/*! @azure/msal-node v5.1.3 2026-04-16 */
|
'use strict';
|
'use strict';
|
|
var uuid = require('uuid');
|
var crypto = require('crypto');
|
var jwt = require('jsonwebtoken');
|
var http = require('http');
|
var fs = require('fs');
|
var path = require('path');
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* This class serializes cache entities to be saved into in-memory object types defined internally
|
* @internal
|
*/
|
class Serializer {
|
/**
|
* serialize the JSON blob
|
* @param data - JSON blob cache
|
*/
|
static serializeJSONBlob(data) {
|
return JSON.stringify(data);
|
}
|
/**
|
* Serialize Accounts
|
* @param accCache - cache of accounts
|
*/
|
static serializeAccounts(accCache) {
|
const accounts = {};
|
Object.keys(accCache).map(function (key) {
|
const accountEntity = accCache[key];
|
accounts[key] = {
|
home_account_id: accountEntity.homeAccountId,
|
environment: accountEntity.environment,
|
realm: accountEntity.realm,
|
local_account_id: accountEntity.localAccountId,
|
username: accountEntity.username,
|
authority_type: accountEntity.authorityType,
|
name: accountEntity.name,
|
client_info: accountEntity.clientInfo,
|
last_modification_time: accountEntity.lastModificationTime,
|
last_modification_app: accountEntity.lastModificationApp,
|
tenantProfiles: accountEntity.tenantProfiles?.map((tenantProfile) => {
|
return JSON.stringify(tenantProfile);
|
}),
|
};
|
});
|
return accounts;
|
}
|
/**
|
* Serialize IdTokens
|
* @param idTCache - cache of ID tokens
|
*/
|
static serializeIdTokens(idTCache) {
|
const idTokens = {};
|
Object.keys(idTCache).map(function (key) {
|
const idTEntity = idTCache[key];
|
idTokens[key] = {
|
home_account_id: idTEntity.homeAccountId,
|
environment: idTEntity.environment,
|
credential_type: idTEntity.credentialType,
|
client_id: idTEntity.clientId,
|
secret: idTEntity.secret,
|
realm: idTEntity.realm,
|
};
|
});
|
return idTokens;
|
}
|
/**
|
* Serializes AccessTokens
|
* @param atCache - cache of access tokens
|
*/
|
static serializeAccessTokens(atCache) {
|
const accessTokens = {};
|
Object.keys(atCache).map(function (key) {
|
const atEntity = atCache[key];
|
accessTokens[key] = {
|
home_account_id: atEntity.homeAccountId,
|
environment: atEntity.environment,
|
credential_type: atEntity.credentialType,
|
client_id: atEntity.clientId,
|
secret: atEntity.secret,
|
realm: atEntity.realm,
|
target: atEntity.target,
|
cached_at: atEntity.cachedAt,
|
expires_on: atEntity.expiresOn,
|
extended_expires_on: atEntity.extendedExpiresOn,
|
refresh_on: atEntity.refreshOn,
|
key_id: atEntity.keyId,
|
token_type: atEntity.tokenType,
|
userAssertionHash: atEntity.userAssertionHash,
|
resource: atEntity.resource,
|
};
|
});
|
return accessTokens;
|
}
|
/**
|
* Serialize refreshTokens
|
* @param rtCache - cache of refresh tokens
|
*/
|
static serializeRefreshTokens(rtCache) {
|
const refreshTokens = {};
|
Object.keys(rtCache).map(function (key) {
|
const rtEntity = rtCache[key];
|
refreshTokens[key] = {
|
home_account_id: rtEntity.homeAccountId,
|
environment: rtEntity.environment,
|
credential_type: rtEntity.credentialType,
|
client_id: rtEntity.clientId,
|
secret: rtEntity.secret,
|
family_id: rtEntity.familyId,
|
target: rtEntity.target,
|
realm: rtEntity.realm,
|
};
|
});
|
return refreshTokens;
|
}
|
/**
|
* Serialize amdtCache
|
* @param amdtCache - cache of app metadata
|
*/
|
static serializeAppMetadata(amdtCache) {
|
const appMetadata = {};
|
Object.keys(amdtCache).map(function (key) {
|
const amdtEntity = amdtCache[key];
|
appMetadata[key] = {
|
client_id: amdtEntity.clientId,
|
environment: amdtEntity.environment,
|
family_id: amdtEntity.familyId,
|
};
|
});
|
return appMetadata;
|
}
|
/**
|
* Serialize the cache
|
* @param inMemCache - itemised cache read from the JSON
|
*/
|
static serializeAllCache(inMemCache) {
|
return {
|
Account: this.serializeAccounts(inMemCache.accounts),
|
IdToken: this.serializeIdTokens(inMemCache.idTokens),
|
AccessToken: this.serializeAccessTokens(inMemCache.accessTokens),
|
RefreshToken: this.serializeRefreshTokens(inMemCache.refreshTokens),
|
AppMetadata: this.serializeAppMetadata(inMemCache.appMetadata),
|
};
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const SKU = "msal.js.common";
|
// default authority
|
const DEFAULT_AUTHORITY = "https://login.microsoftonline.com/common/";
|
const DEFAULT_AUTHORITY_HOST = "login.microsoftonline.com";
|
const DEFAULT_COMMON_TENANT = "common";
|
// ADFS String
|
const ADFS = "adfs";
|
const DSTS = "dstsv2";
|
// Default AAD Instance Discovery Endpoint
|
const AAD_INSTANCE_DISCOVERY_ENDPT = `${DEFAULT_AUTHORITY}discovery/instance?api-version=1.1&authorization_endpoint=`;
|
// CIAM URL
|
const CIAM_AUTH_URL = ".ciamlogin.com";
|
const AAD_TENANT_DOMAIN_SUFFIX = ".onmicrosoft.com";
|
// Resource delimiter - used for certain cache entries
|
const RESOURCE_DELIM = "|";
|
// Default scopes
|
const OPENID_SCOPE = "openid";
|
const PROFILE_SCOPE = "profile";
|
const OFFLINE_ACCESS_SCOPE = "offline_access";
|
const EMAIL_SCOPE = "email";
|
const URL_FORM_CONTENT_TYPE = "application/x-www-form-urlencoded;charset=utf-8";
|
const AUTHORIZATION_PENDING = "authorization_pending";
|
const NOT_APPLICABLE = "N/A";
|
const NOT_AVAILABLE = "Not Available";
|
const FORWARD_SLASH = "/";
|
const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
|
const IMDS_VERSION = "2020-06-01";
|
const IMDS_TIMEOUT = 2000;
|
const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
|
const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
|
const KNOWN_PUBLIC_CLOUDS = [
|
"login.microsoftonline.com",
|
"login.windows.net",
|
"login.microsoft.com",
|
"sts.windows.net",
|
];
|
const INVALID_INSTANCE = "invalid_instance";
|
const HTTP_SUCCESS = 200;
|
const HTTP_REDIRECT = 302;
|
const HTTP_CLIENT_ERROR_RANGE_START = 400;
|
const HTTP_BAD_REQUEST = 400;
|
const HTTP_UNAUTHORIZED = 401;
|
const HTTP_NOT_FOUND = 404;
|
const HTTP_REQUEST_TIMEOUT = 408;
|
const HTTP_GONE = 410;
|
const HTTP_TOO_MANY_REQUESTS = 429;
|
const HTTP_CLIENT_ERROR_RANGE_END = 499;
|
const HTTP_SERVER_ERROR = 500;
|
const HTTP_SERVER_ERROR_RANGE_START = 500;
|
const HTTP_SERVICE_UNAVAILABLE = 503;
|
const HTTP_GATEWAY_TIMEOUT = 504;
|
const HTTP_SERVER_ERROR_RANGE_END = 599;
|
const OIDC_DEFAULT_SCOPES = [
|
OPENID_SCOPE,
|
PROFILE_SCOPE,
|
OFFLINE_ACCESS_SCOPE,
|
];
|
const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, EMAIL_SCOPE];
|
/**
|
* Request header names
|
*/
|
const HeaderNames = {
|
CONTENT_TYPE: "Content-Type",
|
CONTENT_LENGTH: "Content-Length",
|
RETRY_AFTER: "Retry-After",
|
CCS_HEADER: "X-AnchorMailbox",
|
WWWAuthenticate: "WWW-Authenticate",
|
AuthenticationInfo: "Authentication-Info",
|
X_MS_REQUEST_ID: "x-ms-request-id",
|
X_MS_HTTP_VERSION: "x-ms-httpver",
|
};
|
/**
|
* String constants related to AAD Authority
|
*/
|
const AADAuthority = {
|
COMMON: "common",
|
ORGANIZATIONS: "organizations",
|
CONSUMERS: "consumers",
|
};
|
/**
|
* Claims request keys
|
*/
|
const ClaimsRequestKeys = {
|
ACCESS_TOKEN: "access_token",
|
XMS_CC: "xms_cc",
|
};
|
/**
|
* we considered making this "enum" in the request instead of string, however it looks like the allowed list of
|
* prompt values kept changing over past couple of years. There are some undocumented prompt values for some
|
* internal partners too, hence the choice of generic "string" type instead of the "enum"
|
*/
|
const PromptValue$1 = {
|
LOGIN: "login",
|
SELECT_ACCOUNT: "select_account",
|
CONSENT: "consent",
|
NONE: "none",
|
CREATE: "create",
|
NO_SESSION: "no_session",
|
};
|
/**
|
* allowed values for codeVerifier
|
*/
|
const CodeChallengeMethodValues = {
|
S256: "S256",
|
};
|
/**
|
* Allowed values for response_type
|
*/
|
const OAuthResponseType = {
|
CODE: "code",
|
IDTOKEN_TOKEN: "id_token token"};
|
/**
|
* allowed values for response_mode
|
*/
|
const ResponseMode$1 = {
|
QUERY: "query",
|
FRAGMENT: "fragment",
|
FORM_POST: "form_post",
|
};
|
/**
|
* allowed grant_type
|
*/
|
const GrantType = {
|
AUTHORIZATION_CODE_GRANT: "authorization_code",
|
CLIENT_CREDENTIALS_GRANT: "client_credentials",
|
RESOURCE_OWNER_PASSWORD_GRANT: "password",
|
REFRESH_TOKEN_GRANT: "refresh_token",
|
DEVICE_CODE_GRANT: "device_code",
|
JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
|
};
|
/**
|
* Account types in Cache
|
*/
|
const CACHE_ACCOUNT_TYPE_MSSTS = "MSSTS";
|
const CACHE_ACCOUNT_TYPE_ADFS = "ADFS";
|
const CACHE_ACCOUNT_TYPE_GENERIC = "Generic";
|
/**
|
* Separators used in cache
|
*/
|
const CACHE_KEY_SEPARATOR = "-";
|
const CLIENT_INFO_SEPARATOR = ".";
|
/**
|
* Credential Type stored in the cache
|
*/
|
const CredentialType = {
|
ID_TOKEN: "IdToken",
|
ACCESS_TOKEN: "AccessToken",
|
ACCESS_TOKEN_WITH_AUTH_SCHEME: "AccessToken_With_AuthScheme",
|
REFRESH_TOKEN: "RefreshToken",
|
};
|
/**
|
* More Cache related constants
|
*/
|
const APP_METADATA = "appmetadata";
|
const CLIENT_INFO = "client_info";
|
const THE_FAMILY_ID = "1";
|
const AUTHORITY_METADATA_CACHE_KEY = "authority-metadata";
|
const AUTHORITY_METADATA_REFRESH_TIME_SECONDS = 3600 * 24; // 24 Hours
|
const AuthorityMetadataSource = {
|
CONFIG: "config",
|
CACHE: "cache",
|
NETWORK: "network",
|
HARDCODED_VALUES: "hardcoded_values",
|
};
|
const SERVER_TELEM_SCHEMA_VERSION = 5;
|
const SERVER_TELEM_MAX_LAST_HEADER_BYTES = 330; // ESTS limit is 350B, set to 330 to provide a 20B buffer,
|
const SERVER_TELEM_MAX_CACHED_ERRORS = 50; // Limit the number of errors that can be stored to prevent uncontrolled size gains
|
const SERVER_TELEM_CACHE_KEY = "server-telemetry";
|
const SERVER_TELEM_CATEGORY_SEPARATOR = "|";
|
const SERVER_TELEM_VALUE_SEPARATOR = ",";
|
const SERVER_TELEM_OVERFLOW_TRUE = "1";
|
const SERVER_TELEM_OVERFLOW_FALSE = "0";
|
const SERVER_TELEM_UNKNOWN_ERROR = "unknown_error";
|
/**
|
* Type of the authentication request
|
*/
|
const AuthenticationScheme = {
|
BEARER: "Bearer",
|
POP: "pop",
|
SSH: "ssh-cert",
|
};
|
/**
|
* Constants related to throttling
|
*/
|
const DEFAULT_THROTTLE_TIME_SECONDS = 60;
|
// Default maximum time to throttle in seconds, overrides what the server sends back
|
const DEFAULT_MAX_THROTTLE_TIME_SECONDS = 3600;
|
// Prefix for storing throttling entries
|
const THROTTLING_PREFIX = "throttling";
|
// Value assigned to the x-ms-lib-capability header to indicate to the server the library supports throttling
|
const X_MS_LIB_CAPABILITY_VALUE = "retry-after, h429";
|
/**
|
* Errors
|
*/
|
const INVALID_GRANT_ERROR = "invalid_grant";
|
const CLIENT_MISMATCH_ERROR = "client_mismatch";
|
/**
|
* Password grant parameters
|
*/
|
const PasswordGrantConstants = {
|
username: "username",
|
password: "password",
|
};
|
/**
|
* Region Discovery Sources
|
*/
|
const RegionDiscoverySources = {
|
FAILED_AUTO_DETECTION: "1",
|
INTERNAL_CACHE: "2",
|
ENVIRONMENT_VARIABLE: "3",
|
IMDS: "4",
|
};
|
/**
|
* Region Discovery Outcomes
|
*/
|
const RegionDiscoveryOutcomes = {
|
CONFIGURED_NO_AUTO_DETECTION: "2",
|
AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
|
AUTO_DETECTION_REQUESTED_FAILED: "5",
|
};
|
/**
|
* Specifies the reason for fetching the access token from the identity provider
|
*/
|
const CacheOutcome = {
|
// When a token is found in the cache or the cache is not supposed to be hit when making the request
|
NOT_APPLICABLE: "0",
|
// When the token request goes to the identity provider because force_refresh was set to true. Also occurs if claims were requested
|
FORCE_REFRESH_OR_CLAIMS: "1",
|
// When the token request goes to the identity provider because no cached access token exists
|
NO_CACHED_ACCESS_TOKEN: "2",
|
// When the token request goes to the identity provider because cached access token expired
|
CACHED_ACCESS_TOKEN_EXPIRED: "3",
|
// When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
|
PROACTIVELY_REFRESHED: "4",
|
};
|
// Token renewal offset default in seconds
|
const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
|
const EncodingTypes = {
|
BASE64: "base64",
|
HEX: "hex",
|
UTF8: "utf-8",
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const CLIENT_ID = "client_id";
|
const REDIRECT_URI = "redirect_uri";
|
const RESPONSE_TYPE = "response_type";
|
const RESPONSE_MODE = "response_mode";
|
const GRANT_TYPE = "grant_type";
|
const CLAIMS = "claims";
|
const SCOPE = "scope";
|
const REFRESH_TOKEN = "refresh_token";
|
const STATE = "state";
|
const NONCE = "nonce";
|
const PROMPT = "prompt";
|
const CODE = "code";
|
const CODE_CHALLENGE = "code_challenge";
|
const CODE_CHALLENGE_METHOD = "code_challenge_method";
|
const CODE_VERIFIER = "code_verifier";
|
const CLIENT_REQUEST_ID = "client-request-id";
|
const X_CLIENT_SKU = "x-client-SKU";
|
const X_CLIENT_VER = "x-client-VER";
|
const X_CLIENT_OS = "x-client-OS";
|
const X_CLIENT_CPU = "x-client-CPU";
|
const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
|
const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
|
const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
|
const X_APP_NAME = "x-app-name";
|
const X_APP_VER = "x-app-ver";
|
const POST_LOGOUT_URI = "post_logout_redirect_uri";
|
const ID_TOKEN_HINT = "id_token_hint";
|
const DEVICE_CODE = "device_code";
|
const CLIENT_SECRET = "client_secret";
|
const CLIENT_ASSERTION = "client_assertion";
|
const CLIENT_ASSERTION_TYPE = "client_assertion_type";
|
const TOKEN_TYPE = "token_type";
|
const REQ_CNF = "req_cnf";
|
const OBO_ASSERTION = "assertion";
|
const REQUESTED_TOKEN_USE = "requested_token_use";
|
const ON_BEHALF_OF = "on_behalf_of";
|
const RETURN_SPA_CODE = "return_spa_code";
|
const LOGOUT_HINT = "logout_hint";
|
const SID = "sid";
|
const LOGIN_HINT = "login_hint";
|
const DOMAIN_HINT = "domain_hint";
|
const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
|
const BROKER_CLIENT_ID = "brk_client_id";
|
const BROKER_REDIRECT_URI = "brk_redirect_uri";
|
const INSTANCE_AWARE = "instance_aware";
|
const RESOURCE = "resource";
|
const CLI_DATA = "clidata";
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
function getDefaultErrorMessage(code) {
|
return `See https://aka.ms/msal.js.errors#${code} for details`;
|
}
|
/**
|
* General error class thrown by the MSAL.js library.
|
*/
|
class AuthError extends Error {
|
constructor(errorCode, errorMessage, suberror) {
|
const message = errorMessage ||
|
(errorCode ? getDefaultErrorMessage(errorCode) : "");
|
const errorString = message ? `${errorCode}: ${message}` : errorCode;
|
super(errorString);
|
Object.setPrototypeOf(this, AuthError.prototype);
|
this.errorCode = errorCode || "";
|
this.errorMessage = message || "";
|
this.subError = suberror || "";
|
this.name = "AuthError";
|
}
|
setCorrelationId(correlationId) {
|
this.correlationId = correlationId;
|
}
|
}
|
function createAuthError(code, additionalMessage) {
|
return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Error thrown when there is an error in configuration of the MSAL.js library.
|
*/
|
class ClientConfigurationError extends AuthError {
|
constructor(errorCode) {
|
super(errorCode);
|
this.name = "ClientConfigurationError";
|
Object.setPrototypeOf(this, ClientConfigurationError.prototype);
|
}
|
}
|
function createClientConfigurationError(errorCode) {
|
return new ClientConfigurationError(errorCode);
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* @hidden
|
*/
|
class StringUtils {
|
/**
|
* Check if stringified object is empty
|
* @param strObj
|
*/
|
static isEmptyObj(strObj) {
|
if (strObj) {
|
try {
|
const obj = JSON.parse(strObj);
|
return Object.keys(obj).length === 0;
|
}
|
catch (e) { }
|
}
|
return true;
|
}
|
static startsWith(str, search) {
|
return str.indexOf(search) === 0;
|
}
|
static endsWith(str, search) {
|
return (str.length >= search.length &&
|
str.lastIndexOf(search) === str.length - search.length);
|
}
|
/**
|
* Parses string into an object.
|
*
|
* @param query
|
*/
|
static queryStringToObject(query) {
|
const obj = {};
|
const params = query.split("&");
|
const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
|
params.forEach((pair) => {
|
if (pair.trim()) {
|
const [key, value] = pair.split(/=(.+)/g, 2); // Split on the first occurence of the '=' character
|
if (key && value) {
|
obj[decode(key)] = decode(value);
|
}
|
}
|
});
|
return obj;
|
}
|
/**
|
* Trims entries in an array.
|
*
|
* @param arr
|
*/
|
static trimArrayEntries(arr) {
|
return arr.map((entry) => entry.trim());
|
}
|
/**
|
* Removes empty strings from array
|
* @param arr
|
*/
|
static removeEmptyStringsFromArray(arr) {
|
return arr.filter((entry) => {
|
return !!entry;
|
});
|
}
|
/**
|
* Attempts to parse a string into JSON
|
* @param str
|
*/
|
static jsonParseHelper(str) {
|
try {
|
return JSON.parse(str);
|
}
|
catch (e) {
|
return null;
|
}
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* ClientAuthErrorMessage class containing string constants used by error codes and messages.
|
*/
|
/**
|
* Error thrown when there is an error in the client code running on the browser.
