broker enough for dozable-allow. The Broker's network call fails with UnknownHostException. - This matches the production scenario: Outlook receives FCM push in background -> calls OneAuth -> OneAuth calls Broker -> Broker's network to eSTS is blocked by Doze firewall. Usage: adb shell dumpsys battery unplug adb shell dumpsys deviceidle force-idle adb shell am broadcast \ -a com.microsoft.identity.client.testapp.SILENT_AUTH \ -n com.msft.identity.client.sample.local/com.microsoft.identity.client.testapp.SilentAuthReceiver adb logcat -s SilentAuthReceiver:*

github-actions · 2026-05-20T20:46:32Z

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

Copilot

Pull request overview

Adds a new testing hook in MsalTestApp to reproduce the Doze network-block scenario by triggering acquireTokenSilent from a BroadcastReceiver (background/receiver process state), along with manifest registration to invoke it via adb.

Changes:

Introduces SilentAuthReceiver to create a PCA instance and run acquireTokenSilentAsync(forceRefresh=true) from a receiver context.
Registers the receiver in AndroidManifest.xml with an intent-filter action for adb triggering.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
testapps/testapp/src/main/java/com/microsoft/identity/client/testapp/SilentAuthReceiver.java	Adds a BroadcastReceiver to run silent token acquisition from a background receiver context for Doze repro.
testapps/testapp/src/main/AndroidManifest.xml	Registers the new receiver/action used to trigger the Doze repro flow.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-05-20T21:11:33Z

❌ Invalid work item number: AB#3612535

##. Work item number must be a valid integer.

Click here to learn more.

github-actions · 2026-05-20T22:00:48Z

✅ Work item link check complete. Description contains link AB#3612535 to an Azure Boards work item.

Prvnkmr337 · 2026-05-20T22:49:12Z

Overall LGTM, just minor comments.

Prvnkmr337

Approving with minor comments. Kindly address the comments before merging :)

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/8666a879-5695-4eb3-bed2-71862e059d5f Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot · 2026-05-20T23:11:08Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

dl.google.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Xmx2048m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)
www.puppycrawl.com
- Triggering command: /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/working/files-to-index17473777082895257656.list --sourceArchiveDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/src --outputDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/trap/java (dns block)
- Triggering command: /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/working/files-to-index16743005309963048569.list --sourceArchiveDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/src --outputDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/cbdbc7c2-0ac5-48a5-9349-50239c795309 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/0e8621a1-0a3e-4157-b8ac-c8436b3d2a33 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/cbdbc7c2-0ac5-48a5-9349-50239c795309 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot · 2026-05-20T23:15:18Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

dl.google.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Xmx2048m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)
www.puppycrawl.com
- Triggering command: /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/working/files-to-index11018229262861532142.list --sourceArchiveDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/src --outputDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/trap/java (dns block)
- Triggering command: /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.4/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/working/files-to-index8606033338045743479.list --sourceArchiveDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/src --outputDir=/tmp/codeql-scratch-38ad52fff39af1e6/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

rpdome requested a review from a team as a code owner May 20, 2026 20:44

Copilot AI review requested due to automatic review settings May 20, 2026 20:44

github-actions Bot added the testapps label May 20, 2026

Copilot started reviewing on behalf of rpdome May 20, 2026 20:47 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

rpdome added the No-Changelog This change does not update the changelog. label May 20, 2026

Potential fix for pull request finding

a6d2373

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rpdome force-pushed the rapong/doze-silent-auth-receiver branch 3 times, most recently from 8cf2f3c to bca228f Compare May 20, 2026 21:03

github-actions Bot changed the title ~~Add SilentAuthReceiver for Doze network-block reproduction~~ Add SilentAuthReceiver for Doze network-block reproduction, Fixes AB#3612535 May 20, 2026

rpdome force-pushed the rapong/doze-silent-auth-receiver branch 2 times, most recently from 9a67d3b to a6d2373 Compare May 20, 2026 22:18

Prvnkmr337 reviewed May 20, 2026

View reviewed changes

Comment thread testapps/testapp/src/main/java/com/microsoft/identity/client/testapp/SilentAuthReceiver.java Outdated

Prvnkmr337 reviewed May 20, 2026

View reviewed changes

Comment thread testapps/testapp/src/main/java/com/microsoft/identity/client/testapp/SilentAuthReceiver.java Outdated

Prvnkmr337 reviewed May 20, 2026

View reviewed changes

Comment thread testapps/testapp/src/main/java/com/microsoft/identity/client/testapp/SilentAuthReceiver.java Outdated

Prvnkmr337 reviewed May 20, 2026

View reviewed changes

Comment thread testapps/testapp/src/main/java/com/microsoft/identity/client/testapp/SilentAuthReceiver.java

Prvnkmr337 approved these changes May 20, 2026

View reviewed changes

Copilot started work on behalf of rpdome May 20, 2026 23:04 View session

Address review comments in SilentAuthReceiver logging and scope handling

a39c8d2

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/8666a879-5695-4eb3-bed2-71862e059d5f Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

rpdome commented May 20, 2026

View reviewed changes

Comment thread testapps/testapp/src/main/java/com/microsoft/identity/client/testapp/SilentAuthReceiver.java Outdated

Harden scope parsing and align SilentAuthReceiver log levels

fe2790f

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/8666a879-5695-4eb3-bed2-71862e059d5f Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot finished work on behalf of rpdome May 20, 2026 23:11

Copilot started work on behalf of rpdome May 20, 2026 23:11 View session

Copilot AI and others added 3 commits May 20, 2026 23:12

Harden SilentAuthReceiver scope fallback and logging

a6cbf58

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/cbdbc7c2-0ac5-48a5-9349-50239c795309 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Simplify scope handling to single trim operation

2c6879c

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/0e8621a1-0a3e-4157-b8ac-c8436b3d2a33 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Adjust SilentAuthReceiver operational log levels

b4b3fcc

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-android/sessions/cbdbc7c2-0ac5-48a5-9349-50239c795309 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot finished work on behalf of rpdome May 20, 2026 23:14

Copilot finished work on behalf of rpdome May 20, 2026 23:15

Conversation

rpdome commented May 20, 2026 • edited by azure-boards Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause (from investigation)

Evidence

Files

Usage

Prerequisites: broker + MsalTestApp installed, account signed in

Cleanup:

Test script

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Prvnkmr337 commented May 20, 2026

Uh oh!

Prvnkmr337 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI commented May 20, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI commented May 20, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rpdome commented May 20, 2026 •

edited by azure-boards Bot

Loading

Prvnkmr337 left a comment •

edited

Loading