-
Notifications
You must be signed in to change notification settings - Fork 152
Open
Labels
BugSomething isn't working, needs an investigation and a fixSomething isn't working, needs an investigation and a fixP2Normal priority items, should be done after P1Normal priority items, should be done after P1confidential-clientFor issues related to confidential client appsFor issues related to confidential client appspublic-clientFor questions/issues related to public client appsFor questions/issues related to public client apps
Description
While make changes in #929 and #931, we discovered that the behavior of the silent flow is incorrect when a refresh_in
value is set:
AcquireTokenSilentSupplier
has two main flows, depending on whether or not an account is passed into the silent call- If an account is passed in, we look up cached tokens based on account data, and if we find a cached token we check if it needs to be refreshed (and use the refresh token to do so)
- If no account is passed in, we look for cached tokens based on the assertion, and simply return the cached token if one is present
- The above behavior has existed since MSAL Java 1.0 (or earlier), and was done because account-based flows are generally the ones which have refresh tokens (OBO is one exception)
- However, when support for proactive refresh was added this behavior wasn't taken into account for confidential client scenarios, and as a result it appears that
refresh_in
values are not being honored for those flowsrefresh_in
is checked along with every other refresh reason in a single method, and these checks are only performed if an account is passed into the silent flow
We should investigate the behavior of the silent flow and proactive refresh in confidential client scenarios to confirm his behavior and correct it by either:
- Refactoring of
AcquireTokenSilentSupplier
to continue handling every scenario in one place, though this has historically led to over-complicated methods in that class which are hard to improve and debug - Look into following MSAL.NET's style of delegating silent call/refresh behavior to each individual Supplier class
neha-bhargava
Metadata
Metadata
Assignees
Labels
BugSomething isn't working, needs an investigation and a fixSomething isn't working, needs an investigation and a fixP2Normal priority items, should be done after P1Normal priority items, should be done after P1confidential-clientFor issues related to confidential client appsFor issues related to confidential client appspublic-clientFor questions/issues related to public client appsFor questions/issues related to public client apps