|
*/
|
class ClientAuthError extends AuthError {
|
constructor(errorCode, additionalMessage) {
|
super(errorCode, additionalMessage);
|
this.name = "ClientAuthError";
|
Object.setPrototypeOf(this, ClientAuthError.prototype);
|
}
|
}
|
function createClientAuthError(errorCode, additionalMessage) {
|
return new ClientAuthError(errorCode, additionalMessage);
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const redirectUriEmpty = "redirect_uri_empty";
|
const claimsRequestParsingError = "claims_request_parsing_error";
|
const authorityUriInsecure = "authority_uri_insecure";
|
const urlParseError = "url_parse_error";
|
const urlEmptyError = "empty_url_error";
|
const emptyInputScopesError = "empty_input_scopes_error";
|
const invalidClaims = "invalid_claims";
|
const tokenRequestEmpty = "token_request_empty";
|
const logoutRequestEmpty = "logout_request_empty";
|
const invalidCodeChallengeMethod = "invalid_code_challenge_method";
|
const pkceParamsMissing = "pkce_params_missing";
|
const invalidCloudDiscoveryMetadata = "invalid_cloud_discovery_metadata";
|
const invalidAuthorityMetadata = "invalid_authority_metadata";
|
const untrustedAuthority = "untrusted_authority";
|
const missingSshJwk = "missing_ssh_jwk";
|
const missingSshKid = "missing_ssh_kid";
|
const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
|
const invalidAuthenticationHeader = "invalid_authentication_header";
|
const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
|
const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
|
const authorityMismatch = "authority_mismatch";
|
const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
|
|
var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
|
__proto__: null,
|
authorityMismatch: authorityMismatch,
|
authorityUriInsecure: authorityUriInsecure,
|
cannotAllowPlatformBroker: cannotAllowPlatformBroker,
|
cannotSetOIDCOptions: cannotSetOIDCOptions,
|
claimsRequestParsingError: claimsRequestParsingError,
|
emptyInputScopesError: emptyInputScopesError,
|
invalidAuthenticationHeader: invalidAuthenticationHeader,
|
invalidAuthorityMetadata: invalidAuthorityMetadata,
|
invalidClaims: invalidClaims,
|
invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
|
invalidCodeChallengeMethod: invalidCodeChallengeMethod,
|
invalidRequestMethodForEAR: invalidRequestMethodForEAR,
|
logoutRequestEmpty: logoutRequestEmpty,
|
missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
|
missingSshJwk: missingSshJwk,
|
missingSshKid: missingSshKid,
|
pkceParamsMissing: pkceParamsMissing,
|
redirectUriEmpty: redirectUriEmpty,
|
tokenRequestEmpty: tokenRequestEmpty,
|
untrustedAuthority: untrustedAuthority,
|
urlEmptyError: urlEmptyError,
|
urlParseError: urlParseError
|
});
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const clientInfoDecodingError = "client_info_decoding_error";
|
const clientInfoEmptyError = "client_info_empty_error";
|
const tokenParsingError = "token_parsing_error";
|
const nullOrEmptyToken = "null_or_empty_token";
|
const endpointResolutionError = "endpoints_resolution_error";
|
const networkError = "network_error";
|
const openIdConfigError = "openid_config_error";
|
const hashNotDeserialized = "hash_not_deserialized";
|
const invalidState = "invalid_state";
|
const stateMismatch = "state_mismatch";
|
const stateNotFound = "state_not_found";
|
const nonceMismatch = "nonce_mismatch";
|
const authTimeNotFound = "auth_time_not_found";
|
const maxAgeTranspired = "max_age_transpired";
|
const multipleMatchingTokens = "multiple_matching_tokens";
|
const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
|
const requestCannotBeMade = "request_cannot_be_made";
|
const cannotRemoveEmptyScope = "cannot_remove_empty_scope";
|
const cannotAppendScopeSet = "cannot_append_scopeset";
|
const emptyInputScopeSet = "empty_input_scopeset";
|
const noAccountInSilentRequest = "no_account_in_silent_request";
|
const invalidCacheRecord = "invalid_cache_record";
|
const invalidCacheEnvironment = "invalid_cache_environment";
|
const noAccountFound = "no_account_found";
|
const noCryptoObject = "no_crypto_object";
|
const unexpectedCredentialType = "unexpected_credential_type";
|
const tokenRefreshRequired = "token_refresh_required";
|
const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
|
const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
|
const bindingKeyNotRemoved = "binding_key_not_removed";
|
const endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
|
const keyIdMissing = "key_id_missing";
|
const noNetworkConnectivity = "no_network_connectivity";
|
const userCanceled = "user_canceled";
|
const methodNotImplemented = "method_not_implemented";
|
const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
|
const platformBrokerError = "platform_broker_error";
|
const resourceParameterRequired = "resource_parameter_required";
|
const misplacedResourceParam = "misplaced_resource_parameter";
|
|
var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
|
__proto__: null,
|
authTimeNotFound: authTimeNotFound,
|
authorizationCodeMissingFromServerResponse: authorizationCodeMissingFromServerResponse,
|
bindingKeyNotRemoved: bindingKeyNotRemoved,
|
cannotAppendScopeSet: cannotAppendScopeSet,
|
cannotRemoveEmptyScope: cannotRemoveEmptyScope,
|
clientInfoDecodingError: clientInfoDecodingError,
|
clientInfoEmptyError: clientInfoEmptyError,
|
emptyInputScopeSet: emptyInputScopeSet,
|
endSessionEndpointNotSupported: endSessionEndpointNotSupported,
|
endpointResolutionError: endpointResolutionError,
|
hashNotDeserialized: hashNotDeserialized,
|
invalidCacheEnvironment: invalidCacheEnvironment,
|
invalidCacheRecord: invalidCacheRecord,
|
invalidState: invalidState,
|
keyIdMissing: keyIdMissing,
|
maxAgeTranspired: maxAgeTranspired,
|
methodNotImplemented: methodNotImplemented,
|
misplacedResourceParam: misplacedResourceParam,
|
multipleMatchingAppMetadata: multipleMatchingAppMetadata,
|
multipleMatchingTokens: multipleMatchingTokens,
|
nestedAppAuthBridgeDisabled: nestedAppAuthBridgeDisabled,
|
networkError: networkError,
|
noAccountFound: noAccountFound,
|
noAccountInSilentRequest: noAccountInSilentRequest,
|
noCryptoObject: noCryptoObject,
|
noNetworkConnectivity: noNetworkConnectivity,
|
nonceMismatch: nonceMismatch,
|
nullOrEmptyToken: nullOrEmptyToken,
|
openIdConfigError: openIdConfigError,
|
platformBrokerError: platformBrokerError,
|
requestCannotBeMade: requestCannotBeMade,
|
resourceParameterRequired: resourceParameterRequired,
|
stateMismatch: stateMismatch,
|
stateNotFound: stateNotFound,
|
tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,
|
tokenParsingError: tokenParsingError,
|
tokenRefreshRequired: tokenRefreshRequired,
|
unexpectedCredentialType: unexpectedCredentialType,
|
userCanceled: userCanceled
|
});
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
|
* the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
|
* to ensure uniqueness of strings.
|
*/
|
class ScopeSet {
|
constructor(inputScopes) {
|
// Filter empty string and null/undefined array items
|
const scopeArr = inputScopes
|
? StringUtils.trimArrayEntries([...inputScopes])
|
: [];
|
const filteredInput = scopeArr
|
? StringUtils.removeEmptyStringsFromArray(scopeArr)
|
: [];
|
// Check if scopes array has at least one member
|
if (!filteredInput || !filteredInput.length) {
|
throw createClientConfigurationError(emptyInputScopesError);
|
}
|
this.scopes = new Set(); // Iterator in constructor not supported by IE11
|
filteredInput.forEach((scope) => this.scopes.add(scope));
|
}
|
/**
|
* Factory method to create ScopeSet from space-delimited string
|
* @param inputScopeString
|
* @param appClientId
|
* @param scopesRequired
|
*/
|
static fromString(inputScopeString) {
|
const scopeString = inputScopeString || "";
|
const inputScopes = scopeString.split(" ");
|
return new ScopeSet(inputScopes);
|
}
|
/**
|
* Creates the set of scopes to search for in cache lookups
|
* @param inputScopeString
|
* @returns
|
*/
|
static createSearchScopes(inputScopeString) {
|
// Handle empty scopes by using default OIDC scopes for cache lookup
|
const scopesToUse = inputScopeString && inputScopeString.length > 0
|
? inputScopeString
|
: [...OIDC_DEFAULT_SCOPES];
|
const scopeSet = new ScopeSet(scopesToUse);
|
if (!scopeSet.containsOnlyOIDCScopes()) {
|
scopeSet.removeOIDCScopes();
|
}
|
else {
|
scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
|
}
|
return scopeSet;
|
}
|
/**
|
* Check if a given scope is present in this set of scopes.
|
* @param scope
|
*/
|
containsScope(scope) {
|
const lowerCaseScopes = this.printScopesLowerCase().split(" ");
|
const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
|
// compare lowercase scopes
|
return scope
|
? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
|
: false;
|
}
|
/**
|
* Check if a set of scopes is present in this set of scopes.
|
* @param scopeSet
|
*/
|
containsScopeSet(scopeSet) {
|
if (!scopeSet || scopeSet.scopes.size <= 0) {
|
return false;
|
}
|
return (this.scopes.size >= scopeSet.scopes.size &&
|
scopeSet.asArray().every((scope) => this.containsScope(scope)));
|
}
|
/**
|
* Check if set of scopes contains only the defaults
|
*/
|
containsOnlyOIDCScopes() {
|
let defaultScopeCount = 0;
|
OIDC_SCOPES.forEach((defaultScope) => {
|
if (this.containsScope(defaultScope)) {
|
defaultScopeCount += 1;
|
}
|
});
|
return this.scopes.size === defaultScopeCount;
|
}
|
/**
|
* Appends single scope if passed
|
* @param newScope
|
*/
|
appendScope(newScope) {
|
if (newScope) {
|
this.scopes.add(newScope.trim());
|
}
|
}
|
/**
|
* Appends multiple scopes if passed
|
* @param newScopes
|
*/
|
appendScopes(newScopes) {
|
try {
|
newScopes.forEach((newScope) => this.appendScope(newScope));
|
}
|
catch (e) {
|
throw createClientAuthError(cannotAppendScopeSet);
|
}
|
}
|
/**
|
* Removes element from set of scopes.
|
* @param scope
|
*/
|
removeScope(scope) {
|
if (!scope) {
|
throw createClientAuthError(cannotRemoveEmptyScope);
|
}
|
this.scopes.delete(scope.trim());
|
}
|
/**
|
* Removes default scopes from set of scopes
|
* Primarily used to prevent cache misses if the default scopes are not returned from the server
|
*/
|
removeOIDCScopes() {
|
OIDC_SCOPES.forEach((defaultScope) => {
|
this.scopes.delete(defaultScope);
|
});
|
}
|
/**
|
* Combines an array of scopes with the current set of scopes.
|
* @param otherScopes
|
*/
|
unionScopeSets(otherScopes) {
|
if (!otherScopes) {
|
throw createClientAuthError(emptyInputScopeSet);
|
}
|
const unionScopes = new Set(); // Iterator in constructor not supported in IE11
|
otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
|
this.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
|
return unionScopes;
|
}
|
/**
|
* Check if scopes intersect between this set and another.
|
* @param otherScopes
|
*/
|
intersectingScopeSets(otherScopes) {
|
if (!otherScopes) {
|
throw createClientAuthError(emptyInputScopeSet);
|
}
|
// Do not allow OIDC scopes to be the only intersecting scopes
|
if (!otherScopes.containsOnlyOIDCScopes()) {
|
otherScopes.removeOIDCScopes();
|
}
|
const unionScopes = this.unionScopeSets(otherScopes);
|
const sizeOtherScopes = otherScopes.getScopeCount();
|
const sizeThisScopes = this.getScopeCount();
|
const sizeUnionScopes = unionScopes.size;
|
return sizeUnionScopes < sizeThisScopes + sizeOtherScopes;
|
}
|
/**
|
* Returns size of set of scopes.
|
*/
|
getScopeCount() {
|
return this.scopes.size;
|
}
|
/**
|
* Returns the scopes as an array of string values
|
*/
|
asArray() {
|
const array = [];
|
this.scopes.forEach((val) => array.push(val));
|
return array;
|
}
|
/**
|
* Prints scopes into a space-delimited string
|
*/
|
printScopes() {
|
if (this.scopes) {
|
const scopeArr = this.asArray();
|
return scopeArr.join(" ");
|
}
|
return "";
|
}
|
/**
|
* Prints scopes into a space-delimited lower-case string (used for caching)
|
*/
|
printScopesLowerCase() {
|
return this.printScopes().toLowerCase();
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
function instrumentBrokerParams(parameters, correlationId, performanceClient) {
|
if (!correlationId) {
|
return;
|
}
|
const clientId = parameters.get(CLIENT_ID);
|
if (clientId && parameters.has(BROKER_CLIENT_ID)) {
|
performanceClient?.addFields({
|
embeddedClientId: clientId,
|
embeddedRedirectUri: parameters.get(REDIRECT_URI),
|
}, correlationId);
|
}
|
}
|
/**
|
* Add the given response_type
|
* @param parameters
|
* @param responseType
|
*/
|
function addResponseType(parameters, responseType) {
|
parameters.set(RESPONSE_TYPE, responseType);
|
}
|
/**
|
* add response_mode. defaults to query.
|
* @param responseMode
|
*/
|
function addResponseMode(parameters, responseMode) {
|
parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode$1.QUERY);
|
}
|
/**
|
* add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
|
* @param scopeSet
|
* @param addOidcScopes
|
*/
|
function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
|
// Always add openid to the scopes when adding OIDC scopes
|
if (addOidcScopes &&
|
!defaultScopes.includes("openid") &&
|
!scopes.includes("openid")) {
|
defaultScopes.push("openid");
|
}
|
const requestScopes = addOidcScopes
|
? [...(scopes || []), ...defaultScopes]
|
: scopes || [];
|
const scopeSet = new ScopeSet(requestScopes);
|
parameters.set(SCOPE, scopeSet.printScopes());
|
}
|
/**
|
* add clientId
|
* @param clientId
|
*/
|
function addClientId(parameters, clientId) {
|
parameters.set(CLIENT_ID, clientId);
|
}
|
/**
|
* add redirect_uri
|
* @param redirectUri
|
*/
|
function addRedirectUri(parameters, redirectUri) {
|
parameters.set(REDIRECT_URI, redirectUri);
|
}
|
/**
|
* add post logout redirectUri
|
* @param redirectUri
|
*/
|
function addPostLogoutRedirectUri(parameters, redirectUri) {
|
parameters.set(POST_LOGOUT_URI, redirectUri);
|
}
|
/**
|
* add id_token_hint to logout request
|
* @param idTokenHint
|
*/
|
function addIdTokenHint(parameters, idTokenHint) {
|
parameters.set(ID_TOKEN_HINT, idTokenHint);
|
}
|
/**
|
* add domain_hint
|
* @param domainHint
|
*/
|
function addDomainHint(parameters, domainHint) {
|
parameters.set(DOMAIN_HINT, domainHint);
|
}
|
/**
|
* add login_hint
|
* @param loginHint
|
*/
|
function addLoginHint(parameters, loginHint) {
|
parameters.set(LOGIN_HINT, loginHint);
|
}
|
/**
|
* Adds the CCS (Cache Credential Service) query parameter for login_hint
|
* @param loginHint
|
*/
|
function addCcsUpn(parameters, loginHint) {
|
parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
|
}
|
/**
|
* Adds the CCS (Cache Credential Service) query parameter for account object
|
* @param loginHint
|
*/
|
function addCcsOid(parameters, clientInfo) {
|
parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
|
}
|
/**
|
* add sid
|
* @param sid
|
*/
|
function addSid(parameters, sid) {
|
parameters.set(SID, sid);
|
}
|
/**
|
* Adds claims to request parameters, conditionally excluding clientCapabilities
|
* when skipBrokerClaims is true and a brokered flow is in effect.
|
* @param parameters - The request parameters map
|
* @param claims - The claims string from the request
|
* @param clientCapabilities - The client capabilities from configuration
|
* @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
|
*/
|
function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
|
// Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
|
const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
|
? undefined
|
: clientCapabilities;
|
if (!StringUtils.isEmptyObj(claims) ||
|
(configClaims && configClaims.length > 0)) {
|
const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
|
try {
|
JSON.parse(mergedClaims);
|
}
|
catch (e) {
|
throw createClientConfigurationError(invalidClaims);
|
}
|
parameters.set(CLAIMS, mergedClaims);
|
}
|
}
|
/**
|
* add correlationId
|
* @param correlationId
|
*/
|
function addCorrelationId(parameters, correlationId) {
|
parameters.set(CLIENT_REQUEST_ID, correlationId);
|
}
|
/**
|
* add library info query params
|
* @param libraryInfo
|
*/
|
function addLibraryInfo(parameters, libraryInfo) {
|
// Telemetry Info
|
parameters.set(X_CLIENT_SKU, libraryInfo.sku);
|
parameters.set(X_CLIENT_VER, libraryInfo.version);
|
if (libraryInfo.os) {
|
parameters.set(X_CLIENT_OS, libraryInfo.os);
|
}
|
if (libraryInfo.cpu) {
|
parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
|
}
|
}
|
/**
|
* Add client telemetry parameters
|
* @param appTelemetry
|
*/
|
function addApplicationTelemetry(parameters, appTelemetry) {
|
if (appTelemetry?.appName) {
|
parameters.set(X_APP_NAME, appTelemetry.appName);
|
}
|
if (appTelemetry?.appVersion) {
|
parameters.set(X_APP_VER, appTelemetry.appVersion);
|
}
|
}
|
/**
|
* add prompt
|
* @param prompt
|
*/
|
function addPrompt(parameters, prompt) {
|
parameters.set(PROMPT, prompt);
|
}
|
/**
|
* add state
|
* @param state
|
*/
|
function addState(parameters, state) {
|
if (state) {
|
parameters.set(STATE, state);
|
}
|
}
|
/**
|
* add nonce
|
* @param nonce
|
*/
|
function addNonce(parameters, nonce) {
|
parameters.set(NONCE, nonce);
|
}
|
/**
|
* add code_challenge and code_challenge_method
|
* - throw if either of them are not passed
|
* @param codeChallenge
|
* @param codeChallengeMethod
|
*/
|
function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
|
if (codeChallenge && codeChallengeMethod) {
|
parameters.set(CODE_CHALLENGE, codeChallenge);
|
parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
|
}
|
else {
|
throw createClientConfigurationError(pkceParamsMissing);
|
}
|
}
|
/**
|
* add the `authorization_code` passed by the user to exchange for a token
|
* @param code
|
*/
|
function addAuthorizationCode(parameters, code) {
|
parameters.set(CODE, code);
|
}
|
/**
|
* add the `authorization_code` passed by the user to exchange for a token
|
* @param code
|
*/
|
function addDeviceCode(parameters, code) {
|
parameters.set(DEVICE_CODE, code);
|
}
|
/**
|
* add the `refreshToken` passed by the user
|
* @param refreshToken
|
*/
|
function addRefreshToken(parameters, refreshToken) {
|
parameters.set(REFRESH_TOKEN, refreshToken);
|
}
|
/**
|
* add the `code_verifier` passed by the user to exchange for a token
|
* @param codeVerifier
|
*/
|
function addCodeVerifier(parameters, codeVerifier) {
|
parameters.set(CODE_VERIFIER, codeVerifier);
|
}
|
/**
|
* add client_secret
|
* @param clientSecret
|
*/
|
function addClientSecret(parameters, clientSecret) {
|
parameters.set(CLIENT_SECRET, clientSecret);
|
}
|
/**
|
* add clientAssertion for confidential client flows
|
* @param clientAssertion
|
*/
|
function addClientAssertion(parameters, clientAssertion) {
|
if (clientAssertion) {
|
parameters.set(CLIENT_ASSERTION, clientAssertion);
|
}
|
}
|
/**
|
* add clientAssertionType for confidential client flows
|
* @param clientAssertionType
|
*/
|
function addClientAssertionType(parameters, clientAssertionType) {
|
if (clientAssertionType) {
|
parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
|
}
|
}
|
/**
|
* add OBO assertion for confidential client flows
|
* @param clientAssertion
|
*/
|
function addOboAssertion(parameters, oboAssertion) {
|
parameters.set(OBO_ASSERTION, oboAssertion);
|
}
|
/**
|
* add grant type
|
* @param grantType
|
*/
|
function addRequestTokenUse(parameters, tokenUse) {
|
parameters.set(REQUESTED_TOKEN_USE, tokenUse);
|
}
|
/**
|
* add grant type
|
* @param grantType
|
*/
|
function addGrantType(parameters, grantType) {
|
parameters.set(GRANT_TYPE, grantType);
|
}
|
/**
|
* add client info
|
*
|
*/
|
function addClientInfo(parameters) {
|
parameters.set(CLIENT_INFO, "1");
|
}
|
/**
|
* add clidata=1 to request to indicate client data support
|
*/
|
function addCliData(parameters) {
|
parameters.set(CLI_DATA, "1");
|
}
|
function addInstanceAware(parameters) {
|
if (!parameters.has(INSTANCE_AWARE)) {
|
parameters.set(INSTANCE_AWARE, "true");
|
}
|
}
|
/**
|
* Add extraParameters
|
* @param extraParams - String dictionary containing extra parameters to be added.
|
*/
|
function addExtraParameters(parameters, extraParams) {
|
Object.entries(extraParams).forEach(([key, value]) => {
|
if (!parameters.has(key) && value) {
|
parameters.set(key, value);
|
}
|
});
|
}
|
function addClientCapabilitiesToClaims(claims, clientCapabilities) {
|
let mergedClaims;
|
// Parse provided claims into JSON object or initialize empty object
|
if (!claims) {
|
mergedClaims = {};
|
}
|
else {
|
try {
|
mergedClaims = JSON.parse(claims);
|
}
|
catch (e) {
|
throw createClientConfigurationError(invalidClaims);
|
}
|
}
|
if (clientCapabilities && clientCapabilities.length > 0) {
|
if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
|
// Add access_token key to claims object
|
mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
|
}
|
// Add xms_cc claim with provided clientCapabilities to access_token key
|
mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
|
values: clientCapabilities,
|
};
|
}
|
return JSON.stringify(mergedClaims);
|
}
|
/**
|
* adds `username` for Password Grant flow
|
* @param username
|
*/
|
function addUsername(parameters, username) {
|
parameters.set(PasswordGrantConstants.username, username);
|
}
|
/**
|
* adds `password` for Password Grant flow
|
* @param password
|
*/
|
function addPassword(parameters, password) {
|
parameters.set(PasswordGrantConstants.password, password);
|
}
|
/**
|
* add pop_jwk to query params
|
* @param cnfString
|
*/
|
function addPopToken(parameters, cnfString) {
|
if (cnfString) {
|
parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
|
parameters.set(REQ_CNF, cnfString);
|
}
|
}
|
/**
|
* add SSH JWK and key ID to query params
|
*/
|
function addSshJwk(parameters, sshJwkString) {
|
if (sshJwkString) {
|
parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
|
parameters.set(REQ_CNF, sshJwkString);
|
}
|
}
|
/**
|
* add server telemetry fields
|
* @param serverTelemetryManager
|
*/
|
function addServerTelemetry(parameters, serverTelemetryManager) {
|
parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
|
parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
|
}
|
/**
|
* Adds parameter that indicates to the server that throttling is supported
|
*/
|
function addThrottling(parameters) {
|
parameters.set(X_MS_LIB_CAPABILITY, X_MS_LIB_CAPABILITY_VALUE);
|
}
|
/**
|
* Adds logout_hint parameter for "silent" logout which prevent server account picker
|
*/
|
function addLogoutHint(parameters, logoutHint) {
|
parameters.set(LOGOUT_HINT, logoutHint);
|
}
|
function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
|
if (!parameters.has(BROKER_CLIENT_ID)) {
|
parameters.set(BROKER_CLIENT_ID, brokerClientId);
|
}
|
if (!parameters.has(BROKER_REDIRECT_URI)) {
|
parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
|
}
|
}
|
function addResource(parameters, resource) {
|
if (resource) {
|
parameters.set(RESOURCE, resource);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/**
|
* Parses hash string from given string. Returns empty string if no hash symbol is found.
