Brokered Hybrid Spa (#4020)

bgavrilMS · gladjohn · pmaytak · web-flow · commit 218643b25b41 · 2023-03-30T11:18:02.000+01:00
* Brokered Hybrid Spa

* wip

* Change to extra params

* Update src/client/Microsoft.Identity.Client/AuthenticationResult.cs

Co-authored-by: Gladwin Johnson &lt;90415114+gladjohn@users.noreply.github.com&gt;

* PR feedback.

---------

Co-authored-by: Gladwin Johnson &lt;90415114+gladjohn@users.noreply.github.com&gt;
Co-authored-by: pmaytak &lt;34331512+pmaytak@users.noreply.github.com&gt;
diff --git a/src/client/Microsoft.Identity.Client/AuthenticationResult.cs b/src/client/Microsoft.Identity.Client/AuthenticationResult.cs
@@ -39,7 +39,8 @@ public partial class AuthenticationResult
         /// <param name="tokenType">The token type, defaults to Bearer. Note: this property is experimental and may change in future versions of the library.</param>
         /// <param name="authenticationResultMetadata">Contains metadata related to the Authentication Result.</param>
         /// <param name="claimsPrincipal">Claims from the ID token</param>
-        /// <param name="spaAuthCode">Auth Code returned by the Microsoft identity platform when you use AcquireTokenByAuthorizeCode.WithSpaAuthorizationCode(). This auth code is meant to be redeemed by the frontend code.</param>
+        /// <param name="spaAuthCode">Auth Code returned by the Microsoft identity platform when you use AcquireTokenByAuthorizationCode.WithSpaAuthorizationCode(). This auth code is meant to be redeemed by the frontend code. See https://aka.ms/msal-net/spa-auth-code</param>
+        /// <param name="additionalResponseParameters">Other properties from the token response.</param>
         public AuthenticationResult( // for backwards compat with 4.16-
             string accessToken,
             bool isExtendedLifeTimeToken,
@@ -54,7 +55,8 @@ public partial class AuthenticationResult
             string tokenType = "Bearer",
             AuthenticationResultMetadata authenticationResultMetadata = null, 
             ClaimsPrincipal claimsPrincipal = null,
-            string spaAuthCode = null)
+            string spaAuthCode = null,
+            IReadOnlyDictionary<string, string> additionalResponseParameters = null)
         {
             AccessToken = accessToken;
 #pragma warning disable CS0618 // Type or member is obsolete
@@ -72,6 +74,7 @@ public partial class AuthenticationResult
             AuthenticationResultMetadata = authenticationResultMetadata;
             ClaimsPrincipal = claimsPrincipal;
             SpaAuthCode = spaAuthCode;
+            AdditionalResponseParameters = additionalResponseParameters;
         }
 
         /// <summary>
@@ -130,7 +133,8 @@ internal AuthenticationResult(
             TokenSource tokenSource, 
             ApiEvent apiEvent,
             Account account,
-            string spaAuthCode = null)
+            string spaAuthCode, 
+            IReadOnlyDictionary<string, string> additionalResponseParameters)
         {
             _authenticationScheme = authenticationScheme ?? throw new ArgumentNullException(nameof(authenticationScheme));
             
@@ -162,7 +166,7 @@ internal AuthenticationResult(
             CorrelationId = correlationID;
             ApiEvent = apiEvent;
             AuthenticationResultMetadata = new AuthenticationResultMetadata(tokenSource);
-
+            AdditionalResponseParameters = additionalResponseParameters;
             if (msalAccessTokenCacheItem != null)
             {
                 AccessToken = authenticationScheme.FormatAccessToken(msalAccessTokenCacheItem);
@@ -268,6 +272,14 @@ internal AuthenticationResult() { }
         /// </summary>
         public string SpaAuthCode { get; }
 
