Browser signature hashes

[opt05]

We are wanting to add our own browser to the safe list in our config but cannot seem to generate the correct hash required. I search the MSAL docs and I'm not finding on how the browser_signature_hashes of the msal_config.json is generated or determined. Using the commands apksigner verify --print-certs -v file.apk or keytool -printcert -jarfile file.apk and using a HexToBase64 converter both seem to produce different hashes from the ones listed in the default MSAL configuration file for the same ones specified already. Can anyone provide details on on the hash is generated? Thanks!

[opt05]

I reached out to Microsoft directly and found the information and I'll put it here for others that cannot find it.

1. Clone this repo
2. Open this repo in Android Studio and wait for gradle to finish syncing
3. Navigate to the package-inspector directory and add/modify the following files:
   a. AndroidManifest.xml - add the following lines:

   <?xml version="1.0" encoding="utf-8"?>
   <manifest xmlns:android="http://schemas.android.com/apk/res/android"
       package="com.microsoft.inspector">
       <permission android:name="android.permission.QUERY_ALL_PACKAGES"/>
       ...
       <queries>
           <intent>
               <action android:name="android.intent.action.MAIN"/>
           </intent>
       </queries>
   </manifest>
   

   b. MainActivity.java - change this line on 148, from "SHA" to:

   final MessageDigest digest = MessageDigest.getInstance("SHA-512");
   

   c. MainActivity.java - change this line on 150, from Base64.NO_WRAP to:

   packageSigningSha = Base64.encodeToString(digest.digest(), Base64.NO_WRAP + Base64.URL_SAFE);
   

4. Run the configuration in Android Studio called package-inspector and app should install on your device/emulator
5. The MSAL Package Inspector should run and list all the installed apps 🎉
6. Verify the hash presented for Firefox (org.mozilla.firefox) matches the one listed in the library's config file.