|
* @param hashString
|
*/
|
function stripLeadingHashOrQuery(responseString) {
|
if (responseString.startsWith("#/")) {
|
return responseString.substring(2);
|
}
|
else if (responseString.startsWith("#") ||
|
responseString.startsWith("?")) {
|
return responseString.substring(1);
|
}
|
return responseString;
|
}
|
/**
|
* Returns URL hash as server auth code response object.
|
*/
|
function getDeserializedResponse(responseString) {
|
// Check if given hash is empty
|
if (!responseString || responseString.indexOf("=") < 0) {
|
return null;
|
}
|
try {
|
// Strip the # or ? symbol if present
|
const normalizedResponse = stripLeadingHashOrQuery(responseString);
|
// If # symbol was not present, above will return empty string, so give original hash value
|
const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
|
// Check for known response properties
|
if (deserializedHash.code ||
|
deserializedHash.ear_jwe ||
|
deserializedHash.error ||
|
deserializedHash.error_description ||
|
deserializedHash.state) {
|
return deserializedHash;
|
}
|
}
|
catch (e) {
|
throw createClientAuthError(hashNotDeserialized);
|
}
|
return null;
|
}
|
/**
|
* Utility to create a URL from the params map
|
*/
|
function mapToQueryString(parameters) {
|
const queryParameterArray = new Array();
|
parameters.forEach((value, key) => {
|
queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
|
});
|
return queryParameterArray.join("&");
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const DEFAULT_CRYPTO_IMPLEMENTATION = {
|
createNewGuid: () => {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
base64Decode: () => {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
base64Encode: () => {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
base64UrlEncode: () => {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
encodeKid: () => {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
async getPublicKeyThumbprint() {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
async removeTokenBindingKey() {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
async clearKeystore() {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
async signJwt() {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
async hashString() {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Log message level.
|
*/
|
exports.LogLevel = void 0;
|
(function (LogLevel) {
|
LogLevel[LogLevel["Error"] = 0] = "Error";
|
LogLevel[LogLevel["Warning"] = 1] = "Warning";
|
LogLevel[LogLevel["Info"] = 2] = "Info";
|
LogLevel[LogLevel["Verbose"] = 3] = "Verbose";
|
LogLevel[LogLevel["Trace"] = 4] = "Trace";
|
})(exports.LogLevel || (exports.LogLevel = {}));
|
// Shared cache state for better minification - using Map's insertion order for LRU
|
const CACHE_CAPACITY = 50;
|
const MAX_LOGS_PER_CORRELATION = 500;
|
const correlationCache = new Map();
|
/**
|
* Mark correlation ID as recently used by moving it to end of Map
|
* @param correlationId
|
* @param {CorrelationLogData} data
|
*/
|
function markAsRecentlyUsed(correlationId, data) {
|
correlationCache.delete(correlationId);
|
correlationCache.set(correlationId, data);
|
}
|
/**
|
* Add log message to cache for specific correlation ID
|
* @param correlationId
|
* @param {LoggedMessage} loggedMessage
|
*/
|
function addLogToCache(correlationId, loggedMessage) {
|
const currentTime = Date.now();
|
let data = correlationCache.get(correlationId);
|
if (data) {
|
// Mark as recently used
|
markAsRecentlyUsed(correlationId, data);
|
}
|
else {
|
// Create new entry
|
data = { logs: [], firstEventTime: currentTime };
|
correlationCache.set(correlationId, data);
|
// Remove LRU (first entry) if capacity exceeded
|
if (correlationCache.size > CACHE_CAPACITY) {
|
const firstKey = correlationCache.keys().next().value;
|
if (firstKey) {
|
correlationCache.delete(firstKey);
|
}
|
}
|
}
|
// Add log to the data, maintaining max logs per correlation
|
data.logs.push({
|
...loggedMessage,
|
milliseconds: currentTime - data.firstEventTime,
|
});
|
if (data.logs.length > MAX_LOGS_PER_CORRELATION) {
|
data.logs.shift(); // Remove oldest log
|
}
|
}
|
/**
|
* Checks if a string is already a hashed logging string (6 alphanumeric characters)
|
*/
|
function isHashedString(str) {
|
if (str.length !== 6) {
|
return false;
|
}
|
for (let i = 0; i < str.length; i++) {
|
const char = str[i];
|
const isAlphaNumeric = (char >= "a" && char <= "z") ||
|
(char >= "A" && char <= "Z") ||
|
(char >= "0" && char <= "9");
|
if (!isAlphaNumeric) {
|
return false;
|
}
|
}
|
return true;
|
}
|
/**
|
* Class which facilitates logging of messages to a specific place.
|
*/
|
class Logger {
|
constructor(loggerOptions, packageName, packageVersion) {
|
// Current log level, defaults to info.
|
this.level = exports.LogLevel.Info;
|
const defaultLoggerCallback = () => {
|
return;
|
};
|
const setLoggerOptions = loggerOptions || Logger.createDefaultLoggerOptions();
|
this.localCallback =
|
setLoggerOptions.loggerCallback || defaultLoggerCallback;
|
this.piiLoggingEnabled = setLoggerOptions.piiLoggingEnabled || false;
|
this.level =
|
typeof setLoggerOptions.logLevel === "number"
|
? setLoggerOptions.logLevel
|
: exports.LogLevel.Info;
|
this.packageName = packageName || "";
|
this.packageVersion = packageVersion || "";
|
}
|
static createDefaultLoggerOptions() {
|
return {
|
loggerCallback: () => {
|
// allow users to not set loggerCallback
|
},
|
piiLoggingEnabled: false,
|
logLevel: exports.LogLevel.Info,
|
};
|
}
|
/**
|
* Create new Logger with existing configurations.
|
*/
|
clone(packageName, packageVersion) {
|
return new Logger({
|
loggerCallback: this.localCallback,
|
piiLoggingEnabled: this.piiLoggingEnabled,
|
logLevel: this.level,
|
}, packageName, packageVersion);
|
}
|
/**
|
* Log message with required options.
|
*/
|
logMessage(logMessage, options) {
|
const correlationId = options.correlationId;
|
const isHashedInput = isHashedString(logMessage);
|
if (isHashedInput) {
|
const loggedMessage = {
|
hash: logMessage,
|
level: options.logLevel,
|
containsPii: options.containsPii || false,
|
milliseconds: 0, // Will be calculated in addLogToCache
|
};
|
addLogToCache(correlationId, loggedMessage);
|
}
|
if (options.logLevel > this.level ||
|
(!this.piiLoggingEnabled && options.containsPii)) {
|
return;
|
}
|
const timestamp = new Date().toUTCString();
|
// Add correlationId to logs if set, correlationId provided on log messages take precedence
|
const logHeader = `[${timestamp}] : [${correlationId}]`;
|
const log = `${logHeader} : ${this.packageName}@${this.packageVersion} : ${exports.LogLevel[options.logLevel]} - ${logMessage}`;
|
this.executeCallback(options.logLevel, log, options.containsPii || false);
|
}
|
/**
|
* Execute callback with message.
|
*/
|
executeCallback(level, message, containsPii) {
|
if (this.localCallback) {
|
this.localCallback(level, message, containsPii);
|
}
|
}
|
/**
|
* Logs error messages.
|
*/
|
error(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Error,
|
containsPii: false,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs error messages with PII.
|
*/
|
errorPii(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Error,
|
containsPii: true,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs warning messages.
|
*/
|
warning(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Warning,
|
containsPii: false,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs warning messages with PII.
|
*/
|
warningPii(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Warning,
|
containsPii: true,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs info messages.
|
*/
|
info(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Info,
|
containsPii: false,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs info messages with PII.
|
*/
|
infoPii(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Info,
|
containsPii: true,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs verbose messages.
|
*/
|
verbose(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Verbose,
|
containsPii: false,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs verbose messages with PII.
|
*/
|
verbosePii(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Verbose,
|
containsPii: true,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs trace messages.
|
*/
|
trace(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Trace,
|
containsPii: false,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Logs trace messages with PII.
|
*/
|
tracePii(message, correlationId) {
|
this.logMessage(message, {
|
logLevel: exports.LogLevel.Trace,
|
containsPii: true,
|
correlationId: correlationId,
|
});
|
}
|
/**
|
* Returns whether PII Logging is enabled or not.
|
*/
|
isPiiLoggingEnabled() {
|
return this.piiLoggingEnabled || false;
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/* eslint-disable header/header */
|
const name$1 = "@azure/msal-common";
|
const version$1 = "16.5.0";
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const AzureCloudInstance = {
|
// AzureCloudInstance is not specified.
|
None: "none",
|
// Microsoft Azure public cloud
|
AzurePublic: "https://login.microsoftonline.com",
|
// Microsoft PPE
|
AzurePpe: "https://login.windows-ppe.net",
|
// Microsoft Chinese national/regional cloud
|
AzureChina: "https://login.chinacloudapi.cn",
|
// Microsoft German national/regional cloud ("Black Forest")
|
AzureGermany: "https://login.microsoftonline.de",
|
// US Government cloud
|
AzureUsGovernment: "https://login.microsoftonline.us",
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Returns true if tenantId matches the utid portion of homeAccountId
|
* @param tenantId
|
* @param homeAccountId
|
* @returns
|
*/
|
function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
|
return (!!tenantId &&
|
!!homeAccountId &&
|
tenantId === homeAccountId.split(".")[1]);
|
}
|
/**
|
* Build tenant profile
|
* @param homeAccountId - Home account identifier for this account object
|
* @param localAccountId - Local account identifer for this account object
|
* @param tenantId - Full tenant or organizational id that this account belongs to
|
* @param idTokenClaims - Claims from the ID token
|
* @returns
|
*/
|
function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
|
if (idTokenClaims) {
|
const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
|
/**
|
* Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
|
* tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
|
* tfp - Trust Framework Policy claim that identifies the policy that was used to authenticate the user. Functions as tenant for B2C scenarios.
|
* acr - Authentication Context Class Reference claim used only with older B2C policies. Fallback in case tfp is not present, but likely won't be present anyway.
|
*/
|
const tenantId = tid || tfp || acr || "";
|
return {
|
tenantId: tenantId,
|
localAccountId: oid || sub || "",
|
name: name,
|
username: preferred_username || upn || "",
|
loginHint: login_hint,
|
isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
|
};
|
}
|
else {
|
return {
|
tenantId,
|
localAccountId,
|
username: "",
|
isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
|
};
|
}
|
}
|
/**
|
* Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
|
* @param baseAccountInfo
|
* @param idTokenClaims
|
* @returns
|
*/
|
function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims, idTokenSecret) {
|
let updatedAccountInfo = baseAccountInfo;
|
// Tenant Profile overrides passed in account info
|
if (tenantProfile) {
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
const { isHomeTenant, ...tenantProfileOverride } = tenantProfile;
|
updatedAccountInfo = { ...baseAccountInfo, ...tenantProfileOverride };
|
}
|
// ID token claims override passed in account info and tenant profile
|
if (idTokenClaims) {
|
// Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
|
updatedAccountInfo = {
|
...updatedAccountInfo,
|
...claimsSourcedTenantProfile,
|
idTokenClaims: idTokenClaims,
|
idToken: idTokenSecret,
|
};
|
return updatedAccountInfo;
|
}
|
return updatedAccountInfo;
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Extract token by decoding the rawToken
|
*
|
* @param encodedToken
|
*/
|
function extractTokenClaims(encodedToken, base64Decode) {
|
const jswPayload = getJWSPayload(encodedToken);
|
// token will be decoded to get the username
|
try {
|
// base64Decode() should throw an error if there is an issue
|
const base64Decoded = base64Decode(jswPayload);
|
return JSON.parse(base64Decoded);
|
}
|
catch (err) {
|
throw createClientAuthError(tokenParsingError);
|
}
|
}
|
/**
|
* Check if the signin_state claim contains "kmsi"
|
* @param idTokenClaims
|
* @returns
|
*/
|
function isKmsi(idTokenClaims) {
|
if (!idTokenClaims.signin_state) {
|
return false;
|
}
|
/**
|
* Signin_state claim known values:
|
* dvc_mngd - device is managed
|
* dvc_dmjd - device is domain joined
|
* kmsi - user opted to "keep me signed in"
|
* inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
|
*/
|
const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
|
return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
|
}
|
/**
|
* decode a JWT
|
*
|
* @param authToken
|
*/
|
function getJWSPayload(authToken) {
|
if (!authToken) {
|
throw createClientAuthError(nullOrEmptyToken);
|
}
|
const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
|
const matches = tokenPartsRegex.exec(authToken);
|
if (!matches || matches.length < 4) {
|
throw createClientAuthError(tokenParsingError);
|
}
|
/**
|
* const crackedToken = {
|
* header: matches[1],
|
* JWSPayload: matches[2],
|
* JWSSig: matches[3],
|
* };
|
*/
|
return matches[2];
|
}
|
/**
|
* Determine if the token's max_age has transpired
|
*/
|
function checkMaxAge(authTime, maxAge) {
|
/*
|
* per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
* To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
|
* provide a value of 0 for the max_age parameter and the AS will force a fresh login.
|
*/
|
const fiveMinuteSkew = 300000; // five minutes in milliseconds
|
if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
|
throw createClientAuthError(maxAgeTranspired);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Url object class which can perform various transformations on url strings.
|
*/
|
class UrlString {
|
get urlString() {
|
return this._urlString;
|
}
|
constructor(url) {
|
this._urlString = url;
|
if (!this._urlString) {
|
// Throws error if url is empty
|
throw createClientConfigurationError(urlEmptyError);
|
}
|
if (!url.includes("#")) {
|
this._urlString = UrlString.canonicalizeUri(url);
|
}
|
}
|
/**
|
* Ensure urls are lower case and end with a / character.
|
* @param url
|
*/
|
static canonicalizeUri(url) {
|
if (url) {
|
let lowerCaseUrl = url.toLowerCase();
|
if (StringUtils.endsWith(lowerCaseUrl, "?")) {
|
lowerCaseUrl = lowerCaseUrl.slice(0, -1);
|
}
|
else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
|
lowerCaseUrl = lowerCaseUrl.slice(0, -2);
|
}
|
if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
|
lowerCaseUrl += "/";
|
}
|
return lowerCaseUrl;
|
}
|
return url;
|
}
|
/**
|
* Throws if urlString passed is not a valid authority URI string.
|
*/
|
validateAsUri() {
|
// Attempts to parse url for uri components
|
let components;
|
try {
|
components = this.getUrlComponents();
|
}
|
catch (e) {
|
throw createClientConfigurationError(urlParseError);
|
}
|
// Throw error if URI or path segments are not parseable.
|
if (!components.HostNameAndPort || !components.PathSegments) {
|
throw createClientConfigurationError(urlParseError);
|
}
|
// Throw error if uri is insecure.
|
if (!components.Protocol ||
|
components.Protocol.toLowerCase() !== "https:") {
|
throw createClientConfigurationError(authorityUriInsecure);
|
}
|
}
|
/**
|
* Given a url and a query string return the url with provided query string appended
|
* @param url
|
* @param queryString
|
*/
|
static appendQueryString(url, queryString) {
|
if (!queryString) {
|
return url;
|
}
|
return url.indexOf("?") < 0
|
? `${url}?${queryString}`
|
: `${url}&${queryString}`;
|
}
|
/**
|
* Returns a url with the hash removed
|
* @param url
|
*/
|
static removeHashFromUrl(url) {
|
return UrlString.canonicalizeUri(url.split("#")[0]);
|
}
|
/**
|
* Given a url like https://a:b/common/d?e=f#g, and a tenantId, returns https://a:b/tenantId/d
|
* @param href The url
|
* @param tenantId The tenant id to replace
|
*/
|
replaceTenantPath(tenantId) {
|
const urlObject = this.getUrlComponents();
|
const pathArray = urlObject.PathSegments;
|
if (tenantId &&
|
pathArray.length !== 0 &&
|
(pathArray[0] === AADAuthority.COMMON ||
|
pathArray[0] === AADAuthority.ORGANIZATIONS)) {
|
pathArray[0] = tenantId;
|
}
|
return UrlString.constructAuthorityUriFromObject(urlObject);
|
}
|
/**
|
* Parses out the components from a url string.
|
* @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
|
*/
|
getUrlComponents() {
|
// https://gist.github.com/curtisz/11139b2cfcaef4a261e0
|
const regEx = RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?");
|
// If url string does not match regEx, we throw an error
|
const match = this.urlString.match(regEx);
|
if (!match) {
|
throw createClientConfigurationError(urlParseError);
|
}
|
// Url component object
|
const urlComponents = {
|
Protocol: match[1],
|
HostNameAndPort: match[4],
|
AbsolutePath: match[5],
|
QueryString: match[7],
|
};
|
let pathSegments = urlComponents.AbsolutePath.split("/");
|
pathSegments = pathSegments.filter((val) => val && val.length > 0); // remove empty elements
|
urlComponents.PathSegments = pathSegments;
|
if (urlComponents.QueryString &&
|
urlComponents.QueryString.endsWith("/")) {
|
urlComponents.QueryString = urlComponents.QueryString.substring(0, urlComponents.QueryString.length - 1);
|
}
|
return urlComponents;
|
}
|
static getDomainFromUrl(url) {
|
const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
|
const match = url.match(regEx);
|
if (!match) {
|
throw createClientConfigurationError(urlParseError);
|
}
|
return match[2];
|
}
|
static getAbsoluteUrl(relativeUrl, baseUrl) {
|
if (relativeUrl[0] === FORWARD_SLASH) {
|
const url = new UrlString(baseUrl);
|
const baseComponents = url.getUrlComponents();
|
return (baseComponents.Protocol +
|
"//" +
|
baseComponents.HostNameAndPort +
|
relativeUrl);
|
}
|
return relativeUrl;
|
}
|
static constructAuthorityUriFromObject(urlObject) {
|
return new UrlString(urlObject.Protocol +
|
"//" +
|
urlObject.HostNameAndPort +
|
"/" +
|
urlObject.PathSegments.join("/"));
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
// Build endpoint metadata dynamically to avoid string duplication
|
const endpointHosts = [
|
{ host: "login.microsoftonline.com" },
|
{
|
host: "login.chinacloudapi.cn",
|
issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
|
},
|
{ host: "login.microsoftonline.us" },
|
{ host: "login.sovcloud-identity.fr" },
|
{ host: "login.sovcloud-identity.de" },
|
{ host: "login.sovcloud-identity.sg" },
|
];
|
function buildOpenIdConfig(host, issuerHost) {
|
return {
|
token_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/token`,
|
jwks_uri: `https://${host}/{tenantid}/discovery/v2.0/keys`,
|
issuer: `https://${issuerHost}/{tenantid}/v2.0`,
|
authorization_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/authorize`,
|
end_session_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/logout`,
|
};
|
}
|
const dynamicEndpointMetadata = endpointHosts.reduce((acc, { host, issuerHost }) => {
|
acc[host] = buildOpenIdConfig(host, issuerHost || host);
|
return acc;
|
}, {});
|
const rawMetdataJSON = {
|
endpointMetadata: dynamicEndpointMetadata,
|
instanceDiscoveryMetadata: {
|
metadata: [
|
{
|
preferred_network: "login.microsoftonline.com",
|
preferred_cache: "login.windows.net",
|
aliases: [
|
"login.microsoftonline.com",
|
"login.windows.net",
|
"login.microsoft.com",
|
"sts.windows.net",
|
],
|
},
|
{
|
preferred_network: "login.partner.microsoftonline.cn",
|
preferred_cache: "login.partner.microsoftonline.cn",
|
aliases: [
|
"login.partner.microsoftonline.cn",
|
"login.chinacloudapi.cn",
|
],
|
},
|
{
|
preferred_network: "login.microsoftonline.de",
|
preferred_cache: "login.microsoftonline.de",
|
aliases: ["login.microsoftonline.de"],
|
},
|
{
|
preferred_network: "login.microsoftonline.us",
|
preferred_cache: "login.microsoftonline.us",
|
aliases: [
|
"login.microsoftonline.us",
|
"login.usgovcloudapi.net",
|
],
|
},
|
{
|
preferred_network: "login-us.microsoftonline.com",
|
preferred_cache: "login-us.microsoftonline.com",
|
aliases: ["login-us.microsoftonline.com"],
|
},
|
{
|
preferred_network: "login.sovcloud-identity.fr",
|
preferred_cache: "login.sovcloud-identity.fr",
|
aliases: ["login.sovcloud-identity.fr"],
|
},
|
{
|
preferred_network: "login.sovcloud-identity.de",
|
preferred_cache: "login.sovcloud-identity.de",
|
aliases: ["login.sovcloud-identity.de"],
|
},
|
{
|
preferred_network: "login.sovcloud-identity.sg",
|
preferred_cache: "login.sovcloud-identity.sg",
|
aliases: ["login.sovcloud-identity.sg"],
|
},
|
],
|
},
|
};
|
const EndpointMetadata = rawMetdataJSON.endpointMetadata;
|
const InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
|
const InstanceDiscoveryMetadataAliases = new Set();
|
InstanceDiscoveryMetadata.metadata.forEach((metadataEntry) => {
|
metadataEntry.aliases.forEach((alias) => {
|
InstanceDiscoveryMetadataAliases.add(alias);
|
});
|
});
|
/**
|
* Attempts to get an aliases array from the static authority metadata sources based on the canonical authority host
|
* @param staticAuthorityOptions
|
* @param logger
|
* @returns
|
*/
|
function getAliasesFromStaticSources(staticAuthorityOptions, logger, correlationId) {
|
let staticAliases;
|
const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
|
if (canonicalAuthority) {
|
const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
|
staticAliases =
|
getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata, AuthorityMetadataSource.CONFIG) ||
|
getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata, AuthorityMetadataSource.HARDCODED_VALUES) ||
|
staticAuthorityOptions.knownAuthorities;
|
}
|
return staticAliases || [];
|
}
|
/**
|
* Returns aliases for from the raw cloud discovery metadata passed in
|
* @param authorityHost
|
* @param rawCloudDiscoveryMetadata
|
* @returns
|
*/
|
function getAliasesFromMetadata(logger, correlationId, authorityHost, cloudDiscoveryMetadata, source) {
|
logger.trace(`getAliasesFromMetadata called with source: '${source}'`, correlationId);
|
if (authorityHost && cloudDiscoveryMetadata) {
|
const metadata = getCloudDiscoveryMetadataFromNetworkResponse(cloudDiscoveryMetadata, authorityHost);
|
if (metadata) {
|
logger.trace(`getAliasesFromMetadata: found cloud discovery metadata in '${source}', returning aliases`, correlationId);
|
return metadata.aliases;
|
}
|
else {
|
logger.trace(`getAliasesFromMetadata: did not find cloud discovery metadata in '${source}'`, correlationId);
|
}
|
}
|
return null;
|
}
|
/**
|
* Get cloud discovery metadata for common authorities
|
*/
|
function getCloudDiscoveryMetadataFromHardcodedValues(authorityHost) {
|
const metadata = getCloudDiscoveryMetadataFromNetworkResponse(InstanceDiscoveryMetadata.metadata, authorityHost);
|
return metadata;
|
}
|
/**
|
* Searches instance discovery network response for the entry that contains the host in the aliases list
|
* @param response
|
* @param authority
|
*/
|
function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
|
for (let i = 0; i < response.length; i++) {
|
const metadata = response[i];
|
if (metadata.aliases.includes(authorityHost)) {
|
return metadata;
|
}
|
}
|
return null;
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const cacheQuotaExceeded = "cache_quota_exceeded";
|
const cacheErrorUnknown = "cache_error_unknown";
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Error thrown when there is an error with the cache
|
*/
|
class CacheError extends Error {
|
constructor(errorCode, errorMessage) {
|
const message = errorMessage || getDefaultErrorMessage(errorCode);
|
super(message);
|
Object.setPrototypeOf(this, CacheError.prototype);
|
this.name = "CacheError";
|
this.errorCode = errorCode;
|
this.errorMessage = message;
|
}
|
}
|
/**
|
* Helper function to wrap browser errors in a CacheError object
|
* @param e
|
* @returns
|
*/
|
function createCacheError(e) {
|
if (!(e instanceof Error)) {
|
return new CacheError(cacheErrorUnknown);
|
}
|
if (e.name === "QuotaExceededError" ||
|
e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
|
e.message.includes("exceeded the quota")) {
|
return new CacheError(cacheQuotaExceeded);
|
}
|
else {
|
return new CacheError(e.name, e.message);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Function to build a client info object from server clientInfo string
|
* @param rawClientInfo
|
* @param crypto
|
*/
|
function buildClientInfo(rawClientInfo, base64Decode) {
|
if (!rawClientInfo) {
|
throw createClientAuthError(clientInfoEmptyError);
|
}
|
try {
|
const decodedClientInfo = base64Decode(rawClientInfo);
|
return JSON.parse(decodedClientInfo);
|
}
|
catch (e) {
|
throw createClientAuthError(clientInfoDecodingError);
|
}
|
}
|
/**
|
* Function to build a client info object from cached homeAccountId string
|
* @param homeAccountId
|
*/
|
function buildClientInfoFromHomeAccountId(homeAccountId) {
|
if (!homeAccountId) {
|
throw createClientAuthError(clientInfoDecodingError);
|
}
|
const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
|
return {
|
uid: clientInfoParts[0],
|
utid: clientInfoParts.length < 2 ? "" : clientInfoParts[1],
|
};
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Authority types supported by MSAL.
