macOS 10.12 Bug regarding CBA and MDM (For ADAL 4.0.0 onwards)
Starting from ADAL 4.0.0, we are moving ADAL to WKWebView as Apple has now officially deprecated UIWebView.
However, there are some known bugs of macOS 10.12 (El Capitan) regarding keychain access prompt, which may cause the auth flow to fail. Following is the affected flows with some workarounds.
For Certificate Based Authentication (CBA) flow, once user chooses the certificate from cert picker, macOS system will pop up the following keychain access prompt:
It is a known system bug that "Always Allow" will lead to authentication failure, while "Allow" could work as expected.