+        /// <summary>
+        /// Exposes additional response parameters returned by the token issuer (AAD).
+        /// </summary>
+        /// <remarks>
+        /// Not all parameters are added here, only the ones that MSAL doesn't interpret itself and only scalars.
+        /// </remarks>
+        public IReadOnlyDictionary<string, string> AdditionalResponseParameters { get; }
+
         /// <summary>
         /// All the claims present in the ID token.
         /// </summary>
diff --git a/src/client/Microsoft.Identity.Client/Internal/Requests/ClientCredentialRequest.cs b/src/client/Microsoft.Identity.Client/Internal/Requests/ClientCredentialRequest.cs
@@ -65,7 +65,9 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
                                                             AuthenticationRequestParameters.RequestContext.CorrelationId,
                                                             TokenSource.Cache,
                                                             AuthenticationRequestParameters.RequestContext.ApiEvent,
-                                                            null);
+                                                            account: null,
+                                                            spaAuthCode: null,
+                                                            additionalResponseParameters: null);
                 }
                 else
                 {
diff --git a/src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs b/src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs
@@ -56,7 +56,9 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
                                                             AuthenticationRequestParameters.RequestContext.CorrelationId,
                                                             TokenSource.Cache,
                                                             AuthenticationRequestParameters.RequestContext.ApiEvent,
-                                                            null);
+                                                            account: null, 
+                                                            spaAuthCode: null,
+                                                            additionalResponseParameters: null);
                 }
                 else
                 {
diff --git a/src/client/Microsoft.Identity.Client/Internal/Requests/OnBehalfOfRequest.cs b/src/client/Microsoft.Identity.Client/Internal/Requests/OnBehalfOfRequest.cs
@@ -82,7 +82,9 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
                                                             AuthenticationRequestParameters.RequestContext.CorrelationId,
                                                             TokenSource.Cache,
                                                             AuthenticationRequestParameters.RequestContext.ApiEvent,
-                                                            account);
+                                                            account, 
+                                                            spaAuthCode: null,
+                                                            additionalResponseParameters: null);
                 }
                 else
                 {
diff --git a/src/client/Microsoft.Identity.Client/Internal/Requests/RequestBase.cs b/src/client/Microsoft.Identity.Client/Internal/Requests/RequestBase.cs
@@ -235,7 +235,8 @@ protected async Task<AuthenticationResult> CacheTokenResponseAndCreateAuthentica
                 msalTokenResponse.TokenSource,
                 AuthenticationRequestParameters.RequestContext.ApiEvent,
                 account,
-                msalTokenResponse.SpaAuthCode);
+                msalTokenResponse.SpaAuthCode, 
+                msalTokenResponse.CreateExtensionDataStringMap());
         }
 
         private void ValidateAccountIdentifiers(ClientInfo fromServer)
@@ -452,7 +453,9 @@ internal async Task<AuthenticationResult> HandleTokenRefreshErrorAsync(MsalServi
                     AuthenticationRequestParameters.RequestContext.CorrelationId,
                     TokenSource.Cache,
                     AuthenticationRequestParameters.RequestContext.ApiEvent,
-                    account);
+                    account, 
+                    spaAuthCode: null, 
+                    additionalResponseParameters: null);
             }
 
             logger.Warning("Either the exception does not indicate a problem with AAD or the token cache does not have an AT that is usable. ");
diff --git a/src/client/Microsoft.Identity.Client/Internal/Requests/Silent/CacheSilentStrategy.cs b/src/client/Microsoft.Identity.Client/Internal/Requests/Silent/CacheSilentStrategy.cs
@@ -160,7 +160,9 @@ private async Task<AuthenticationResult> CreateAuthenticationResultAsync(MsalAcc
                 AuthenticationRequestParameters.RequestContext.CorrelationId,
                 TokenSource.Cache,
                 AuthenticationRequestParameters.RequestContext.ApiEvent,
-                account);
+                account, 
+                spaAuthCode: null,
+                additionalResponseParameters: null);
         }       
 
         private async Task<MsalTokenResponse> TryGetTokenUsingFociAsync(CancellationToken cancellationToken)
diff --git a/src/client/Microsoft.Identity.Client/OAuth2/MsalTokenResponse.cs b/src/client/Microsoft.Identity.Client/OAuth2/MsalTokenResponse.cs
@@ -19,6 +19,7 @@
 using JsonProperty = System.Text.Json.Serialization.JsonPropertyNameAttribute;
 #else
 using Microsoft.Identity.Json;
+using Microsoft.Identity.Json.Linq;
 #endif
 