|
*/
|
const AuthorityType = {
|
Default: 0,
|
Adfs: 1,
|
Dsts: 2,
|
Ciam: 3,
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Gets tenantId from available ID token claims to set as credential realm with the following precedence:
|
* 1. tid - if the token is acquired from an Azure AD tenant tid will be present
|
* 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
|
* 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
|
* Downcased to match the realm case-insensitive comparison requirements
|
* @param idTokenClaims
|
* @returns
|
*/
|
function getTenantIdFromIdTokenClaims(idTokenClaims) {
|
if (idTokenClaims) {
|
const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
|
return tenantId || null;
|
}
|
return null;
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Protocol modes supported by MSAL.
|
*/
|
const ProtocolMode = {
|
/**
|
* Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
|
*/
|
AAD: "AAD",
|
/**
|
* Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
|
* Support is limited for this mode.
|
*/
|
OIDC: "OIDC",
|
/**
|
* Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
|
*/
|
EAR: "EAR",
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/**
|
* Returns the AccountInfo interface for this account.
|
*/
|
function getAccountInfo(accountEntity) {
|
const tenantProfiles = accountEntity.tenantProfiles || [];
|
// Ensure at least the home tenant profile exists
|
if (tenantProfiles.length === 0 &&
|
accountEntity.realm &&
|
accountEntity.localAccountId) {
|
tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
|
}
|
return {
|
homeAccountId: accountEntity.homeAccountId,
|
environment: accountEntity.environment,
|
tenantId: accountEntity.realm,
|
username: accountEntity.username,
|
localAccountId: accountEntity.localAccountId,
|
loginHint: accountEntity.loginHint,
|
name: accountEntity.name,
|
nativeAccountId: accountEntity.nativeAccountId,
|
authorityType: accountEntity.authorityType,
|
// Deserialize tenant profiles array into a Map
|
tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
|
return [tenantProfile.tenantId, tenantProfile];
|
})),
|
dataBoundary: accountEntity.dataBoundary,
|
};
|
}
|
/**
|
* Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
|
* @param accountDetails
|
*/
|
function createAccountEntity(accountDetails, authority, base64Decode) {
|
let authorityType;
|
if (authority.authorityType === AuthorityType.Adfs) {
|
authorityType = CACHE_ACCOUNT_TYPE_ADFS;
|
}
|
else if (authority.protocolMode === ProtocolMode.OIDC) {
|
authorityType = CACHE_ACCOUNT_TYPE_GENERIC;
|
}
|
else {
|
authorityType = CACHE_ACCOUNT_TYPE_MSSTS;
|
}
|
let clientInfo;
|
let dataBoundary;
|
if (accountDetails.clientInfo && base64Decode) {
|
clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
|
if (clientInfo.xms_tdbr) {
|
dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
|
}
|
}
|
const env = accountDetails.environment ||
|
(authority && authority.getPreferredCache());
|
if (!env) {
|
throw createClientAuthError(invalidCacheEnvironment);
|
}
|
/*
|
* In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
|
* In most cases it will contain a single email. This field should not be relied upon if a custom
|
* policy is configured to return more than 1 email.
|
*/
|
const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
|
accountDetails.idTokenClaims?.upn;
|
const email = accountDetails.idTokenClaims?.emails
|
? accountDetails.idTokenClaims.emails[0]
|
: null;
|
const username = preferredUsername || email || "";
|
const loginHint = accountDetails.idTokenClaims?.login_hint;
|
const realm = clientInfo?.utid ||
|
getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
|
""; // non-AAD scenarios can have empty realm
|
// How do you account for MSA CID here?
|
const localAccountId = clientInfo?.uid ||
|
accountDetails.idTokenClaims?.oid ||
|
accountDetails.idTokenClaims?.sub ||
|
"";
|
let tenantProfiles;
|
if (accountDetails.tenantProfiles) {
|
tenantProfiles = accountDetails.tenantProfiles;
|
}
|
else {
|
const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims);
|
tenantProfiles = [tenantProfile];
|
}
|
return {
|
homeAccountId: accountDetails.homeAccountId,
|
environment: env,
|
realm: realm,
|
localAccountId: localAccountId,
|
username: username,
|
authorityType: authorityType,
|
loginHint: loginHint,
|
clientInfo: accountDetails.clientInfo,
|
name: accountDetails.idTokenClaims?.name || "",
|
lastModificationTime: undefined,
|
lastModificationApp: undefined,
|
cloudGraphHostName: accountDetails.cloudGraphHostName,
|
msGraphHost: accountDetails.msGraphHost,
|
nativeAccountId: accountDetails.nativeAccountId,
|
tenantProfiles: tenantProfiles,
|
dataBoundary,
|
};
|
}
|
/**
|
* Generate HomeAccountId from server response
|
* @param serverClientInfo
|
* @param authType
|
*/
|
function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, correlationId, idTokenClaims) {
|
// since ADFS/DSTS do not have tid and does not set client_info
|
if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
|
// for cases where there is clientInfo
|
if (serverClientInfo) {
|
try {
|
const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
|
if (clientInfo.uid && clientInfo.utid) {
|
return `${clientInfo.uid}.${clientInfo.utid}`;
|
}
|
}
|
catch (e) { }
|
}
|
logger.warning("No client info in response", correlationId);
|
}
|
// default to "sub" claim
|
return idTokenClaims?.sub || "";
|
}
|
/**
|
* Validates an entity: checks for all expected params
|
* @param entity
|
*/
|
function isAccountEntity(entity) {
|
if (!entity) {
|
return false;
|
}
|
return (entity.hasOwnProperty("homeAccountId") &&
|
entity.hasOwnProperty("environment") &&
|
entity.hasOwnProperty("realm") &&
|
entity.hasOwnProperty("localAccountId") &&
|
entity.hasOwnProperty("username") &&
|
entity.hasOwnProperty("authorityType"));
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
|
* @internal
|
*/
|
class CacheManager {
|
constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
|
this.clientId = clientId;
|
this.cryptoImpl = cryptoImpl;
|
this.commonLogger = logger.clone(name$1, version$1);
|
this.staticAuthorityOptions = staticAuthorityOptions;
|
this.performanceClient = performanceClient;
|
}
|
/**
|
* Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
|
* @param accountFilter - (Optional) filter to narrow down the accounts returned
|
* @returns Array of AccountInfo objects in cache
|
*/
|
getAllAccounts(accountFilter = {}, correlationId) {
|
return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
|
}
|
/**
|
* Gets first tenanted AccountInfo object found based on provided filters
|
*/
|
getAccountInfoFilteredBy(accountFilter, correlationId) {
|
if (Object.keys(accountFilter).length === 0 ||
|
Object.values(accountFilter).every((value) => value === null || value === undefined || value === "")) {
|
this.commonLogger.warning("getAccountInfoFilteredBy: Account filter is empty or invalid, returning null", correlationId);
|
return null;
|
}
|
const allAccounts = this.getAllAccounts(accountFilter, correlationId);
|
if (allAccounts.length > 1) {
|
// If one or more accounts are found, prioritize accounts that have an ID token
|
const sortedAccounts = allAccounts.sort((account) => {
|
return account.idTokenClaims ? -1 : 1;
|
});
|
return sortedAccounts[0];
|
}
|
else if (allAccounts.length === 1) {
|
// If only one account is found, return it regardless of whether a matching ID token was found
|
return allAccounts[0];
|
}
|
else {
|
return null;
|
}
|
}
|
/**
|
* Returns a single matching
|
* @param accountFilter
|
* @returns
|
*/
|
getBaseAccountInfo(accountFilter, correlationId) {
|
const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
|
if (accountEntities.length > 0) {
|
return getAccountInfo(accountEntities[0]);
|
}
|
else {
|
return null;
|
}
|
}
|
/**
|
* Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
|
* and builds the account info objects from the matching ID token's claims
|
* @param cachedAccounts
|
* @param accountFilter
|
* @returns Array of AccountInfo objects that match account and tenant profile filters
|
*/
|
buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
|
return cachedAccounts.flatMap((accountEntity) => {
|
return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
|
});
|
}
|
getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
|
let tenantedAccountInfo = null;
|
let idTokenClaims;
|
if (tenantProfileFilter) {
|
if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {
|
return null;
|
}
|
}
|
const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
|
if (idToken) {
|
idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
|
if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
|
// ID token sourced claims don't match so this tenant profile is not a match
|
return null;
|
}
|
}
|
// Expand tenant profile into account info based on matching tenant profile and if available matching ID token claims
|
tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
|
return tenantedAccountInfo;
|
}
|
getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
|
const accountInfo = getAccountInfo(accountEntity);
|
let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
|
const tokenKeys = this.getTokenKeys();
|
// If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists
|
if (targetTenantId) {
|
const tenantProfile = searchTenantProfiles.get(targetTenantId);
|
if (tenantProfile) {
|
// Reduce search field to just this tenant profile
|
searchTenantProfiles = new Map([
|
[targetTenantId, tenantProfile],
|
]);
|
}
|
else {
|
// No tenant profile for search tenant ID, return empty array
|
return [];
|
}
|
}
|
const matchingTenantProfiles = [];
|
searchTenantProfiles.forEach((tenantProfile) => {
|
const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
|
if (tenantedAccountInfo) {
|
matchingTenantProfiles.push(tenantedAccountInfo);
|
}
|
});
|
return matchingTenantProfiles;
|
}
|
tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter) {
|
if (!!tenantProfileFilter.localAccountId &&
|
!this.matchLocalAccountIdFromTenantProfile(tenantProfile, tenantProfileFilter.localAccountId)) {
|
return false;
|
}
|
if (!!tenantProfileFilter.name &&
|
!(tenantProfile.name === tenantProfileFilter.name)) {
|
return false;
|
}
|
if (tenantProfileFilter.isHomeTenant !== undefined &&
|
!(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
|
return false;
|
}
|
return true;
|
}
|
idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
|
// Tenant Profile filtering
|
if (tenantProfileFilter) {
|
if (!!tenantProfileFilter.localAccountId &&
|
!this.matchLocalAccountIdFromTokenClaims(idTokenClaims, tenantProfileFilter.localAccountId)) {
|
return false;
|
}
|
if (!!tenantProfileFilter.loginHint &&
|
!this.matchLoginHintFromTokenClaims(idTokenClaims, tenantProfileFilter.loginHint)) {
|
return false;
|
}
|
if (!!tenantProfileFilter.username &&
|
!this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
|
return false;
|
}
|
if (!!tenantProfileFilter.name &&
|
!this.matchName(idTokenClaims, tenantProfileFilter.name)) {
|
return false;
|
}
|
if (!!tenantProfileFilter.sid &&
|
!this.matchSid(idTokenClaims, tenantProfileFilter.sid)) {
|
return false;
|
}
|
}
|
return true;
|
}
|
/**
|
* saves a cache record
|
* @param cacheRecord {CacheRecord}
|
* @param storeInCache {?StoreInCache}
|
* @param correlationId {?string} correlation id
|
*/
|
async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
|
if (!cacheRecord) {
|
throw createClientAuthError(invalidCacheRecord);
|
}
|
try {
|
if (!!cacheRecord.account) {
|
await this.setAccount(cacheRecord.account, correlationId, kmsi, apiId);
|
}
|
if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
|
await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
|
}
|
if (!!cacheRecord.accessToken &&
|
storeInCache?.accessToken !== false) {
|
await this.saveAccessToken(cacheRecord.accessToken, correlationId, kmsi);
|
}
|
if (!!cacheRecord.refreshToken &&
|
storeInCache?.refreshToken !== false) {
|
await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId, kmsi);
|
}
|
if (!!cacheRecord.appMetadata) {
|
this.setAppMetadata(cacheRecord.appMetadata, correlationId);
|
}
|
}
|
catch (e) {
|
this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`, correlationId);
|
if (e instanceof AuthError) {
|
throw e;
|
}
|
else {
|
throw createCacheError(e);
|
}
|
}
|
}
|
/**
|
* saves access token credential
|
* @param credential
|
*/
|
async saveAccessToken(credential, correlationId, kmsi) {
|
const accessTokenFilter = {
|
clientId: credential.clientId,
|
credentialType: credential.credentialType,
|
environment: credential.environment,
|
homeAccountId: credential.homeAccountId,
|
realm: credential.realm,
|
tokenType: credential.tokenType,
|
};
|
const tokenKeys = this.getTokenKeys();
|
const currentScopes = ScopeSet.fromString(credential.target);
|
tokenKeys.accessToken.forEach((key) => {
|
if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
|
return;
|
}
|
const tokenEntity = this.getAccessTokenCredential(key, correlationId);
|
if (tokenEntity &&
|
this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
|
const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
|
if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
|
this.removeAccessToken(key, correlationId);
|
}
|
}
|
});
|
await this.setAccessTokenCredential(credential, correlationId, kmsi);
|
}
|
/**
|
* Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
|
* Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
|
* @param accountFilter - An object containing Account properties to filter by
|
*/
|
getAccountsFilteredBy(accountFilter, correlationId) {
|
const allAccountKeys = this.getAccountKeys();
|
const matchingAccounts = [];
|
allAccountKeys.forEach((cacheKey) => {
|
const entity = this.getAccount(cacheKey, correlationId);
|
// Match base account fields
|
if (!entity) {
|
return;
|
}
|
if (!!accountFilter.homeAccountId &&
|
!this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
|
return;
|
}
|
if (!!accountFilter.username &&
|
!this.matchUsername(entity.username, accountFilter.username)) {
|
return;
|
}
|
if (!!accountFilter.environment &&
|
!this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
|
return;
|
}
|
if (!!accountFilter.realm &&
|
!this.matchRealm(entity, accountFilter.realm)) {
|
return;
|
}
|
if (!!accountFilter.nativeAccountId &&
|
!this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
|
return;
|
}
|
if (!!accountFilter.authorityType &&
|
!this.matchAuthorityType(entity, accountFilter.authorityType)) {
|
return;
|
}
|
// If at least one tenant profile matches the tenant profile filter, add the account to the list of matching accounts
|
const tenantProfileFilter = {
|
localAccountId: accountFilter?.localAccountId,
|
name: accountFilter?.name,
|
};
|
const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
|
return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
|
});
|
if (matchingTenantProfiles && matchingTenantProfiles.length === 0) {
|
// No tenant profile for this account matches filter, don't add to list of matching accounts
|
return;
|
}
|
matchingAccounts.push(entity);
|
});
|
return matchingAccounts;
|
}
|
/**
|
* Returns whether or not the given credential entity matches the filter
|
* @param entity
|
* @param filter
|
* @param correlationId
|
* @returns
|
*/
|
credentialMatchesFilter(entity, filter, correlationId) {
|
if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) {
|
return false;
|
}
|
if (!!filter.userAssertionHash &&
|
!this.matchUserAssertionHash(entity, filter.userAssertionHash)) {
|
return false;
|
}
|
/*
|
* homeAccountId can be undefined, and we want to filter out cached items that have a homeAccountId of ""
|
* because we don't want a client_credential request to return a cached token that has a homeAccountId
|
*/
|
if (typeof filter.homeAccountId === "string" &&
|
!this.matchHomeAccountId(entity, filter.homeAccountId)) {
|
return false;
|
}
|
if (!!filter.environment &&
|
!this.matchEnvironment(entity, filter.environment, correlationId)) {
|
return false;
|
}
|
if (!!filter.realm && !this.matchRealm(entity, filter.realm)) {
|
return false;
|
}
|
if (!!filter.credentialType &&
|
!this.matchCredentialType(entity, filter.credentialType)) {
|
return false;
|
}
|
if (!!filter.familyId && !this.matchFamilyId(entity, filter.familyId)) {
|
return false;
|
}
|
/*
|
* idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
|
* Resource specific refresh tokens case will be added when the support is deemed necessary
|
*/
|
if (!!filter.target && !this.matchTarget(entity, filter.target)) {
|
return false;
|
}
|
// Access Token with Auth Scheme specific matching
|
if (entity.credentialType ===
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
|
if (!!filter.tokenType &&
|
!this.matchTokenType(entity, filter.tokenType)) {
|
return false;
|
}
|
// KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
|
if (filter.tokenType === AuthenticationScheme.SSH) {
|
if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
|
return false;
|
}
|
}
|
}
|
return true;
|
}
|
/**
|
* retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata
|
* @param filter
|
* @param correlationId
|
*/
|
getAppMetadataFilteredBy(filter, correlationId) {
|
const allCacheKeys = this.getKeys();
|
const matchingAppMetadata = {};
|
allCacheKeys.forEach((cacheKey) => {
|
// don't parse any non-appMetadata type cache entities
|
if (!this.isAppMetadata(cacheKey)) {
|
return;
|
}
|
// Attempt retrieval
|
const entity = this.getAppMetadata(cacheKey, correlationId);
|
if (!entity) {
|
return;
|
}
|
if (!!filter.environment &&
|
!this.matchEnvironment(entity, filter.environment, correlationId)) {
|
return;
|
}
|
if (!!filter.clientId &&
|
!this.matchClientId(entity, filter.clientId)) {
|
return;
|
}
|
matchingAppMetadata[cacheKey] = entity;
|
});
|
return matchingAppMetadata;
|
}
|
/**
|
* retrieve authorityMetadata that contains a matching alias
|
* @param host
|
* @param correlationId
|
*/
|
getAuthorityMetadataByAlias(host, correlationId) {
|
const allCacheKeys = this.getAuthorityMetadataKeys();
|
let matchedEntity = null;
|
allCacheKeys.forEach((cacheKey) => {
|
// don't parse any non-authorityMetadata type cache entities
|
if (!this.isAuthorityMetadata(cacheKey) ||
|
cacheKey.indexOf(this.clientId) === -1) {
|
return;
|
}
|
// Attempt retrieval
|
const entity = this.getAuthorityMetadata(cacheKey, correlationId);
|
if (!entity) {
|
return;
|
}
|
if (entity.aliases.indexOf(host) === -1) {
|
return;
|
}
|
matchedEntity = entity;
|
});
|
return matchedEntity;
|
}
|
/**
|
* Removes all accounts and related tokens from cache.
|
*/
|
removeAllAccounts(correlationId) {
|
const accounts = this.getAllAccounts({}, correlationId);
|
accounts.forEach((account) => {
|
this.removeAccount(account, correlationId);
|
});
|
}
|
/**
|
* Removes the account and related tokens for a given account key
|
* @param account
|
*/
|
removeAccount(account, correlationId) {
|
this.removeAccountContext(account, correlationId);
|
const accountKeys = this.getAccountKeys();
|
const keyFilter = (key) => {
|
return (key.includes(account.homeAccountId) &&
|
key.includes(account.environment));
|
};
|
accountKeys.filter(keyFilter).forEach((key) => {
|
this.removeItem(key, correlationId);
|
this.performanceClient.incrementFields({ accountsRemoved: 1 }, correlationId);
|
});
|
}
|
/**
|
* Removes credentials associated with the provided account
|
* @param account
|
*/
|
removeAccountContext(account, correlationId) {
|
const allTokenKeys = this.getTokenKeys();
|
const keyFilter = (key) => {
|
return (key.includes(account.homeAccountId) &&
|
key.includes(account.environment));
|
};
|
allTokenKeys.idToken.filter(keyFilter).forEach((key) => {
|
this.removeIdToken(key, correlationId);
|
});
|
allTokenKeys.accessToken.filter(keyFilter).forEach((key) => {
|
this.removeAccessToken(key, correlationId);
|
});
|
allTokenKeys.refreshToken.filter(keyFilter).forEach((key) => {
|
this.removeRefreshToken(key, correlationId);
|
});
|
}
|
/**
|
* returns a boolean if the given credential is removed
|
* @param key
|
* @param correlationId
|
*/
|
removeAccessToken(key, correlationId) {
|
const credential = this.getAccessTokenCredential(key, correlationId);
|
if (!credential) {
|
return;
|
}
|
this.removeItem(key, correlationId);
|
this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
|
// Remove Token Binding Key from key store for PoP Tokens Credentials
|
if (credential.credentialType.toLowerCase() ===
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
|
if (credential.tokenType === AuthenticationScheme.POP) {
|
const accessTokenWithAuthSchemeEntity = credential;
|
const kid = accessTokenWithAuthSchemeEntity.keyId;
|
if (kid) {
|
void this.cryptoImpl
|
.removeTokenBindingKey(kid, correlationId)
|
.catch(() => {
|
this.commonLogger.error(`Failed to remove token binding key '${kid}'`, correlationId);
|
this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
|
});
|
}
|
}
|
}
|
}
|
/**
|
* Removes all app metadata objects from cache.
