title: AAD / ADAL: understanding user authorisation of app and "Show details" link
body: <p>I'm working on a proof of concept with Azure Active Directory and a native client obtaining an OpenID token for authentication to a web app. The native client uses <code>Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.AcquireTokenAsync</code>. My native client app is called "<em>Proof of concept</em>" and the web app is called "<em>PoC server</em>".</p>
  
  <p>The first time that a user logs in, the embedded browser opened by ADAL requires the user to authorise the application, with this page:</p>
  
  <p><img src="https://i.stack.imgur.com/gFivJ.png" alt="Screenshot"></p>
  
  <p>Translation:</p>
  
  <blockquote>
    <p>Authorise Proof of concept</p>
    
    <p>Proof of concept<br>
    Website of the application's publisher: nathexperimental.onmicrosoft.com</p>
    
    <p>Proof of concept needs permission to</p>
    
    <ul>
    <li>Access PoC server (PoC server)</li>
    <li>Log in and read your profile</li>
    </ul>
    
    <p>You've logged in as: test2@nathexperimental.onmicrosoft.com</p>
    
    <p>Show details</p>
    
    <p>[Accept] [Cancel]</p>
  </blockquote>
  
  <p>If I now click on the "Show details" link, it throws an exception:</p>
  
  <pre><code>Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: Non-HTTPS url redirect is not supported in webview
     en Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenInteractiveHandler.VerifyAuthorizationResult()
     en Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenInteractiveHandler.&lt;PreTokenRequest&gt;d__8.MoveNext()
  --- Fin del seguimiento de la pila de la ubicación anterior donde se produjo la excepción ---
     en System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     en System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     en System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
     en Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenHandlerBase.&lt;RunAsync&gt;d__55.MoveNext()
  </code></pre>
  
  <p>I'm not sure what the non-HTTPS URL it's trying to redirect to is, but my best guess is that it's the redirection URI of the native client, which I had set to <code>hook://login</code> with the intention to implement a custom protocol handler and see what calls were made.</p>
  
  <p>This seems to be confirmed by the fact that when I changed the redirection URI to <code>https://codegolf.stackexchange.com</code> (it was the first HTTPS-enabled site that came to mind...), the behaviour changed. But not in the way I expected. Now when I log in for the first time as a new user, it skips the entire "Authorise Proof of concept" page.</p>
  
  <p>What's going on? Under what conditions is the user required to authorise the application? Does the scenario where they must authorise permit me to supply a "More details" page?</p>