 namespace Microsoft.Identity.Client.OAuth2
@@ -39,13 +40,16 @@ internal class TokenResponseClaim : OAuth2ResponseBaseClaim
         public const string Authority = "authority";
         public const string FamilyId = "foci";
         public const string RefreshIn = "refresh_in";
-        public const string SpaCode = "spa_code";
         public const string ErrorSubcode = "error_subcode";
         public const string ErrorSubcodeCancel = "cancel";
 
         public const string TenantId = "tenant_id";
         public const string Upn = "username";
         public const string LocalAccountId = "local_account_id";
+
+        // Hybrid SPA - see https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/3994
+        public const string SpaCode = "spa_code";
+
     }
 
     [JsonObject]
@@ -59,6 +63,59 @@ public MsalTokenResponse()
 
         private const string iOSBrokerErrorMetadata = "error_metadata";
         private const string iOSBrokerHomeAccountId = "home_account_id";
+
+        // All properties not explicitly defined are added to this dictionary
+        // See JSON overflow https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/handle-overflow?pivots=dotnet-7-0
+#if SUPPORTS_SYSTEM_TEXT_JSON
+        [JsonExtensionData]
+        public Dictionary<string, JsonElement> ExtensionData { get; set; }
+#else
+        [JsonExtensionData]
+        public Dictionary<string, JToken> ExtensionData { get; set; }
+#endif
+
+        // Exposes only scalar properties from ExtensionData
+        public Dictionary<string, string> CreateExtensionDataStringMap()
+        {
+            if (ExtensionData == null || ExtensionData.Count == 0)
+            {
+                return null;
+            }
+
+            Dictionary<string, string> stringExtensionData = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+
+#if SUPPORTS_SYSTEM_TEXT_JSON
+            foreach (KeyValuePair<string, JsonElement> item in ExtensionData)
+            {
+                if (item.Value.ValueKind == JsonValueKind.String ||
+                   item.Value.ValueKind == JsonValueKind.Number ||
+                   item.Value.ValueKind == JsonValueKind.True ||
+                   item.Value.ValueKind == JsonValueKind.False ||
+                   item.Value.ValueKind == JsonValueKind.Null)
+                {
+                    stringExtensionData.Add(item.Key, item.Value.ToString());
+                }
+            }
+#else
+            foreach (KeyValuePair<string, JToken> item in ExtensionData)
+            {
+                if (item.Value.Type == JTokenType.String ||
+                   item.Value.Type == JTokenType.Uri ||
+                   item.Value.Type == JTokenType.Boolean ||
+                   item.Value.Type == JTokenType.Date ||
+                   item.Value.Type == JTokenType.Float ||
+                   item.Value.Type == JTokenType.Guid ||
+                   item.Value.Type == JTokenType.Integer ||
+                   item.Value.Type == JTokenType.TimeSpan ||
+                   item.Value.Type == JTokenType.Null)
+                {
+                    stringExtensionData.Add(item.Key, item.Value.ToString());
+                }
+            }
+#endif
+            return stringExtensionData;
+        }
+
         [JsonProperty(TokenResponseClaim.TokenType)]
         public string TokenType { get; set; }
 
diff --git a/src/client/Microsoft.Identity.Client/Utils/JsonHelper.cs b/src/client/Microsoft.Identity.Client/Utils/JsonHelper.cs
@@ -40,7 +40,10 @@ internal static T DeserializeFromJson<T>(string json)
 #if SUPPORTS_SYSTEM_TEXT_JSON
             return (T)JsonSerializer.Deserialize(json, typeof(T), MsalJsonSerializerContext.Custom);
 #else
-            return JsonConvert.DeserializeObject<T>(json);
+            
+            return JsonConvert.DeserializeObject<T>(json, new JsonSerializerSettings() { 
+                DateParseHandling = DateParseHandling.None, // Newtonsoft tries to be smart about dates, but System.Text.Json does not                
+            });
 #endif
         }
 
diff --git a/src/client/Microsoft.Identity.Client/json/Serialization/DefaultContractResolver.cs b/src/client/Microsoft.Identity.Client/json/Serialization/DefaultContractResolver.cs
@@ -582,7 +582,7 @@ internal class EnumerableDictionaryWrapper<TEnumeratorKey, TEnumeratorValue> : I
         {
             private readonly IEnumerable<KeyValuePair<TEnumeratorKey, TEnumeratorValue>> _e;
 