|
*/
|
removeAppMetadata(correlationId) {
|
const allCacheKeys = this.getKeys();
|
allCacheKeys.forEach((cacheKey) => {
|
if (this.isAppMetadata(cacheKey)) {
|
this.removeItem(cacheKey, correlationId);
|
}
|
});
|
return true;
|
}
|
/**
|
* Retrieve IdTokenEntity from cache
|
* @param account {AccountInfo}
|
* @param tokenKeys {?TokenKeys}
|
* @param targetRealm {?string}
|
* @param performanceClient {?IPerformanceClient}
|
* @param correlationId {?string}
|
*/
|
getIdToken(account, correlationId, tokenKeys, targetRealm) {
|
this.commonLogger.trace("CacheManager - getIdToken called", correlationId);
|
const idTokenFilter = {
|
homeAccountId: account.homeAccountId,
|
environment: account.environment,
|
credentialType: CredentialType.ID_TOKEN,
|
clientId: this.clientId,
|
realm: targetRealm,
|
};
|
const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
|
const numIdTokens = idTokenMap.size;
|
if (numIdTokens < 1) {
|
this.commonLogger.info("CacheManager:getIdToken - No token found", correlationId);
|
return null;
|
}
|
else if (numIdTokens > 1) {
|
let tokensToBeRemoved = idTokenMap;
|
// Multiple tenant profiles and no tenant specified, pick home account
|
if (!targetRealm) {
|
const homeIdTokenMap = new Map();
|
idTokenMap.forEach((idToken, key) => {
|
if (idToken.realm === account.tenantId) {
|
homeIdTokenMap.set(key, idToken);
|
}
|
});
|
const numHomeIdTokens = homeIdTokenMap.size;
|
if (numHomeIdTokens < 1) {
|
this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result", correlationId);
|
return idTokenMap.values().next().value;
|
}
|
else if (numHomeIdTokens === 1) {
|
this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile", correlationId);
|
return homeIdTokenMap.values().next().value;
|
}
|
else {
|
// Multiple ID tokens for home tenant profile, remove all and return null
|
tokensToBeRemoved = homeIdTokenMap;
|
}
|
}
|
// Multiple tokens for a single tenant profile, remove all and return null
|
this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them", correlationId);
|
tokensToBeRemoved.forEach((idToken, key) => {
|
this.removeIdToken(key, correlationId);
|
});
|
this.performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
|
return null;
|
}
|
this.commonLogger.info("CacheManager:getIdToken - Returning ID token", correlationId);
|
return idTokenMap.values().next().value;
|
}
|
/**
|
* Gets all idTokens matching the given filter
|
* @param filter
|
* @returns
|
*/
|
getIdTokensByFilter(filter, correlationId, tokenKeys) {
|
const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
|
const idTokens = new Map();
|
idTokenKeys.forEach((key) => {
|
if (!this.idTokenKeyMatchesFilter(key, {
|
clientId: this.clientId,
|
...filter,
|
})) {
|
return;
|
}
|
const idToken = this.getIdTokenCredential(key, correlationId);
|
if (idToken &&
|
this.credentialMatchesFilter(idToken, filter, correlationId)) {
|
idTokens.set(key, idToken);
|
}
|
});
|
return idTokens;
|
}
|
/**
|
* Validate the cache key against filter before retrieving and parsing cache value
|
* @param key
|
* @param filter
|
* @returns
|
*/
|
idTokenKeyMatchesFilter(inputKey, filter) {
|
const key = inputKey.toLowerCase();
|
if (filter.clientId &&
|
key.indexOf(filter.clientId.toLowerCase()) === -1) {
|
return false;
|
}
|
if (filter.homeAccountId &&
|
key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
|
return false;
|
}
|
return true;
|
}
|
/**
|
* Removes idToken from the cache
|
* @param key
|
*/
|
removeIdToken(key, correlationId) {
|
this.removeItem(key, correlationId);
|
}
|
/**
|
* Removes refresh token from the cache
|
* @param key
|
*/
|
removeRefreshToken(key, correlationId) {
|
this.removeItem(key, correlationId);
|
}
|
/**
|
* Retrieve AccessTokenEntity from cache
|
* @param account {AccountInfo}
|
* @param request {BaseAuthRequest}
|
* @param tokenKeys {?TokenKeys}
|
* @param performanceClient {?IPerformanceClient}
|
*/
|
getAccessToken(account, request, tokenKeys, targetRealm) {
|
const correlationId = request.correlationId;
|
this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
|
const scopes = ScopeSet.createSearchScopes(request.scopes);
|
const authScheme = request.authenticationScheme ||
|
AuthenticationScheme.BEARER;
|
/*
|
* Distinguish between Bearer and PoP/SSH token cache types
|
* Cast to lowercase to handle "bearer" from ADFS
|
*/
|
const credentialType = authScheme.toLowerCase() !==
|
AuthenticationScheme.BEARER.toLowerCase()
|
? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
|
: CredentialType.ACCESS_TOKEN;
|
const accessTokenFilter = {
|
homeAccountId: account.homeAccountId,
|
environment: account.environment,
|
credentialType: credentialType,
|
clientId: this.clientId,
|
realm: targetRealm || account.tenantId,
|
target: scopes,
|
tokenType: authScheme,
|
keyId: request.sshKid,
|
};
|
const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||
|
this.getTokenKeys().accessToken;
|
const accessTokens = [];
|
accessTokenKeys.forEach((key) => {
|
// Validate key
|
if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
|
const accessToken = this.getAccessTokenCredential(key, correlationId);
|
// Validate value
|
if (accessToken &&
|
this.credentialMatchesFilter(accessToken, accessTokenFilter, correlationId)) {
|
accessTokens.push(accessToken);
|
}
|
}
|
});
|
const numAccessTokens = accessTokens.length;
|
if (numAccessTokens < 1) {
|
this.commonLogger.info("CacheManager:getAccessToken - No token found", correlationId);
|
return null;
|
}
|
else if (numAccessTokens > 1) {
|
this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
|
accessTokens.forEach((accessToken) => {
|
this.removeAccessToken(this.generateCredentialKey(accessToken), correlationId);
|
});
|
this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
|
return null;
|
}
|
this.commonLogger.info("CacheManager:getAccessToken - Returning access token", correlationId);
|
return accessTokens[0];
|
}
|
/**
|
* Validate the cache key against filter before retrieving and parsing cache value
|
* @param key
|
* @param filter
|
* @param keyMustContainAllScopes
|
* @returns
|
*/
|
accessTokenKeyMatchesFilter(inputKey, filter, keyMustContainAllScopes) {
|
const key = inputKey.toLowerCase();
|
if (filter.clientId &&
|
key.indexOf(filter.clientId.toLowerCase()) === -1) {
|
return false;
|
}
|
if (filter.homeAccountId &&
|
key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
|
return false;
|
}
|
if (filter.realm && key.indexOf(filter.realm.toLowerCase()) === -1) {
|
return false;
|
}
|
if (filter.target) {
|
const scopes = filter.target.asArray();
|
for (let i = 0; i < scopes.length; i++) {
|
if (keyMustContainAllScopes &&
|
!key.includes(scopes[i].toLowerCase())) {
|
// When performing a cache lookup a missing scope would be a cache miss
|
return false;
|
}
|
else if (!keyMustContainAllScopes &&
|
key.includes(scopes[i].toLowerCase())) {
|
// When performing a cache write, any token with a subset of requested scopes should be replaced
|
return true;
|
}
|
}
|
}
|
return true;
|
}
|
/**
|
* Gets all access tokens matching the filter
|
* @param filter
|
* @returns
|
*/
|
getAccessTokensByFilter(filter, correlationId) {
|
const tokenKeys = this.getTokenKeys();
|
const accessTokens = [];
|
tokenKeys.accessToken.forEach((key) => {
|
if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
|
return;
|
}
|
const accessToken = this.getAccessTokenCredential(key, correlationId);
|
if (accessToken &&
|
this.credentialMatchesFilter(accessToken, filter, correlationId)) {
|
accessTokens.push(accessToken);
|
}
|
});
|
return accessTokens;
|
}
|
/**
|
* Helper to retrieve the appropriate refresh token from cache
|
* @param account {AccountInfo}
|
* @param familyRT {boolean}
|
* @param tokenKeys {?TokenKeys}
|
* @param performanceClient {?IPerformanceClient}
|
* @param correlationId {?string}
|
*/
|
getRefreshToken(account, familyRT, correlationId, tokenKeys) {
|
this.commonLogger.trace("CacheManager - getRefreshToken called", correlationId);
|
const id = familyRT ? THE_FAMILY_ID : undefined;
|
const refreshTokenFilter = {
|
homeAccountId: account.homeAccountId,
|
environment: account.environment,
|
credentialType: CredentialType.REFRESH_TOKEN,
|
clientId: this.clientId,
|
familyId: id,
|
};
|
const refreshTokenKeys = (tokenKeys && tokenKeys.refreshToken) ||
|
this.getTokenKeys().refreshToken;
|
const refreshTokens = [];
|
refreshTokenKeys.forEach((key) => {
|
// Validate key
|
if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
|
const refreshToken = this.getRefreshTokenCredential(key, correlationId);
|
// Validate value
|
if (refreshToken &&
|
this.credentialMatchesFilter(refreshToken, refreshTokenFilter, correlationId)) {
|
refreshTokens.push(refreshToken);
|
}
|
}
|
});
|
const numRefreshTokens = refreshTokens.length;
|
if (numRefreshTokens < 1) {
|
this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found.", correlationId);
|
return null;
|
}
|
// address the else case after remove functions address environment aliases
|
if (numRefreshTokens > 1) {
|
this.performanceClient.addFields({ multiMatchedRT: numRefreshTokens }, correlationId);
|
}
|
this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token", correlationId);
|
return refreshTokens[0];
|
}
|
/**
|
* Validate the cache key against filter before retrieving and parsing cache value
|
* @param key
|
* @param filter
|
*/
|
refreshTokenKeyMatchesFilter(inputKey, filter) {
|
const key = inputKey.toLowerCase();
|
if (filter.familyId &&
|
key.indexOf(filter.familyId.toLowerCase()) === -1) {
|
return false;
|
}
|
// If familyId is used, clientId is not in the key
|
if (!filter.familyId &&
|
filter.clientId &&
|
key.indexOf(filter.clientId.toLowerCase()) === -1) {
|
return false;
|
}
|
if (filter.homeAccountId &&
|
key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
|
return false;
|
}
|
return true;
|
}
|
/**
|
* Retrieve AppMetadataEntity from cache
|
*/
|
readAppMetadataFromCache(environment, correlationId) {
|
const appMetadataFilter = {
|
environment,
|
clientId: this.clientId,
|
};
|
const appMetadata = this.getAppMetadataFilteredBy(appMetadataFilter, correlationId);
|
const appMetadataEntries = Object.keys(appMetadata).map((key) => appMetadata[key]);
|
const numAppMetadata = appMetadataEntries.length;
|
if (numAppMetadata < 1) {
|
return null;
|
}
|
else if (numAppMetadata > 1) {
|
throw createClientAuthError(multipleMatchingAppMetadata);
|
}
|
return appMetadataEntries[0];
|
}
|
/**
|
* Return the family_id value associated with FOCI
|
* @param environment
|
* @param clientId
|
*/
|
isAppMetadataFOCI(environment, correlationId) {
|
const appMetadata = this.readAppMetadataFromCache(environment, correlationId);
|
return !!(appMetadata && appMetadata.familyId === THE_FAMILY_ID);
|
}
|
/**
|
* helper to match account ids
|
* @param value
|
* @param homeAccountId
|
*/
|
matchHomeAccountId(entity, homeAccountId) {
|
return !!(typeof entity.homeAccountId === "string" &&
|
homeAccountId === entity.homeAccountId);
|
}
|
/**
|
* helper to match account ids
|
* @param entity
|
* @param localAccountId
|
* @returns
|
*/
|
matchLocalAccountIdFromTokenClaims(tokenClaims, localAccountId) {
|
const idTokenLocalAccountId = tokenClaims.oid || tokenClaims.sub;
|
return localAccountId === idTokenLocalAccountId;
|
}
|
matchLocalAccountIdFromTenantProfile(tenantProfile, localAccountId) {
|
return tenantProfile.localAccountId === localAccountId;
|
}
|
/**
|
* helper to match names
|
* @param entity
|
* @param name
|
* @returns true if the downcased name properties are present and match in the filter and the entity
|
*/
|
matchName(claims, name) {
|
return !!(name.toLowerCase() === claims.name?.toLowerCase());
|
}
|
/**
|
* helper to match usernames
|
* @param entity
|
* @param username
|
* @returns
|
*/
|
matchUsername(cachedUsername, filterUsername) {
|
return !!(cachedUsername &&
|
typeof cachedUsername === "string" &&
|
filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
|
}
|
/**
|
* helper to match assertion
|
* @param value
|
* @param oboAssertion
|
*/
|
matchUserAssertionHash(entity, userAssertionHash) {
|
return !!(entity.userAssertionHash &&
|
userAssertionHash === entity.userAssertionHash);
|
}
|
/**
|
* helper to match environment
|
* @param value
|
* @param environment
|
*/
|
matchEnvironment(entity, environment, correlationId) {
|
// Check static authority options first for cases where authority metadata has not been resolved and cached yet
|
if (this.staticAuthorityOptions) {
|
const staticAliases = getAliasesFromStaticSources(this.staticAuthorityOptions, this.commonLogger, correlationId);
|
if (staticAliases.includes(environment) &&
|
staticAliases.includes(entity.environment)) {
|
return true;
|
}
|
}
|
// Query metadata cache if no static authority configuration has aliases that match enviroment
|
const cloudMetadata = this.getAuthorityMetadataByAlias(environment, correlationId);
|
if (cloudMetadata &&
|
cloudMetadata.aliases.indexOf(entity.environment) > -1) {
|
return true;
|
}
|
return false;
|
}
|
/**
|
* helper to match credential type
|
* @param entity
|
* @param credentialType
|
*/
|
matchCredentialType(entity, credentialType) {
|
return (entity.credentialType &&
|
credentialType.toLowerCase() === entity.credentialType.toLowerCase());
|
}
|
/**
|
* helper to match client ids
|
* @param entity
|
* @param clientId
|
*/
|
matchClientId(entity, clientId) {
|
return !!(entity.clientId && clientId === entity.clientId);
|
}
|
/**
|
* helper to match family ids
|
* @param entity
|
* @param familyId
|
*/
|
matchFamilyId(entity, familyId) {
|
return !!(entity.familyId && familyId === entity.familyId);
|
}
|
/**
|
* helper to match realm
|
* @param entity
|
* @param realm
|
*/
|
matchRealm(entity, realm) {
|
return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
|
}
|
/**
|
* helper to match nativeAccountId
|
* @param entity
|
* @param nativeAccountId
|
* @returns boolean indicating the match result
|
*/
|
matchNativeAccountId(entity, nativeAccountId) {
|
return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
|
}
|
/**
|
* helper to match loginHint which can be either:
|
* 1. login_hint ID token claim
|
* 2. username in cached account object
|
* 3. upn in ID token claims
|
* @param entity
|
* @param loginHint
|
* @returns
|
*/
|
matchLoginHintFromTokenClaims(tokenClaims, loginHint) {
|
if (tokenClaims.login_hint === loginHint) {
|
return true;
|
}
|
if (tokenClaims.preferred_username === loginHint) {
|
return true;
|
}
|
if (tokenClaims.upn === loginHint) {
|
return true;
|
}
|
return false;
|
}
|
/**
|
* Helper to match sid
|
* @param entity
|
* @param sid
|
* @returns true if the sid claim is present and matches the filter
|
*/
|
matchSid(idTokenClaims, sid) {
|
return idTokenClaims.sid === sid;
|
}
|
matchAuthorityType(entity, authorityType) {
|
return !!(entity.authorityType &&
|
authorityType.toLowerCase() === entity.authorityType.toLowerCase());
|
}
|
/**
|
* Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
|
* @param entity
|
* @param target
|
*/
|
matchTarget(entity, target) {
|
const isNotAccessTokenCredential = entity.credentialType !== CredentialType.ACCESS_TOKEN &&
|
entity.credentialType !==
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
|
if (isNotAccessTokenCredential || !entity.target) {
|
return false;
|
}
|
const entityScopeSet = ScopeSet.fromString(entity.target);
|
return entityScopeSet.containsScopeSet(target);
|
}
|
/**
|
* Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
|
* @param entity
|
* @param tokenType
|
*/
|
matchTokenType(entity, tokenType) {
|
return !!(entity.tokenType && entity.tokenType === tokenType);
|
}
|
/**
|
* Returns true if the credential's keyId matches the one in the request, false otherwise
|
* @param entity
|
* @param keyId
|
*/
|
matchKeyId(entity, keyId) {
|
return !!(entity.keyId && entity.keyId === keyId);
|
}
|
/**
|
* returns if a given cache entity is of the type appmetadata
|
* @param key
|
*/
|
isAppMetadata(key) {
|
return key.indexOf(APP_METADATA) !== -1;
|
}
|
/**
|
* returns if a given cache entity is of the type authoritymetadata
|
* @param key
|
*/
|
isAuthorityMetadata(key) {
|
return key.indexOf(AUTHORITY_METADATA_CACHE_KEY) !== -1;
|
}
|
/**
|
* returns cache key used for cloud instance metadata
|
*/
|
generateAuthorityMetadataCacheKey(authority) {
|
return `${AUTHORITY_METADATA_CACHE_KEY}-${this.clientId}-${authority}`;
|
}
|
/**
|
* Helper to convert serialized data to object
|
* @param obj
|
* @param json
|
*/
|
static toObject(obj, json) {
|
for (const propertyName in json) {
|
obj[propertyName] = json[propertyName];
|
}
|
return obj;
|
}
|
}
|
/** @internal */
|
class DefaultStorageClass extends CacheManager {
|
async setAccount() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getAccount() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
async setIdTokenCredential() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getIdTokenCredential() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
async setAccessTokenCredential() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getAccessTokenCredential() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
async setRefreshTokenCredential() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getRefreshTokenCredential() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
setAppMetadata() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getAppMetadata() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
setServerTelemetry() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getServerTelemetry() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
setAuthorityMetadata() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getAuthorityMetadata() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getAuthorityMetadataKeys() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
setThrottlingCache() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getThrottlingCache() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
removeItem() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getKeys() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getAccountKeys() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
getTokenKeys() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
generateCredentialKey() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
generateAccountKey() {
|
throw createClientAuthError(methodNotImplemented);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* State of the performance event.
|
*
|
* @export
|
* @enum {number}
|
*/
|
const PerformanceEventStatus = {
|
InProgress: 1};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class StubPerformanceClient {
|
generateId() {
|
return "callback-id";
|
}
|
startMeasurement(measureName, correlationId) {
|
return {
|
end: () => null,
|
discard: () => { },
|
add: () => { },
|
increment: () => { },
|
event: {
|
eventId: this.generateId(),
|
status: PerformanceEventStatus.InProgress,
|
authority: "",
|
libraryName: "",
|
libraryVersion: "",
|
clientId: "",
|
name: measureName,
|
startTimeMs: Date.now(),
|
correlationId: correlationId || "",
|
},
|
};
|
}
|
endMeasurement() {
|
return null;
|
}
|
discardMeasurements() {
|
return;
|
}
|
removePerformanceCallback() {
|
return true;
|
}
|
addPerformanceCallback() {
|
return "";
|
}
|
emitEvents() {
|
return;
|
}
|
addFields() {
|
return;
|
}
|
incrementFields() {
|
return;
|
}
|
cacheEventByCorrelationId() {
|
return;
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const DEFAULT_SYSTEM_OPTIONS$1 = {
|
tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
|
preventCorsPreflight: false,
|
};
|
const DEFAULT_LOGGER_IMPLEMENTATION = {
|
loggerCallback: () => {
|
// allow users to not set loggerCallback
|
},
|
piiLoggingEnabled: false,
|
logLevel: exports.LogLevel.Info,
|
correlationId: "",
|
};
|
const DEFAULT_NETWORK_IMPLEMENTATION = {
|
async sendGetRequestAsync() {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
async sendPostRequestAsync() {
|
throw createClientAuthError(methodNotImplemented);
|
},
|
};
|
const DEFAULT_LIBRARY_INFO = {
|
sku: SKU,
|
version: version$1,
|
cpu: "",
|
os: "",
|
};
|
const DEFAULT_CLIENT_CREDENTIALS = {
|
clientSecret: "",
|
clientAssertion: undefined,
|
};
|
const DEFAULT_AZURE_CLOUD_OPTIONS = {
|
azureCloudInstance: AzureCloudInstance.None,
|
tenant: `${DEFAULT_COMMON_TENANT}`,
|
};
|
const DEFAULT_TELEMETRY_OPTIONS$1 = {
|
application: {
|
appName: "",
|
appVersion: "",
|
},
|
};
|
/**
|
* Function that sets the default options when not explicitly configured from app developer
|
*
|
* @param Configuration
|
*
|
* @returns Configuration
|
*/
|
function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
|
const loggerOptions = {
|
...DEFAULT_LOGGER_IMPLEMENTATION,
|
...userLoggerOption,
|
};
|
return {
|
authOptions: buildAuthOptions(userAuthOptions),
|
systemOptions: { ...DEFAULT_SYSTEM_OPTIONS$1, ...userSystemOptions },
|
loggerOptions: loggerOptions,
|
storageInterface: storageImplementation ||
|
new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
|
networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
|
cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
|
clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
|
libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
|
telemetry: { ...DEFAULT_TELEMETRY_OPTIONS$1, ...telemetry },
|
serverTelemetryManager: serverTelemetryManager || null,
|
persistencePlugin: persistencePlugin || null,
|
serializableCache: serializableCache || null,
|
};
|
}
|
/**
|
* Construct authoptions from the client and platform passed values
|
* @param authOptions
|
*/
|
function buildAuthOptions(authOptions) {
|
return {
|
clientCapabilities: [],
|
azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
|
instanceAware: false,
|
isMcp: false,
|
...authOptions,
|
};
|
}
|
/**
|
* Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
|
* @param ClientConfiguration
|
*/
|
function isOidcProtocolMode(config) {
|
return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* This class instance helps track the memory changes facilitating
|
* decisions to read from and write to the persistent cache
|
*/ class TokenCacheContext {
|
constructor(tokenCache, hasChanged) {
|
this.cache = tokenCache;
|
this.hasChanged = hasChanged;
|
}
|
/**
|
* boolean which indicates the changes in cache
|
*/
|
get cacheHasChanged() {
|
return this.hasChanged;
|
}
|
/**
|
* function to retrieve the token cache
|
*/
|
get tokenCache() {
|
return this.cache;
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Utility functions for managing date and time operations.
