Fix ABBA deadlock between AzureActiveDirectory and AzureActiveDirectoryAuthority class monitors, Fixes AB#3578299

[mohitc1]

Summary

Fixes an ABBA deadlock between AzureActiveDirectory.class and AzureActiveDirectoryAuthority.class monitors, discovered during ANR investigation on Microsoft Authenticator (Broker v16.0.0). Under high concurrency (multiple apps calling into Broker simultaneously), two threads could deadlock:

• Path A (isKnownAuthority): sLock → authority.getAuthorityURL() → AzureActiveDirectoryAuthority.class → AzureActiveDirectory.class
• Path B (ensureCloudDiscoveryForAuthority): AzureActiveDirectory.class → authority.getAuthorityURL() → AzureActiveDirectoryAuthority.class

Changes

Source (3 files)

Authority.java

• Extract authority.getAuthorityURL() outside synchronized(sLock) in isKnownAuthority()
• Add null check for authorityUrl
• Improve error handling in getKnownAuthorityResult(): propagate original discovery exception error code instead of replacing with UNKNOWN_AUTHORITY
• Make KnownAuthorityResult fields final

AzureActiveDirectory.java

• Remove synchronized from read-only ConcurrentHashMap methods: hasCloudHost, getAzureActiveDirectoryCloud, getAzureActiveDirectoryCloudFromHostName, isValidCloudHost
• Extract authority.getAuthorityURL() outside synchronized scope in ensureCloudDiscoveryForAuthority(Authority)

AzureActiveDirectoryAuthority.java

• Remove synchronized from private static getAzureActiveDirectoryCloud()

Tests (2 files)

AzureActiveDirectoryTest.kt — 5 concurrency regression tests:

1. ABBA deadlock between isKnownAuthority and ensureCloudDiscovery
2. Concurrent reads do not block (ConcurrentHashMap safety)
3. Concurrent getAuthorityURL() calls
4. Concurrent reader/writer scenarios
5. High-concurrency stress test with multiple authorities

AuthorityKnownAuthorityTest.kt — expanded:

• Sovereign cloud recognition (Bleu, Delos, GovSG)
• Null authority / null authorityUrl handling
• Error code propagation (IO_ERROR, MALFORMED_URL, UNKNOWN_AUTHORITY)
• Developer-configured authority with discovery failure
• Pre-seeded metadata fallback

Linked Work Items

AB#3578299

[github-actions]

❌ Invalid work item number: AB#3578299
. Work item number must be a valid integer.

Click here to learn more.

[github-actions]

✅ Work item link check complete. Description contains link AB#3578299 to an Azure Boards work item.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Fixes a lock-order inversion (ABBA deadlock) between AzureActiveDirectory and AzureActiveDirectoryAuthority by moving polymorphic getAuthorityURL() calls out of synchronized scopes and reducing unnecessary synchronization in read-only cloud map accessors, with added regression tests around concurrency and error propagation.

Changes:

• Prevent deadlock by resolving authority.getAuthorityURL() outside locks in Authority.isKnownAuthority() and AzureActiveDirectory.ensureCloudDiscoveryForAuthority(Authority).
• Remove synchronized from read-only methods backed by ConcurrentHashMap and adjust known-authority discovery error propagation behavior.
• Add/expand Kotlin tests for concurrency deadlock regression and known-authority result behaviors.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
common4j/src/test/com/microsoft/identity/common/java/providers/microsoft/azureactivedirectory/AzureActiveDirectoryTest.kt	Adds concurrency regression/stress tests for deadlock and concurrent read/write behavior.
common4j/src/test/com/microsoft/identity/common/java/authorities/AuthorityKnownAuthorityTest.kt	Expands tests for null handling, sovereign clouds, and discovery error-code propagation.
common4j/src/main/com/microsoft/identity/common/java/providers/microsoft/azureactivedirectory/AzureActiveDirectory.java	Removes synchronization from read-only cloud map API and avoids lock inversion in authority-based discovery.
common4j/src/main/com/microsoft/identity/common/java/authorities/AzureActiveDirectoryAuthority.java	Removes synchronized from a static cloud lookup helper.
common4j/src/main/com/microsoft/identity/common/java/authorities/Authority.java	Avoids lock inversion in isKnownAuthority, improves getKnownAuthorityResult error propagation, finalizes result fields.
changelog.txt	Documents the patch-level deadlock fix.