-            internal EnumerableDictionaryWrapper(IEnumerable<KeyValuePair<TEnumeratorKey, TEnumeratorValue>> e)
+            public EnumerableDictionaryWrapper(IEnumerable<KeyValuePair<TEnumeratorKey, TEnumeratorValue>> e)
             {
                 ValidationUtils.ArgumentNotNull(e, nameof(e));
                 _e = e;
diff --git a/tests/Microsoft.Identity.Test.Common/Core/Mocks/MockHelpers.cs b/tests/Microsoft.Identity.Test.Common/Core/Mocks/MockHelpers.cs
@@ -7,6 +7,7 @@
 using System.Net;
 using System.Net.Http;
 using System.Net.Http.Headers;
+using System.Xml;
 using Microsoft.Identity.Client.Utils;
 using Microsoft.Identity.Test.Unit;
 
@@ -60,8 +61,7 @@ public static string GetDefaultTokenResponse(string accessToken = TestConstants.
             "\"r1/scope1 r1/scope2\",\"access_token\":\"" + accessToken + "\"" +
             ",\"refresh_token\":\"" + Guid.NewGuid() + "\",\"client_info\"" +
             ":\"" + CreateClientInfo() + "\",\"id_token\"" +
-            ":\"" + CreateIdToken(TestConstants.UniqueId, TestConstants.DisplayableId) +
-            "\",\"id_token_expires_in\":\"3600\"}";
+            ":\"" + CreateIdToken(TestConstants.UniqueId, TestConstants.DisplayableId) + "\"}";
         }
 
         public static string GetPopTokenResponse()
@@ -87,6 +87,18 @@ public static string GetHybridSpaTokenResponse(string spaCode)
             ",\"id_token_expires_in\":\"3600\"}";
         }
 
+        public static string GetBridgedHybridSpaTokenResponse(string spaAccountId)
+        {
+            return
+            "{\"token_type\":\"Bearer\",\"expires_in\":\"3599\",\"refresh_in\":\"2400\",\"scope\":" +
+            "\"r1/scope1 r1/scope2\",\"access_token\":\"" + TestConstants.ATSecret + "\"" +
+            ",\"refresh_token\":\"" + Guid.NewGuid() + "\",\"client_info\"" +
+            ":\"" + CreateClientInfo() + "\",\"id_token\"" +
+            ":\"" + CreateIdToken(TestConstants.UniqueId, TestConstants.DisplayableId) +
+            "\",\"spa_accountId\":\"" + spaAccountId + "\"" +
+            ",\"id_token_expires_in\":\"3600\"}";
+        }
+
         public static string GetMsiSuccessfulResponse()
         {
             string expiresOn = DateTimeHelpers.DateTimeToUnixTimestamp(DateTime.UtcNow.AddHours(1));
@@ -311,17 +323,30 @@ public static HttpResponseMessage CreateSuccessTokenResponseMessage(
             string accessToken = "some-access-token",
             string refreshToken = "OAAsomethingencrypedQwgAA")
         {
-            string idToken = CreateIdToken(uniqueId, displayableId, TestConstants.Utid);
             HttpResponseMessage responseMessage = new HttpResponseMessage(HttpStatusCode.OK);
+            string stringContent = CreateSuccessTokenResponseString(uniqueId, displayableId, scope, foci, utid, accessToken, refreshToken);
+            HttpContent content = new StringContent(stringContent);
+            responseMessage.Content = content;
+            return responseMessage;
+        }
+
+        public static string CreateSuccessTokenResponseString(string uniqueId,
+            string displayableId,
+            string[] scope,
+            bool foci = false,
+            string utid = TestConstants.Utid,
+            string accessToken = "some-access-token",
+            string refreshToken = "OAAsomethingencrypedQwgAA")
+        {
+            string idToken = CreateIdToken(uniqueId, displayableId, TestConstants.Utid);
             string stringContent = "{\"token_type\":\"Bearer\",\"expires_in\":\"3599\",\"refresh_in\":\"2400\",\"scope\":\"" +
                                   scope.AsSingleString() +
                                   "\",\"access_token\":\"" + accessToken + "\",\"refresh_token\":\"" + refreshToken + "\",\"id_token\":\"" +
                                   idToken +
                                   (foci ? "\",\"foci\":\"1" : "") +
                                   "\",\"id_token_expires_in\":\"3600\",\"client_info\":\"" + CreateClientInfo(uniqueId, utid) + "\"}";
-            HttpContent content = new StringContent(stringContent);
-            responseMessage.Content = content;
-            return responseMessage;
+            
+            return stringContent;
         }
 