|
*/
|
/**
|
* return the current time in Unix time (seconds).
|
*/
|
function nowSeconds() {
|
// Date.getTime() returns in milliseconds.
|
return Math.round(new Date().getTime() / 1000.0);
|
}
|
/**
|
* Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
|
* @param seconds
|
*/
|
function toDateFromSeconds(seconds) {
|
if (seconds) {
|
return new Date(Number(seconds) * 1000);
|
}
|
return new Date();
|
}
|
/**
|
* check if a token is expired based on given UTC time in seconds.
|
* @param expiresOn
|
*/
|
function isTokenExpired(expiresOn, offset) {
|
// check for access token expiry
|
const expirationSec = Number(expiresOn) || 0;
|
const offsetCurrentTimeSec = nowSeconds() + offset;
|
// If current time + offset is greater than token expiration time, then token is expired.
|
return offsetCurrentTimeSec > expirationSec;
|
}
|
/**
|
* If the current time is earlier than the time that a token was cached at, we must discard the token
|
* i.e. The system clock was turned back after acquiring the cached token
|
* @param cachedAt
|
* @param offset
|
*/
|
function wasClockTurnedBack(cachedAt) {
|
const cachedAtSec = Number(cachedAt);
|
return cachedAtSec > nowSeconds();
|
}
|
/**
|
* Waits for t number of milliseconds
|
* @param t number
|
* @param value T
|
*/
|
function delay(t, value) {
|
return new Promise((resolve) => setTimeout(() => resolve(value), t));
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Create IdTokenEntity
|
* @param homeAccountId
|
* @param authenticationResult
|
* @param clientId
|
* @param authority
|
*/
|
function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
|
const idTokenEntity = {
|
credentialType: CredentialType.ID_TOKEN,
|
homeAccountId: homeAccountId,
|
environment: environment,
|
clientId: clientId,
|
secret: idToken,
|
realm: tenantId,
|
lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
|
};
|
return idTokenEntity;
|
}
|
/**
|
* Create AccessTokenEntity
|
* @param homeAccountId
|
* @param environment
|
* @param accessToken
|
* @param clientId
|
* @param tenantId
|
* @param scopes
|
* @param expiresOn
|
* @param extExpiresOn
|
*/
|
function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
|
const atEntity = {
|
homeAccountId: homeAccountId,
|
credentialType: CredentialType.ACCESS_TOKEN,
|
secret: accessToken,
|
cachedAt: nowSeconds().toString(),
|
expiresOn: expiresOn.toString(),
|
extendedExpiresOn: extExpiresOn.toString(),
|
environment: environment,
|
clientId: clientId,
|
realm: tenantId,
|
target: scopes,
|
tokenType: tokenType || AuthenticationScheme.BEARER,
|
lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
|
};
|
if (userAssertionHash) {
|
atEntity.userAssertionHash = userAssertionHash;
|
}
|
if (refreshOn) {
|
atEntity.refreshOn = refreshOn.toString();
|
}
|
/*
|
* Create Access Token With Auth Scheme instead of regular access token
|
* Cast to lower to handle "bearer" from ADFS
|
*/
|
if (atEntity.tokenType?.toLowerCase() !==
|
AuthenticationScheme.BEARER.toLowerCase()) {
|
atEntity.credentialType =
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
|
switch (atEntity.tokenType) {
|
case AuthenticationScheme.POP:
|
// Make sure keyId is present and add it to credential
|
const tokenClaims = extractTokenClaims(accessToken, base64Decode);
|
if (!tokenClaims?.cnf?.kid) {
|
throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
|
}
|
atEntity.keyId = tokenClaims.cnf.kid;
|
break;
|
case AuthenticationScheme.SSH:
|
atEntity.keyId = keyId;
|
}
|
}
|
return atEntity;
|
}
|
/**
|
* Create RefreshTokenEntity
|
* @param homeAccountId
|
* @param authenticationResult
|
* @param clientId
|
* @param authority
|
*/
|
function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
|
const rtEntity = {
|
credentialType: CredentialType.REFRESH_TOKEN,
|
homeAccountId: homeAccountId,
|
environment: environment,
|
clientId: clientId,
|
secret: refreshToken,
|
lastUpdatedAt: Date.now().toString(),
|
};
|
if (userAssertionHash) {
|
rtEntity.userAssertionHash = userAssertionHash;
|
}
|
if (familyId) {
|
rtEntity.familyId = familyId;
|
}
|
if (expiresOn) {
|
rtEntity.expiresOn = expiresOn.toString();
|
}
|
return rtEntity;
|
}
|
function isCredentialEntity(entity) {
|
return (entity.hasOwnProperty("homeAccountId") &&
|
entity.hasOwnProperty("environment") &&
|
entity.hasOwnProperty("credentialType") &&
|
entity.hasOwnProperty("clientId") &&
|
entity.hasOwnProperty("secret"));
|
}
|
/**
|
* Validates an entity: checks for all expected params
|
* @param entity
|
*/
|
function isAccessTokenEntity(entity) {
|
if (!entity) {
|
return false;
|
}
|
return (isCredentialEntity(entity) &&
|
entity.hasOwnProperty("realm") &&
|
entity.hasOwnProperty("target") &&
|
(entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
|
entity["credentialType"] ===
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
|
}
|
/**
|
* Validates an entity: checks for all expected params
|
* @param entity
|
*/
|
function isIdTokenEntity(entity) {
|
if (!entity) {
|
return false;
|
}
|
return (isCredentialEntity(entity) &&
|
entity.hasOwnProperty("realm") &&
|
entity["credentialType"] === CredentialType.ID_TOKEN);
|
}
|
/**
|
* Validates an entity: checks for all expected params
|
* @param entity
|
*/
|
function isRefreshTokenEntity(entity) {
|
if (!entity) {
|
return false;
|
}
|
return (isCredentialEntity(entity) &&
|
entity["credentialType"] === CredentialType.REFRESH_TOKEN);
|
}
|
/**
|
* validates if a given cache entry is "Telemetry", parses <key,value>
|
* @param key
|
* @param entity
|
*/
|
function isServerTelemetryEntity(key, entity) {
|
const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
|
let validateEntity = true;
|
if (entity) {
|
validateEntity =
|
entity.hasOwnProperty("failedRequests") &&
|
entity.hasOwnProperty("errors") &&
|
entity.hasOwnProperty("cacheHits");
|
}
|
return validateKey && validateEntity;
|
}
|
/**
|
* validates if a given cache entry is "Throttling", parses <key,value>
|
* @param key
|
* @param entity
|
*/
|
function isThrottlingEntity(key, entity) {
|
let validateKey = false;
|
if (key) {
|
validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
|
}
|
let validateEntity = true;
|
if (entity) {
|
validateEntity = entity.hasOwnProperty("throttleTime");
|
}
|
return validateKey && validateEntity;
|
}
|
/**
|
* Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
|
*/
|
function generateAppMetadataKey({ environment, clientId, }) {
|
const appMetaDataKeyArray = [
|
APP_METADATA,
|
environment,
|
clientId,
|
];
|
return appMetaDataKeyArray
|
.join(CACHE_KEY_SEPARATOR)
|
.toLowerCase();
|
}
|
/*
|
* Validates an entity: checks for all expected params
|
* @param entity
|
*/
|
function isAppMetadataEntity(key, entity) {
|
if (!entity) {
|
return false;
|
}
|
return (key.indexOf(APP_METADATA) === 0 &&
|
entity.hasOwnProperty("clientId") &&
|
entity.hasOwnProperty("environment"));
|
}
|
/**
|
* Validates an entity: checks for all expected params
|
* @param entity
|
*/
|
function isAuthorityMetadataEntity(key, entity) {
|
if (!entity) {
|
return false;
|
}
|
return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
|
entity.hasOwnProperty("aliases") &&
|
entity.hasOwnProperty("preferred_cache") &&
|
entity.hasOwnProperty("preferred_network") &&
|
entity.hasOwnProperty("canonical_authority") &&
|
entity.hasOwnProperty("authorization_endpoint") &&
|
entity.hasOwnProperty("token_endpoint") &&
|
entity.hasOwnProperty("issuer") &&
|
entity.hasOwnProperty("aliasesFromNetwork") &&
|
entity.hasOwnProperty("endpointsFromNetwork") &&
|
entity.hasOwnProperty("expiresAt") &&
|
entity.hasOwnProperty("jwks_uri"));
|
}
|
/**
|
* Reset the exiresAt value
|
*/
|
function generateAuthorityMetadataExpiresAt() {
|
return (nowSeconds() +
|
AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
|
}
|
function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
|
authorityMetadata.authorization_endpoint =
|
updatedValues.authorization_endpoint;
|
authorityMetadata.token_endpoint = updatedValues.token_endpoint;
|
authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
|
authorityMetadata.issuer = updatedValues.issuer;
|
authorityMetadata.endpointsFromNetwork = fromNetwork;
|
authorityMetadata.jwks_uri = updatedValues.jwks_uri;
|
}
|
function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
|
authorityMetadata.aliases = updatedValues.aliases;
|
authorityMetadata.preferred_cache = updatedValues.preferred_cache;
|
authorityMetadata.preferred_network = updatedValues.preferred_network;
|
authorityMetadata.aliasesFromNetwork = fromNetwork;
|
}
|
/**
|
* Returns whether or not the data needs to be refreshed
|
*/
|
function isAuthorityMetadataExpired(metadata) {
|
return metadata.expiresAt <= nowSeconds();
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Time spent sending/waiting for the response of a request to the token endpoint
|
*/
|
const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
|
const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
|
const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
|
/**
|
* Time spent on the network for refresh token acquisition
|
*/
|
const RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";
|
/**
|
* Time taken for acquiring refresh token , records RT size
|
*/
|
const RefreshTokenClientAcquireToken = "refreshTokenClientAcquireToken";
|
/**
|
* Time taken for acquiring cached refresh token
|
*/
|
const RefreshTokenClientAcquireTokenWithCachedRefreshToken = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
|
/**
|
* Helper function to create token request body in RefreshTokenClient (msal-common).
|
*/
|
const RefreshTokenClientCreateTokenRequestBody = "refreshTokenClientCreateTokenRequestBody";
|
const SilentFlowClientGenerateResultFromCacheRecord = "silentFlowClientGenerateResultFromCacheRecord";
|
/**
|
* APIs in Authorization Code Client (msal-common)
|
*/
|
const AuthClientExecuteTokenRequest = "authClientExecuteTokenRequest";
|
const AuthClientCreateTokenRequestBody = "authClientCreateTokenRequestBody";
|
const UpdateTokenEndpointAuthority = "updateTokenEndpointAuthority";
|
/**
|
* Generate functions in PopTokenGenerator (msal-common)
|
*/
|
const PopTokenGenerateCnf = "popTokenGenerateCnf";
|
/**
|
* handleServerTokenResponse API in ResponseHandler (msal-common)
|
*/
|
const HandleServerTokenResponse = "handleServerTokenResponse";
|
/**
|
* Authority functions
|
*/
|
const AuthorityResolveEndpointsAsync = "authorityResolveEndpointsAsync";
|
const AuthorityGetCloudDiscoveryMetadataFromNetwork = "authorityGetCloudDiscoveryMetadataFromNetwork";
|
const AuthorityUpdateCloudDiscoveryMetadata = "authorityUpdateCloudDiscoveryMetadata";
|
const AuthorityGetEndpointMetadataFromNetwork = "authorityGetEndpointMetadataFromNetwork";
|
const AuthorityUpdateEndpointMetadata = "authorityUpdateEndpointMetadata";
|
const AuthorityUpdateMetadataWithRegionalInformation = "authorityUpdateMetadataWithRegionalInformation";
|
/**
|
* Region Discovery functions
|
*/
|
const RegionDiscoveryDetectRegion = "regionDiscoveryDetectRegion";
|
const RegionDiscoveryGetRegionFromIMDS = "regionDiscoveryGetRegionFromIMDS";
|
const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
|
/**
|
* Cache operations
|
*/
|
const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Wraps a function with a performance measurement.
|
* Usage: invoke(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
|
* @param callback
|
* @param eventName
|
* @param logger
|
* @param telemetryClient
|
* @param correlationId
|
* @returns
|
* @internal
|
*/
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
const invoke = (callback, eventName, logger, telemetryClient, correlationId) => {
|
return (...args) => {
|
logger.trace(`Executing function '${eventName}'`, correlationId);
|
const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
|
if (correlationId) {
|
// Track number of times this API is called in a single request
|
telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
|
}
|
try {
|
const result = callback(...args);
|
inProgressEvent.end({
|
success: true,
|
});
|
logger.trace(`Returning result from '${eventName}'`, correlationId);
|
return result;
|
}
|
catch (e) {
|
logger.trace(`Error occurred in '${eventName}'`, correlationId);
|
try {
|
logger.trace(JSON.stringify(e), correlationId);
|
}
|
catch (e) {
|
logger.trace("Unable to print error message.", correlationId);
|
}
|
inProgressEvent.end({
|
success: false,
|
}, e);
|
throw e;
|
}
|
};
|
};
|
/**
|
* Wraps an async function with a performance measurement.
|
* Usage: invokeAsync(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
|
* @param callback
|
* @param eventName
|
* @param logger
|
* @param telemetryClient
|
* @param correlationId
|
* @returns
|
* @internal
|
*
|
*/
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId) => {
|
return (...args) => {
|
logger.trace(`Executing function '${eventName}'`, correlationId);
|
const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
|
if (correlationId) {
|
// Track number of times this API is called in a single request
|
telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
|
}
|
return callback(...args)
|
.then((response) => {
|
logger.trace(`Returning result from '${eventName}'`, correlationId);
|
inProgressEvent.end({
|
success: true,
|
});
|
return response;
|
})
|
.catch((e) => {
|
logger.trace(`Error occurred in '${eventName}'`, correlationId);
|
try {
|
logger.trace(JSON.stringify(e), correlationId);
|
}
|
catch (e) {
|
logger.trace("Unable to print error message.", correlationId);
|
}
|
inProgressEvent.end({
|
success: false,
|
}, e);
|
throw e;
|
});
|
};
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const KeyLocation = {
|
SW: "sw"};
|
/** @internal */
|
class PopTokenGenerator {
|
constructor(cryptoUtils, performanceClient) {
|
this.cryptoUtils = cryptoUtils;
|
this.performanceClient = performanceClient;
|
}
|
/**
|
* Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
|
* and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
|
* @param request
|
* @returns
|
*/
|
async generateCnf(request, logger) {
|
const reqCnf = await invokeAsync(this.generateKid.bind(this), PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
|
const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
|
return {
|
kid: reqCnf.kid,
|
reqCnfString,
|
};
|
}
|
/**
|
* Generates key_id for a SHR token request
|
* @param request
|
* @returns
|
*/
|
async generateKid(request) {
|
const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);
|
return {
|
kid: kidThumbprint,
|
xms_ksl: KeyLocation.SW,
|
};
|
}
|
/**
|
* Signs the POP access_token with the local generated key-pair
|
* @param accessToken
|
* @param request
|
* @returns
|
*/
|
async signPopToken(accessToken, keyId, request) {
|
return this.signPayload(accessToken, keyId, request);
|
}
|
/**
|
* Utility function to generate the signed JWT for an access_token
|
* @param payload
|
* @param kid
|
* @param request
|
* @param claims
|
* @returns
|
*/
|
async signPayload(payload, keyId, request, claims) {
|
// Deconstruct request to extract SHR parameters
|
const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
|
const resourceUrlString = resourceRequestUri
|
? new UrlString(resourceRequestUri)
|
: undefined;
|
const resourceUrlComponents = resourceUrlString?.getUrlComponents();
|
return this.cryptoUtils.signJwt({
|
at: payload,
|
ts: nowSeconds(),
|
m: resourceRequestMethod?.toUpperCase(),
|
u: resourceUrlComponents?.HostNameAndPort,
|
nonce: shrNonce || this.cryptoUtils.createNewGuid(),
|
p: resourceUrlComponents?.AbsolutePath,
|
q: resourceUrlComponents?.QueryString
|
? [[], resourceUrlComponents.QueryString]
|
: undefined,
|
client_claims: shrClaims || undefined,
|
...claims,
|
}, keyId, shrOptions, request.correlationId);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* MSAL-defined interaction required error code indicating no tokens are found in cache.
|
* @public
|
*/
|
const noTokensFound = "no_tokens_found";
|
/**
|
* MSAL-defined error code indicating a native account is unavailable on the platform.
|
* @public
|
*/
|
const nativeAccountUnavailable = "native_account_unavailable";
|
/**
|
* MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
|
* @public
|
*/
|
const refreshTokenExpired = "refresh_token_expired";
|
/**
|
* MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
|
* @public
|
*/
|
const uxNotAllowed = "ux_not_allowed";
|
/**
|
* Server-originated error code indicating interaction is required to complete the request.
|
* @public
|
*/
|
const interactionRequired = "interaction_required";
|
/**
|
* Server-originated error code indicating user consent is required.
|
* @public
|
*/
|
const consentRequired = "consent_required";
|
/**
|
* Server-originated error code indicating user login is required.
|
* @public
|
*/
|
const loginRequired = "login_required";
|
/**
|
* Server-originated error code indicating the token is invalid or corrupted.
|
* @public
|
*/
|
const badToken = "bad_token";
|
/**
|
* Server-originated error code indicating the user is in an interrupted state and interaction is required.
|
* @public
|
*/
|
const interruptedUser = "interrupted_user";
|
|
var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
|
__proto__: null,
|
badToken: badToken,
|
consentRequired: consentRequired,
|
interactionRequired: interactionRequired,
|
interruptedUser: interruptedUser,
|
loginRequired: loginRequired,
|
nativeAccountUnavailable: nativeAccountUnavailable,
|
noTokensFound: noTokensFound,
|
refreshTokenExpired: refreshTokenExpired,
|
uxNotAllowed: uxNotAllowed
|
});
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
|
*/
|
const InteractionRequiredServerErrorMessage = [
|
interactionRequired,
|
consentRequired,
|
loginRequired,
|
badToken,
|
uxNotAllowed,
|
interruptedUser,
|
];
|
const InteractionRequiredAuthSubErrorMessage = [
|
"message_only",
|
"additional_action",
|
"basic_action",
|
"user_password_expired",
|
"consent_required",
|
"bad_token",
|
"ux_not_allowed",
|
"interrupted_user",
|
];
|
/**
|
* Error thrown when user interaction is required.
|
*/
|
class InteractionRequiredAuthError extends AuthError {
|
constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
|
super(errorCode, errorMessage, subError);
|
Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
|
this.timestamp = timestamp || "";
|
this.traceId = traceId || "";
|
this.correlationId = correlationId || "";
|
this.claims = claims || "";
|
this.name = "InteractionRequiredAuthError";
|
this.errorNo = errorNo;
|
}
|
}
|
/**
|
* Helper function used to determine if an error thrown by the server requires interaction to resolve
|
* @param errorCode
|
* @param errorString
|
* @param subError
|
*/
|
function isInteractionRequiredError(errorCode, errorString, subError) {
|
const isInteractionRequiredErrorCode = !!errorCode &&
|
InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
|
const isInteractionRequiredSubError = !!subError &&
|
InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
|
const isInteractionRequiredErrorDesc = !!errorString &&
|
InteractionRequiredServerErrorMessage.some((irErrorCode) => {
|
return errorString.indexOf(irErrorCode) > -1;
|
});
|
return (isInteractionRequiredErrorCode ||
|
isInteractionRequiredErrorDesc ||
|
isInteractionRequiredSubError);
|
}
|
/**
|
* Creates an InteractionRequiredAuthError
|
*/
|
function createInteractionRequiredAuthError(errorCode, errorMessage) {
|
return new InteractionRequiredAuthError(errorCode, errorMessage);
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Error thrown when there is an error with the server code, for example, unavailability.
|
*/
|
class ServerError extends AuthError {
|
constructor(errorCode, errorMessage, subError, errorNo, status) {
|
super(errorCode, errorMessage, subError);
|
this.name = "ServerError";
|
this.errorNo = errorNo;
|
this.status = status;
|
Object.setPrototypeOf(this, ServerError.prototype);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/**
|
* Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
|
* @param base64Decode
|
* @param state
|
*/
|
function parseRequestState(base64Decode, state) {
|
if (!base64Decode) {
|
throw createClientAuthError(noCryptoObject);
|
}
|
if (!state) {
|
throw createClientAuthError(invalidState);
|
}
|
try {
|
// Split the state between library state and user passed state and decode them separately
|
const splitState = state.split(RESOURCE_DELIM);
|
const libraryState = splitState[0];
|
const userState = splitState.length > 1
|
? splitState.slice(1).join(RESOURCE_DELIM)
|
: "";
|
const libraryStateString = base64Decode(libraryState);
|
const libraryStateObj = JSON.parse(libraryStateString);
|
return {
|
userRequestState: userState || "",
|
libraryState: libraryStateObj,
|
};
|
}
|
catch (e) {
|
throw createClientAuthError(invalidState);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Class that handles response parsing.
|
* @internal
|
*/
|
class ResponseHandler {
|
constructor(clientId, cacheStorage, cryptoObj, logger, performanceClient, serializableCache, persistencePlugin) {
|
this.clientId = clientId;
|
this.cacheStorage = cacheStorage;
|
this.cryptoObj = cryptoObj;
|
this.logger = logger;
|
this.performanceClient = performanceClient;
|
this.serializableCache = serializableCache;
|
this.persistencePlugin = persistencePlugin;
|
}
|
/**
|
* Function which validates server authorization token response.
|
* @param serverResponse
|
* @param correlationId
|
* @param refreshAccessToken
|
*/
|
validateTokenResponse(serverResponse, correlationId, refreshAccessToken) {
|
// Check for error
|
if (serverResponse.error ||
|
serverResponse.error_description ||
|
serverResponse.suberror) {
|
const errString = `Error(s): ${serverResponse.error_codes || NOT_AVAILABLE} - Timestamp: ${serverResponse.timestamp || NOT_AVAILABLE} - Description: ${serverResponse.error_description || NOT_AVAILABLE} - Correlation ID: ${serverResponse.correlation_id || NOT_AVAILABLE} - Trace ID: ${serverResponse.trace_id || NOT_AVAILABLE}`;
|
const serverErrorNo = serverResponse.error_codes?.length
|
? serverResponse.error_codes[0]
|
: undefined;
|
const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
|
// check if 500 error
|
if (refreshAccessToken &&
|
serverResponse.status &&
|
serverResponse.status >=
|
HTTP_SERVER_ERROR_RANGE_START &&
|
serverResponse.status <= HTTP_SERVER_ERROR_RANGE_END) {
|
this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.\n${serverError}`, correlationId);
|
// don't throw an exception, but alert the user via a log that the token was unable to be refreshed
|
return;
|
// check if 400 error
|
}
|
else if (refreshAccessToken &&
|
serverResponse.status &&
|
serverResponse.status >=
|
HTTP_CLIENT_ERROR_RANGE_START &&
|
serverResponse.status <= HTTP_CLIENT_ERROR_RANGE_END) {
|
this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.\n${serverError}`, correlationId);
|
// don't throw an exception, but alert the user via a log that the token was unable to be refreshed
|
return;
|
}
|
if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
|
throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
|
}
|
throw serverError;
|
}
|
}
|
/**
|
* Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
|
* @param serverTokenResponse
|
* @param authority
|
*/
|
async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
|
// create an idToken object (not entity)
|
let idTokenClaims;
|
if (serverTokenResponse.id_token) {
|
idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode);
|
// token nonce check (TODO: Add a warning if no nonce is given?)
|
if (authCodePayload && authCodePayload.nonce) {
|
if (idTokenClaims.nonce !== authCodePayload.nonce) {
|
throw createClientAuthError(nonceMismatch);
|
}
|
}
|
// token max_age check
|
if (request.maxAge || request.maxAge === 0) {
|
const authTime = idTokenClaims.auth_time;
|
if (!authTime) {
|
throw createClientAuthError(authTimeNotFound);
|
}
|
checkMaxAge(authTime, request.maxAge);
|
}
|
}
|
// generate homeAccountId
|
this.homeAccountIdentifier = generateHomeAccountId(serverTokenResponse.client_info || "", authority.authorityType, this.logger, this.cryptoObj, request.correlationId, idTokenClaims);
|
// save the response tokens
|
let requestStateObj;
|
if (!!authCodePayload && !!authCodePayload.state) {
|
requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state);
|
}
|
// Add keyId from request to serverTokenResponse if defined
|
serverTokenResponse.key_id =
|
serverTokenResponse.key_id || request.sshKid || undefined;
|
const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
|
let cacheContext;
|
try {
|
if (this.persistencePlugin && this.serializableCache) {
|
this.logger.verbose("Persistence enabled, calling beforeCacheAccess", request.correlationId);
|
cacheContext = new TokenCacheContext(this.serializableCache, true);
|
await this.persistencePlugin.beforeCacheAccess(cacheContext);
|
}
|
/*
|
* When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
|
* If not present, we should return null, as it's the case that another application called removeAccount in between
|
* the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
|
* the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
|
*/
|
if (handlingRefreshTokenResponse &&
|
!forceCacheRefreshTokenResponse &&
|
cacheRecord.account) {
|
const cachedAccounts = this.cacheStorage.getAllAccounts({
|
homeAccountId: cacheRecord.account.homeAccountId,
|
environment: cacheRecord.account.environment,
|
}, request.correlationId);
|
if (cachedAccounts.length < 1) {
|
this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache", request.correlationId);
|
this.performanceClient?.addFields({
|
acntLoggedOut: true,
|
}, request.correlationId);
|
return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, undefined, serverRequestId);
|
}
|
}
|
await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), apiId, request.storeInCache);
|
}
|
finally {
|
if (this.persistencePlugin &&
|
this.serializableCache &&
|
cacheContext) {
|
this.logger.verbose("Persistence enabled, calling afterCacheAccess", request.correlationId);
|
await this.persistencePlugin.afterCacheAccess(cacheContext);
|
}
|
}
|
return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, serverTokenResponse, serverRequestId);
|
}
|
/**
|
* Generates CacheRecord
|
* @param serverTokenResponse
|
* @param idTokenObj
|
* @param authority
|
*/
|
generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
|
const env = authority.getPreferredCache();
|
if (!env) {
|
throw createClientAuthError(invalidCacheEnvironment);
|
}
|
const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
|
// IdToken: non AAD scenarios can have empty realm
|
let cachedIdToken;
|
let cachedAccount;
|
if (serverTokenResponse.id_token && !!idTokenClaims) {
|
cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
|
cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
|
this.logger, this.performanceClient);
|
}
|
// AccessToken
|
let cachedAccessToken = null;
|
if (serverTokenResponse.access_token) {
|
// If scopes not returned in server response, use request scopes
|
const responseScopes = serverTokenResponse.scope
|
? ScopeSet.fromString(serverTokenResponse.scope)
|
: new ScopeSet(request.scopes || []);
|
/*
|
* Use timestamp calculated before request
|
* Server may return timestamps as strings, parse to numbers if so.
|
*/
|
const expiresIn = (typeof serverTokenResponse.expires_in === "string"
|
? parseInt(serverTokenResponse.expires_in, 10)
|
: serverTokenResponse.expires_in) || 0;
|
const extExpiresIn = (typeof serverTokenResponse.ext_expires_in === "string"
|
? parseInt(serverTokenResponse.ext_expires_in, 10)
|
: serverTokenResponse.ext_expires_in) || 0;
|
const refreshIn = (typeof serverTokenResponse.refresh_in === "string"
|
? parseInt(serverTokenResponse.refresh_in, 10)
|
: serverTokenResponse.refresh_in) || undefined;
|
const tokenExpirationSeconds = reqTimestamp + expiresIn;
|
const extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
|
const refreshOnSeconds = refreshIn && refreshIn > 0
|
? reqTimestamp + refreshIn
|
: undefined;
|
// non AAD scenarios can have empty realm
|
cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
|
// Set resource (to be used for MCP scenarios)
|
const resource = request.resource || null;
|
if (resource) {
|
cachedAccessToken.resource = resource;
|
}
|
}
|
// refreshToken
|
let cachedRefreshToken = null;
|
if (serverTokenResponse.refresh_token) {
|
let rtExpiresOn;
|
if (serverTokenResponse.refresh_token_expires_in) {
|
const rtExpiresIn = typeof serverTokenResponse.refresh_token_expires_in ===
|
"string"
|
? parseInt(serverTokenResponse.refresh_token_expires_in, 10)
|
: serverTokenResponse.refresh_token_expires_in;
|
rtExpiresOn = reqTimestamp + rtExpiresIn;
|
this.performanceClient?.addFields({ ntwkRtExpiresOnSeconds: rtExpiresOn }, request.correlationId);
|
}
|
cachedRefreshToken = createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token, this.clientId, serverTokenResponse.foci, userAssertionHash, rtExpiresOn);
|
}
|
// appMetadata
|
let cachedAppMetadata = null;
|
if (serverTokenResponse.foci) {
|
cachedAppMetadata = {
|
clientId: this.clientId,
|
environment: env,
|
familyId: serverTokenResponse.foci,
|
};
|
}
|
return {
|
account: cachedAccount,
|
idToken: cachedIdToken,
|
accessToken: cachedAccessToken,
|
refreshToken: cachedRefreshToken,
|
appMetadata: cachedAppMetadata,
|
};
|
}
|
/**
|
* Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
|
*
|
* Optionally takes a state string that is set as-is in the response.
|
*
|
* @param cacheRecord
|
* @param idTokenObj
|
* @param fromTokenCache
|
* @param stateString
|
*/
|
static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, performanceClient, idTokenClaims, requestState, serverTokenResponse, requestId) {
|
let accessToken = "";
|
let responseScopes = [];
|
let expiresOn = null;
|
let extExpiresOn;
|
let refreshOn;
|
let familyId = "";
|
if (cacheRecord.accessToken) {
|
/*
|
* if the request object has `popKid` property, `signPopToken` will be set to false and
|
* the token will be returned unsigned
|
*/
|
if (cacheRecord.accessToken.tokenType ===
|
AuthenticationScheme.POP &&
|
!request.popKid) {
|
const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
|
const { secret, keyId } = cacheRecord.accessToken;
|
if (!keyId) {
|
throw createClientAuthError(keyIdMissing);
|
}
|
accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
|
}
|
else {
|
accessToken = cacheRecord.accessToken.secret;
|
}
|
responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
|
// Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
|
expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
|
extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
|
if (cacheRecord.accessToken.refreshOn) {
|
refreshOn = toDateFromSeconds(cacheRecord.accessToken.refreshOn);
|
}
|
}
|
if (cacheRecord.appMetadata) {
|
familyId =
|
cacheRecord.appMetadata.familyId === THE_FAMILY_ID
|
? THE_FAMILY_ID
|
: "";
|
}
|
const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
|
const tid = idTokenClaims?.tid || "";
|
// for hybrid + native bridge enablement, send back the native account Id
|
if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
|
cacheRecord.account.nativeAccountId =
|
serverTokenResponse?.spa_accountid;
|
}
|
const accountInfo = cacheRecord.account
|
? updateAccountTenantProfileData(getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
|
idTokenClaims, cacheRecord.idToken?.secret)
|
: null;
|
return {
|
authority: authority.canonicalAuthority,
|
uniqueId: uid,
|
tenantId: tid,
|
scopes: responseScopes,
|
account: accountInfo,
|
idToken: cacheRecord?.idToken?.secret || "",
|
idTokenClaims: idTokenClaims || {},
|
accessToken: accessToken,
|
fromCache: fromTokenCache,
|
expiresOn: expiresOn,
|
extExpiresOn: extExpiresOn,
|
refreshOn: refreshOn,
|
correlationId: request.correlationId,
|
requestId: requestId || "",
|
familyId: familyId,
|
tokenType: cacheRecord.accessToken?.tokenType || "",
|
state: requestState ? requestState.userRequestState : "",
|
cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
|
msGraphHost: cacheRecord.account?.msGraphHost || "",
|
code: serverTokenResponse?.spa_code,
|
fromPlatformBroker: false,
|
};
|
}
|
}
|
function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
|
logger?.verbose("setCachedAccount called", correlationId);
|
/*
|
* Check if base account is already cached. Filter by homeAccountId (identifies
|
* the user's home identity) and environment (identifies the cloud) — the two
|
* tenant-agnostic properties that uniquely locate a base AccountEntity.
|
*/
|
const accountEnvironment = environment || authority.getPreferredCache();
|
const matchedAccounts = cacheStorage.getAccountsFilteredBy({ homeAccountId, environment: accountEnvironment }, correlationId);
|
performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
|
if (matchedAccounts.length > 1) {
|
/*
|
* Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
|
* If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
|
*/
|
logger?.warning("Multiple base accounts matched homeAccountId. Ignoring cached account and creating a new base account.", correlationId);
|
}
|
const cachedAccount = matchedAccounts.length === 1 ? matchedAccounts[0] : null;
|
const baseAccount = cachedAccount ||
|
createAccountEntity({
|
homeAccountId,
|
idTokenClaims,
|
clientInfo,
|
environment,
|
cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
|
msGraphHost: authCodePayload?.msgraph_host,
|
nativeAccountId: nativeAccountId,
|
}, authority, base64Decode);
|
const tenantProfiles = baseAccount.tenantProfiles || [];
|
const tenantId = claimsTenantId || baseAccount.realm;
|
if (tenantId &&
|
!tenantProfiles.find((tenantProfile) => {
|
return tenantProfile.tenantId === tenantId;
|
})) {
|
const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, idTokenClaims);
|
tenantProfiles.push(newTenantProfile);
|
}
|
baseAccount.tenantProfiles = tenantProfiles;
|
return baseAccount;
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const CcsCredentialType = {
|
HOME_ACCOUNT_ID: "home_account_id",
|
UPN: "UPN",
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
|
if (typeof clientAssertion === "string") {
|
return clientAssertion;
|
}
|
else {
|
const config = {
|
clientId: clientId,
|
tokenEndpoint: tokenEndpoint,
|
};
|
return clientAssertion(config);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
function getRequestThumbprint(clientId, request, homeAccountId) {
|
return {
|
clientId: clientId,
|
authority: request.authority,
|
scopes: request.scopes,
|
homeAccountIdentifier: homeAccountId,
|
claims: request.claims,
|
authenticationScheme: request.authenticationScheme,
|
resourceRequestMethod: request.resourceRequestMethod,
|
resourceRequestUri: request.resourceRequestUri,
|
shrClaims: request.shrClaims,
|
sshKid: request.sshKid,
|
embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
|
};
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/** @internal */
|
class ThrottlingUtils {
|
/**
|
* Prepares a RequestThumbprint to be stored as a key.
|
* @param thumbprint
|
*/
|
static generateThrottlingStorageKey(thumbprint) {
|
return `${THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
|
}
|
/**
|
* Performs necessary throttling checks before a network request.
|
* @param cacheManager
|
* @param thumbprint
|
*/
|
static preProcess(cacheManager, thumbprint, correlationId) {
|
const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
|
const value = cacheManager.getThrottlingCache(key, correlationId);
|
if (value) {
|
if (value.throttleTime < Date.now()) {
|
cacheManager.removeItem(key, correlationId);
|
return;
|
}
|
throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
|
}
|
}
|
/**
|
* Performs necessary throttling checks after a network request.
|
* @param cacheManager
|
* @param thumbprint
|
* @param response
|
*/
|
static postProcess(cacheManager, thumbprint, response, correlationId) {
|
if (ThrottlingUtils.checkResponseStatus(response) ||
|
ThrottlingUtils.checkResponseForRetryAfter(response)) {
|
const thumbprintValue = {
|
throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
|
error: response.body.error,
|
errorCodes: response.body.error_codes,
|
errorMessage: response.body.error_description,
|
subError: response.body.suberror,
|
};
|
cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
|
}
|
}
|
/**
|
* Checks a NetworkResponse object's status codes against 429 or 5xx
|
* @param response
|
*/
|
static checkResponseStatus(response) {
|
return (response.status === 429 ||
|
(response.status >= 500 && response.status < 600));
|
}
|
/**
|
* Checks a NetworkResponse object's RetryAfter header
|
* @param response
|
*/
|
static checkResponseForRetryAfter(response) {
|
if (response.headers) {
|
return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
|
(response.status < 200 || response.status >= 300));
|
}
|
return false;
|
}
|
/**
|
* Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
|
* @param throttleTime
|
*/
|
static calculateThrottleTime(throttleTime) {
|
const time = throttleTime <= 0 ? 0 : throttleTime;
|
const currentSeconds = Date.now() / 1000;
|
return Math.floor(Math.min(currentSeconds +
|
(time || DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds + DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
|
}
|
static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
|
const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
|
const key = this.generateThrottlingStorageKey(thumbprint);
|
cacheManager.removeItem(key, request.correlationId);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Represents network related errors
|
*/
|
class NetworkError extends AuthError {
|
constructor(error, httpStatus, responseHeaders) {
|
super(error.errorCode, error.errorMessage, error.subError);
|
Object.setPrototypeOf(this, NetworkError.prototype);
|
this.name = "NetworkError";
|
this.error = error;
|
this.httpStatus = httpStatus;
|
this.responseHeaders = responseHeaders;
|
}
|
}
|
/**
|
* Creates NetworkError object for a failed network request
|
* @param error - Error to be thrown back to the caller
|
* @param httpStatus - Status code of the network request
|
* @param responseHeaders - Response headers of the network request, when available
|
* @returns NetworkError object
|
*/
|
function createNetworkError(error, httpStatus, responseHeaders, additionalError) {
|
error.errorMessage = `${error.errorMessage}, additionalErrorInfo: error.name:${additionalError?.name}, error.message:${additionalError?.message}`;
|
return new NetworkError(error, httpStatus, responseHeaders);
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Creates default headers for requests to token endpoint
|
*/
|
function createTokenRequestHeaders(logger, preventCorsPreflight, ccsCred) {
|
const headers = {};
|
headers[HeaderNames.CONTENT_TYPE] = URL_FORM_CONTENT_TYPE;
|
if (!preventCorsPreflight && ccsCred) {
|
switch (ccsCred.type) {
|
case CcsCredentialType.HOME_ACCOUNT_ID:
|
try {
|
const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
|
headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
|
}
|
catch (e) {
|
logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, "");
|
}
|
break;
|
case CcsCredentialType.UPN:
|
headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
|
break;
|
}
|
}
|
return headers;
|
}
|
/**
|
* Creates query string for the /token request
|
* @param request
|
*/
|
function createTokenQueryParameters(request, clientId, redirectUri, performanceClient) {
|
const parameters = new Map();
|
if (request.embeddedClientId) {
|
addBrokerParameters(parameters, clientId, redirectUri);
|
}
|
if (request.extraQueryParameters) {
|
addExtraParameters(parameters, request.extraQueryParameters);
|
}
|
addCorrelationId(parameters, request.correlationId);
|
instrumentBrokerParams(parameters, request.correlationId, performanceClient);
|
return mapToQueryString(parameters);
|
}
|
/**
|
* Http post to token endpoint
|
* @param tokenEndpoint
|
* @param queryString
|
* @param headers
|
* @param thumbprint
|
*/
|
async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
|
const response = await sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId, cacheManager, networkClient, logger, performanceClient);
|
if (serverTelemetryManager &&
|
response.status < 500 &&
|
response.status !== 429) {
|
// Telemetry data successfully logged by server, clear Telemetry cache
|
serverTelemetryManager.clearTelemetryCache();
|
}
|
return response;
|
}
|
/**
|
* Wraps sendPostRequestAsync with necessary preflight and postflight logic
|
* @param thumbprint - Request thumbprint for throttling
|
* @param tokenEndpoint - Endpoint to make the POST to
|
* @param options - Body and Headers to include on the POST request
|
* @param correlationId - CorrelationId for telemetry
|
* @param cacheManager - Cache manager instance
|
* @param networkClient - Network module instance
|
* @param logger - Logger instance
|
* @param performanceClient - Performance client instance
|
*/
|
async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
|
ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
|
let response;
|
try {
|
response = await invokeAsync((networkClient.sendPostRequestAsync.bind(networkClient)), NetworkClientSendPostRequestAsync, logger, performanceClient, correlationId)(tokenEndpoint, options);
|
const responseHeaders = response.headers || {};
|
performanceClient?.addFields({
|
refreshTokenSize: response.body.refresh_token?.length || 0,
|
httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
|
requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
|
}, correlationId);
|
}
|
catch (e) {
|
if (e instanceof NetworkError) {
|
const responseHeaders = e.responseHeaders;
|
if (responseHeaders) {
|
performanceClient?.addFields({
|
httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] ||
|
"",
|
requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
|
contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
|
undefined,
|
contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
|
undefined,
|
httpStatus: e.httpStatus,
|
}, correlationId);
|
}
|
throw e.error;
|
}
|
if (e instanceof AuthError) {
|
throw e;
|
}
|
else {
|
throw createClientAuthError(networkError);
|
}
|
}
|
ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
|
return response;
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
function isOpenIdConfigResponse(response) {
|
return (response.hasOwnProperty("authorization_endpoint") &&
|
response.hasOwnProperty("token_endpoint") &&
|
response.hasOwnProperty("issuer") &&
|
response.hasOwnProperty("jwks_uri"));
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
function isCloudInstanceDiscoveryResponse(response) {
|
return (response.hasOwnProperty("tenant_discovery_endpoint") &&
|
response.hasOwnProperty("metadata"));
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
function isCloudInstanceDiscoveryErrorResponse(response) {
|
return (response.hasOwnProperty("error") &&
|
response.hasOwnProperty("error_description"));
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class RegionDiscovery {
|
constructor(networkInterface, logger, performanceClient, correlationId) {
|
this.networkInterface = networkInterface;
|
this.logger = logger;
|
this.performanceClient = performanceClient;
|
this.correlationId = correlationId;
|
}
|
/**
|
* Detect the region from the application's environment.