         public static string CreateIdToken(string uniqueId, string displayableId)
diff --git a/tests/Microsoft.Identity.Test.Unit/PublicApiTests/AuthenticationResultTests.cs b/tests/Microsoft.Identity.Test.Unit/PublicApiTests/AuthenticationResultTests.cs
diff --git a/tests/Microsoft.Identity.Test.Unit/PublicApiTests/ConfidentialClientApplicationTests.cs b/tests/Microsoft.Identity.Test.Unit/PublicApiTests/ConfidentialClientApplicationTests.cs
diff --git a/tests/devapps/Managed Identity apps/MSIHelperService/AzureFunction/GetEnvironmentVariables.cs b/tests/devapps/Managed Identity apps/MSIHelperService/AzureFunction/GetEnvironmentVariables.cs

Original file line number	Diff line number	Diff line change
`@@ -65,7 +65,9 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok`
`65`	`65`	`AuthenticationRequestParameters.RequestContext.CorrelationId,`
`66`	`66`	`TokenSource.Cache,`
`67`	`67`	`AuthenticationRequestParameters.RequestContext.ApiEvent,`
`68`		`- null);`
	`68`	`+ account: null,`
	`69`	`+ spaAuthCode: null,`
	`70`	`+ additionalResponseParameters: null);`
`69`	`71`	`}`
`70`	`72`	`else`
`71`	`73`	`{`
Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,9 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok`
`56`	`56`	`AuthenticationRequestParameters.RequestContext.CorrelationId,`
`57`	`57`	`TokenSource.Cache,`
`58`	`58`	`AuthenticationRequestParameters.RequestContext.ApiEvent,`
`59`		`- null);`
	`59`	`+ account: null,`
	`60`	`+ spaAuthCode: null,`
	`61`	`+ additionalResponseParameters: null);`
`60`	`62`	`}`
`61`	`63`	`else`
`62`	`64`	`{`
Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,9 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok`
`82`	`82`	`AuthenticationRequestParameters.RequestContext.CorrelationId,`
`83`	`83`	`TokenSource.Cache,`
`84`	`84`	`AuthenticationRequestParameters.RequestContext.ApiEvent,`
`85`		`- account);`
	`85`	`+ account,`
	`86`	`+ spaAuthCode: null,`
	`87`	`+ additionalResponseParameters: null);`
`86`	`88`	`}`
`87`	`89`	`else`
`88`	`90`	`{`
Original file line number	Diff line number	Diff line change
`@@ -582,7 +582,7 @@ internal class EnumerableDictionaryWrapper<TEnumeratorKey, TEnumeratorValue> : I`
`582`	`582`	`{`
`583`	`583`	`private readonly IEnumerable<KeyValuePair<TEnumeratorKey, TEnumeratorValue>> _e;`
`584`	`584`
`585`		`- internal EnumerableDictionaryWrapper(IEnumerable<KeyValuePair<TEnumeratorKey, TEnumeratorValue>> e)`
	`585`	`+ public EnumerableDictionaryWrapper(IEnumerable<KeyValuePair<TEnumeratorKey, TEnumeratorValue>> e)`
`586`	`586`	`{`
`587`	`587`	`ValidationUtils.ArgumentNotNull(e, nameof(e));`
`588`	`588`	`_e = e;`