|
*
|
* @returns Promise<string | null>
|
*/
|
async detectRegion(environmentRegion, regionDiscoveryMetadata) {
|
// Initialize auto detected region with the region from the envrionment
|
let autodetectedRegionName = environmentRegion;
|
// Check if a region was detected from the environment, if not, attempt to get the region from IMDS
|
if (!autodetectedRegionName) {
|
const options = RegionDiscovery.IMDS_OPTIONS;
|
try {
|
const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
|
if (localIMDSVersionResponse.status === HTTP_SUCCESS) {
|
autodetectedRegionName = localIMDSVersionResponse.body;
|
regionDiscoveryMetadata.region_source =
|
RegionDiscoverySources.IMDS;
|
}
|
// If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
|
if (localIMDSVersionResponse.status ===
|
HTTP_BAD_REQUEST) {
|
const currentIMDSVersion = await invokeAsync(this.getCurrentVersion.bind(this), RegionDiscoveryGetCurrentVersion, this.logger, this.performanceClient, this.correlationId)(options);
|
if (!currentIMDSVersion) {
|
regionDiscoveryMetadata.region_source =
|
RegionDiscoverySources.FAILED_AUTO_DETECTION;
|
return null;
|
}
|
const currentIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(currentIMDSVersion, options);
|
if (currentIMDSVersionResponse.status ===
|
HTTP_SUCCESS) {
|
autodetectedRegionName =
|
currentIMDSVersionResponse.body;
|
regionDiscoveryMetadata.region_source =
|
RegionDiscoverySources.IMDS;
|
}
|
}
|
}
|
catch (e) {
|
regionDiscoveryMetadata.region_source =
|
RegionDiscoverySources.FAILED_AUTO_DETECTION;
|
return null;
|
}
|
}
|
else {
|
regionDiscoveryMetadata.region_source =
|
RegionDiscoverySources.ENVIRONMENT_VARIABLE;
|
}
|
// If no region was auto detected from the environment or from the IMDS endpoint, mark the attempt as a FAILED_AUTO_DETECTION
|
if (!autodetectedRegionName) {
|
regionDiscoveryMetadata.region_source =
|
RegionDiscoverySources.FAILED_AUTO_DETECTION;
|
}
|
return autodetectedRegionName || null;
|
}
|
/**
|
* Make the call to the IMDS endpoint
|
*
|
* @param imdsEndpointUrl
|
* @returns Promise<NetworkResponse<string>>
|
*/
|
async getRegionFromIMDS(version, options) {
|
return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
|
}
|
/**
|
* Get the most recent version of the IMDS endpoint available
|
*
|
* @returns Promise<string | null>
|
*/
|
async getCurrentVersion(options) {
|
try {
|
const response = await this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?format=json`, options);
|
// When IMDS endpoint is called without the api version query param, bad request response comes back with latest version.
|
if (response.status === HTTP_BAD_REQUEST &&
|
response.body &&
|
response.body["newest-versions"] &&
|
response.body["newest-versions"].length > 0) {
|
return response.body["newest-versions"][0];
|
}
|
return null;
|
}
|
catch (e) {
|
return null;
|
}
|
}
|
}
|
// Options for the IMDS endpoint request
|
RegionDiscovery.IMDS_OPTIONS = {
|
headers: {
|
Metadata: "true",
|
},
|
};
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the
|
* endpoint. It will store the pertinent config data in this object for use during token calls.
|
* @internal
|
*/
|
class Authority {
|
constructor(authority, networkInterface, cacheManager, authorityOptions, logger, correlationId, performanceClient, managedIdentity) {
|
this.canonicalAuthority = authority;
|
this._canonicalAuthority.validateAsUri();
|
this.networkInterface = networkInterface;
|
this.cacheManager = cacheManager;
|
this.authorityOptions = authorityOptions;
|
this.regionDiscoveryMetadata = {
|
region_used: undefined,
|
region_source: undefined,
|
region_outcome: undefined,
|
};
|
this.logger = logger;
|
this.performanceClient = performanceClient;
|
this.correlationId = correlationId;
|
this.managedIdentity = managedIdentity || false;
|
this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
|
}
|
/**
|
* Get {@link AuthorityType}
|
* @param authorityUri {@link IUri}
|
* @private
|
*/
|
getAuthorityType(authorityUri) {
|
// CIAM auth url pattern is being standardized as: <tenant>.ciamlogin.com
|
if (authorityUri.HostNameAndPort.endsWith(CIAM_AUTH_URL)) {
|
return AuthorityType.Ciam;
|
}
|
const pathSegments = authorityUri.PathSegments;
|
if (pathSegments.length) {
|
switch (pathSegments[0].toLowerCase()) {
|
case ADFS:
|
return AuthorityType.Adfs;
|
case DSTS:
|
return AuthorityType.Dsts;
|
}
|
}
|
return AuthorityType.Default;
|
}
|
// See above for AuthorityType
|
get authorityType() {
|
return this.getAuthorityType(this.canonicalAuthorityUrlComponents);
|
}
|
/**
|
* ProtocolMode enum representing the way endpoints are constructed.
|
*/
|
get protocolMode() {
|
return this.authorityOptions.protocolMode;
|
}
|
/**
|
* Returns authorityOptions which can be used to reinstantiate a new authority instance
|
*/
|
get options() {
|
return this.authorityOptions;
|
}
|
/**
|
* A URL that is the authority set by the developer
|
*/
|
get canonicalAuthority() {
|
return this._canonicalAuthority.urlString;
|
}
|
/**
|
* Sets canonical authority.
|
*/
|
set canonicalAuthority(url) {
|
this._canonicalAuthority = new UrlString(url);
|
this._canonicalAuthority.validateAsUri();
|
this._canonicalAuthorityUrlComponents = null;
|
}
|
/**
|
* Get authority components.
|
*/
|
get canonicalAuthorityUrlComponents() {
|
if (!this._canonicalAuthorityUrlComponents) {
|
this._canonicalAuthorityUrlComponents =
|
this._canonicalAuthority.getUrlComponents();
|
}
|
return this._canonicalAuthorityUrlComponents;
|
}
|
/**
|
* Get hostname and port i.e. login.microsoftonline.com
|
*/
|
get hostnameAndPort() {
|
return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase();
|
}
|
/**
|
* Get tenant for authority.
|
*/
|
get tenant() {
|
return this.canonicalAuthorityUrlComponents.PathSegments[0];
|
}
|
/**
|
* OAuth /authorize endpoint for requests
|
*/
|
get authorizationEndpoint() {
|
if (this.discoveryComplete()) {
|
return this.replacePath(this.metadata.authorization_endpoint);
|
}
|
else {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
/**
|
* OAuth /token endpoint for requests
|
*/
|
get tokenEndpoint() {
|
if (this.discoveryComplete()) {
|
return this.replacePath(this.metadata.token_endpoint);
|
}
|
else {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
get deviceCodeEndpoint() {
|
if (this.discoveryComplete()) {
|
return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
|
}
|
else {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
/**
|
* OAuth logout endpoint for requests
|
*/
|
get endSessionEndpoint() {
|
if (this.discoveryComplete()) {
|
// ROPC policies may not have end_session_endpoint set
|
if (!this.metadata.end_session_endpoint) {
|
throw createClientAuthError(endSessionEndpointNotSupported);
|
}
|
return this.replacePath(this.metadata.end_session_endpoint);
|
}
|
else {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
/**
|
* OAuth issuer for requests
|
*/
|
get selfSignedJwtAudience() {
|
if (this.discoveryComplete()) {
|
return this.replacePath(this.metadata.issuer);
|
}
|
else {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
/**
|
* Jwks_uri for token signing keys
|
*/
|
get jwksUri() {
|
if (this.discoveryComplete()) {
|
return this.replacePath(this.metadata.jwks_uri);
|
}
|
else {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
/**
|
* Returns a flag indicating that tenant name can be replaced in authority {@link IUri}
|
* @param authorityUri {@link IUri}
|
* @private
|
*/
|
canReplaceTenant(authorityUri) {
|
return (authorityUri.PathSegments.length === 1 &&
|
!Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) &&
|
this.getAuthorityType(authorityUri) === AuthorityType.Default &&
|
this.protocolMode !== ProtocolMode.OIDC);
|
}
|
/**
|
* Replaces tenant in url path with current tenant. Defaults to common.
|
* @param urlString
|
*/
|
replaceTenant(urlString) {
|
return urlString.replace(/{tenant}|{tenantid}/g, this.tenant);
|
}
|
/**
|
* Replaces path such as tenant or policy with the current tenant or policy.
|
* @param urlString
|
*/
|
replacePath(urlString) {
|
let endpoint = urlString;
|
const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
|
const cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
|
const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
|
const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
|
currentAuthorityParts.forEach((currentPart, index) => {
|
let cachedPart = cachedAuthorityParts[index];
|
if (index === 0 &&
|
this.canReplaceTenant(cachedAuthorityUrlComponents)) {
|
const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
|
/**
|
* Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
|
* by comparing its first path segment to the corresponding authorization endpoint path segment, which is
|
* always resolved with tenant id by OIDC.
|
*/
|
if (cachedPart !== tenantId) {
|
this.logger.verbose(`Replacing tenant domain name '${cachedPart}' with id '${tenantId}'`, this.correlationId);
|
cachedPart = tenantId;
|
}
|
}
|
if (currentPart !== cachedPart) {
|
endpoint = endpoint.replace(`/${cachedPart}/`, `/${currentPart}/`);
|
}
|
});
|
return this.replaceTenant(endpoint);
|
}
|
/**
|
* The default open id configuration endpoint for any canonical authority.
|
*/
|
get defaultOpenIdConfigurationEndpoint() {
|
const canonicalAuthorityHost = this.hostnameAndPort;
|
if (this.canonicalAuthority.endsWith("v2.0/") ||
|
this.authorityType === AuthorityType.Adfs ||
|
(this.protocolMode === ProtocolMode.OIDC &&
|
!this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost))) {
|
return `${this.canonicalAuthority}.well-known/openid-configuration`;
|
}
|
return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
|
}
|
/**
|
* Boolean that returns whether or not tenant discovery has been completed.
|
*/
|
discoveryComplete() {
|
return !!this.metadata;
|
}
|
/**
|
* Perform endpoint discovery to discover aliases, preferred_cache, preferred_network
|
* and the /authorize, /token and logout endpoints.
|
*/
|
async resolveEndpointsAsync() {
|
const metadataEntity = this.getCurrentMetadataEntity();
|
const cloudDiscoverySource = await invokeAsync(this.updateCloudDiscoveryMetadata.bind(this), AuthorityUpdateCloudDiscoveryMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
|
this.canonicalAuthority = this.canonicalAuthority.replace(this.hostnameAndPort, metadataEntity.preferred_network);
|
const endpointSource = await invokeAsync(this.updateEndpointMetadata.bind(this), AuthorityUpdateEndpointMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
|
this.updateCachedMetadata(metadataEntity, cloudDiscoverySource, {
|
source: endpointSource,
|
});
|
this.performanceClient?.addFields({
|
cloudDiscoverySource: cloudDiscoverySource,
|
authorityEndpointSource: endpointSource,
|
}, this.correlationId);
|
}
|
/**
|
* Returns metadata entity from cache if it exists, otherwiser returns a new metadata entity built
|
* from the configured canonical authority
|
* @returns
|
*/
|
getCurrentMetadataEntity() {
|
let metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort, this.correlationId);
|
if (!metadataEntity) {
|
metadataEntity = {
|
aliases: [],
|
preferred_cache: this.hostnameAndPort,
|
preferred_network: this.hostnameAndPort,
|
canonical_authority: this.canonicalAuthority,
|
authorization_endpoint: "",
|
token_endpoint: "",
|
end_session_endpoint: "",
|
issuer: "",
|
aliasesFromNetwork: false,
|
endpointsFromNetwork: false,
|
expiresAt: generateAuthorityMetadataExpiresAt(),
|
jwks_uri: "",
|
};
|
}
|
return metadataEntity;
|
}
|
/**
|
* Updates cached metadata based on metadata source and sets the instance's metadata
|
* property to the same value
|
* @param metadataEntity
|
* @param cloudDiscoverySource
|
* @param endpointMetadataResult
|
*/
|
updateCachedMetadata(metadataEntity, cloudDiscoverySource, endpointMetadataResult) {
|
if (cloudDiscoverySource !== AuthorityMetadataSource.CACHE &&
|
endpointMetadataResult?.source !==
|
AuthorityMetadataSource.CACHE) {
|
// Reset the expiration time unless both values came from a successful cache lookup
|
metadataEntity.expiresAt =
|
generateAuthorityMetadataExpiresAt();
|
metadataEntity.canonical_authority = this.canonicalAuthority;
|
}
|
const cacheKey = this.cacheManager.generateAuthorityMetadataCacheKey(metadataEntity.preferred_cache, this.correlationId);
|
this.cacheManager.setAuthorityMetadata(cacheKey, metadataEntity, this.correlationId);
|
this.metadata = metadataEntity;
|
}
|
/**
|
* Update AuthorityMetadataEntity with new endpoints and return where the information came from
|
* @param metadataEntity
|
*/
|
async updateEndpointMetadata(metadataEntity) {
|
const localMetadata = this.updateEndpointMetadataFromLocalSources(metadataEntity);
|
// Further update may be required for hardcoded metadata if regional metadata is preferred
|
if (localMetadata) {
|
if (localMetadata.source ===
|
AuthorityMetadataSource.HARDCODED_VALUES) {
|
// If the user prefers to use an azure region replace the global endpoints with regional information.
|
if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
|
if (localMetadata.metadata) {
|
const hardcodedMetadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(localMetadata.metadata);
|
updateAuthorityEndpointMetadata(metadataEntity, hardcodedMetadata, false);
|
metadataEntity.canonical_authority =
|
this.canonicalAuthority;
|
}
|
}
|
}
|
return localMetadata.source;
|
}
|
// Get metadata from network if local sources aren't available
|
let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
|
if (metadata) {
|
// If the user prefers to use an azure region replace the global endpoints with regional information.
|
if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
|
metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
|
}
|
updateAuthorityEndpointMetadata(metadataEntity, metadata, true);
|
return AuthorityMetadataSource.NETWORK;
|
}
|
else {
|
// Metadata could not be obtained from the config, cache, network or hardcoded values
|
throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
|
}
|
}
|
/**
|
* Updates endpoint metadata from local sources and returns where the information was retrieved from and the metadata config
|
* response if the source is hardcoded metadata
|
* @param metadataEntity
|
* @returns
|
*/
|
updateEndpointMetadataFromLocalSources(metadataEntity) {
|
this.logger.verbose("Attempting to get endpoint metadata from authority configuration", this.correlationId);
|
const configMetadata = this.getEndpointMetadataFromConfig();
|
if (configMetadata) {
|
this.logger.verbose("Found endpoint metadata in authority configuration", this.correlationId);
|
updateAuthorityEndpointMetadata(metadataEntity, configMetadata, false);
|
return {
|
source: AuthorityMetadataSource.CONFIG,
|
};
|
}
|
this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.", this.correlationId);
|
const hardcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
|
if (hardcodedMetadata) {
|
updateAuthorityEndpointMetadata(metadataEntity, hardcodedMetadata, false);
|
return {
|
source: AuthorityMetadataSource.HARDCODED_VALUES,
|
metadata: hardcodedMetadata,
|
};
|
}
|
else {
|
this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.", this.correlationId);
|
}
|
// Check cached metadata entity expiration status
|
const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
|
if (this.isAuthoritySameType(metadataEntity) &&
|
metadataEntity.endpointsFromNetwork &&
|
!metadataEntityExpired) {
|
// No need to update
|
this.logger.verbose("Found endpoint metadata in the cache.", "");
|
return { source: AuthorityMetadataSource.CACHE };
|
}
|
else if (metadataEntityExpired) {
|
this.logger.verbose("The metadata entity is expired.", "");
|
}
|
return null;
|
}
|
/**
|
* Compares the number of url components after the domain to determine if the cached
|
* authority metadata can be used for the requested authority. Protects against same domain different
|
* authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
|
* @param metadataEntity
|
*/
|
isAuthoritySameType(metadataEntity) {
|
const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
|
const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
|
return (cachedParts.length ===
|
this.canonicalAuthorityUrlComponents.PathSegments.length);
|
}
|
/**
|
* Parse authorityMetadata config option
|
*/
|
getEndpointMetadataFromConfig() {
|
if (this.authorityOptions.authorityMetadata) {
|
try {
|
return JSON.parse(this.authorityOptions.authorityMetadata);
|
}
|
catch (e) {
|
throw createClientConfigurationError(invalidAuthorityMetadata);
|
}
|
}
|
return null;
|
}
|
/**
|
* Gets OAuth endpoints from the given OpenID configuration endpoint.
|
*
|
* @param hasHardcodedMetadata boolean
|
*/
|
async getEndpointMetadataFromNetwork() {
|
const options = {};
|
/*
|
* TODO: Add a timeout if the authority exists in our library's
|
* hardcoded list of metadata
|
*/
|
const openIdConfigurationEndpoint = this.defaultOpenIdConfigurationEndpoint;
|
this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: attempting to retrieve OAuth endpoints from '${openIdConfigurationEndpoint}'`, this.correlationId);
|
try {
|
const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
|
const isValidResponse = isOpenIdConfigResponse(response.body);
|
if (isValidResponse) {
|
return response.body;
|
}
|
else {
|
this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration`, this.correlationId);
|
return null;
|
}
|
}
|
catch (e) {
|
this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: '${e}'`, this.correlationId);
|
return null;
|
}
|
}
|
/**
|
* Get OAuth endpoints for common authorities.
|
*/
|
getEndpointMetadataFromHardcodedValues() {
|
if (this.hostnameAndPort in EndpointMetadata) {
|
return EndpointMetadata[this.hostnameAndPort];
|
}
|
return null;
|
}
|
/**
|
* Update the retrieved metadata with regional information.
|
* User selected Azure region will be used if configured.
|
*/
|
async updateMetadataWithRegionalInformation(metadata) {
|
const userConfiguredAzureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion;
|
if (userConfiguredAzureRegion) {
|
if (userConfiguredAzureRegion !==
|
AZURE_REGION_AUTO_DISCOVER_FLAG) {
|
this.regionDiscoveryMetadata.region_outcome =
|
RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
|
this.regionDiscoveryMetadata.region_used =
|
userConfiguredAzureRegion;
|
return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
|
}
|
const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
|
?.environmentRegion, this.regionDiscoveryMetadata);
|
if (autodetectedRegionName) {
|
this.regionDiscoveryMetadata.region_outcome =
|
RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
|
this.regionDiscoveryMetadata.region_used =
|
autodetectedRegionName;
|
return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
|
}
|
this.regionDiscoveryMetadata.region_outcome =
|
RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
|
}
|
return metadata;
|
}
|
/**
|
* Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
|
* and returns where the information was retrieved from
|
* @param metadataEntity
|
* @returns AuthorityMetadataSource
|
*/
|
async updateCloudDiscoveryMetadata(metadataEntity) {
|
const localMetadataSource = this.updateCloudDiscoveryMetadataFromLocalSources(metadataEntity);
|
if (localMetadataSource) {
|
return localMetadataSource;
|
}
|
// Fallback to network as metadata source
|
const metadata = await invokeAsync(this.getCloudDiscoveryMetadataFromNetwork.bind(this), AuthorityGetCloudDiscoveryMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
|
if (metadata) {
|
updateCloudDiscoveryMetadata(metadataEntity, metadata, true);
|
return AuthorityMetadataSource.NETWORK;
|
}
|
// Metadata could not be obtained from the config, cache, network or hardcoded values
|
throw createClientConfigurationError(untrustedAuthority);
|
}
|
updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
|
this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration", this.correlationId);
|
this.logger.verbosePii(`Known Authorities: '${this.authorityOptions.knownAuthorities ||
|
NOT_APPLICABLE}'`, this.correlationId);
|
this.logger.verbosePii(`Authority Metadata: '${this.authorityOptions.authorityMetadata ||
|
NOT_APPLICABLE}'`, this.correlationId);
|
this.logger.verbosePii(`Canonical Authority: '${metadataEntity.canonical_authority || NOT_APPLICABLE}'`, this.correlationId);
|
const metadata = this.getCloudDiscoveryMetadataFromConfig();
|
if (metadata) {
|
this.logger.verbose("Found cloud discovery metadata in authority configuration", this.correlationId);
|
updateCloudDiscoveryMetadata(metadataEntity, metadata, false);
|
return AuthorityMetadataSource.CONFIG;
|
}
|
// If the cached metadata came from config but that config was not passed to this instance, we must go to hardcoded values
|
this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.", this.correlationId);
|
const hardcodedMetadata = getCloudDiscoveryMetadataFromHardcodedValues(this.hostnameAndPort);
|
if (hardcodedMetadata) {
|
this.logger.verbose("Found cloud discovery metadata from hardcoded values.", this.correlationId);
|
updateCloudDiscoveryMetadata(metadataEntity, hardcodedMetadata, false);
|
return AuthorityMetadataSource.HARDCODED_VALUES;
|
}
|
this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.", this.correlationId);
|
const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
|
if (this.isAuthoritySameType(metadataEntity) &&
|
metadataEntity.aliasesFromNetwork &&
|
!metadataEntityExpired) {
|
this.logger.verbose("Found cloud discovery metadata in the cache.", "");
|
// No need to update
|
return AuthorityMetadataSource.CACHE;
|
}
|
else if (metadataEntityExpired) {
|
this.logger.verbose("The metadata entity is expired.", "");
|
}
|
return null;
|
}
|
/**
|
* Parse cloudDiscoveryMetadata config or check knownAuthorities
|
*/
|
getCloudDiscoveryMetadataFromConfig() {
|
// CIAM does not support cloud discovery metadata
|
if (this.authorityType === AuthorityType.Ciam) {
|
this.logger.verbose("CIAM authorities do not support cloud discovery metadata, generate the aliases from authority host.", this.correlationId);
|
return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
|
}
|
// Check if network response was provided in config
|
if (this.authorityOptions.cloudDiscoveryMetadata) {
|
this.logger.verbose("The cloud discovery metadata has been provided as a network response, in the config.", this.correlationId);
|
try {
|
this.logger.verbose("Attempting to parse the cloud discovery metadata.", this.correlationId);
|
const parsedResponse = JSON.parse(this.authorityOptions.cloudDiscoveryMetadata);
|
const metadata = getCloudDiscoveryMetadataFromNetworkResponse(parsedResponse.metadata, this.hostnameAndPort);
|
this.logger.verbose("Parsed the cloud discovery metadata.", "");
|
if (metadata) {
|
this.logger.verbose("There is returnable metadata attached to the parsed cloud discovery metadata.", this.correlationId);
|
return metadata;
|
}
|
else {
|
this.logger.verbose("There is no metadata attached to the parsed cloud discovery metadata.", this.correlationId);
|
}
|
}
|
catch (e) {
|
this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.", this.correlationId);
|
throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
|
}
|
}
|
// If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
|
if (this.isInKnownAuthorities()) {
|
this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host.", this.correlationId);
|
return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
|
}
|
return null;
|
}
|
/**
|
* Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
|
*
|
* @param hasHardcodedMetadata boolean
|
*/
|
async getCloudDiscoveryMetadataFromNetwork() {
|
const instanceDiscoveryEndpoint = `${AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`;
|
const options = {};
|
/*
|
* TODO: Add a timeout if the authority exists in our library's
|
* hardcoded list of metadata
|
*/
|
let match = null;
|
try {
|
const response = await this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options);
|
let typedResponseBody;
|
let metadata;
|
if (isCloudInstanceDiscoveryResponse(response.body)) {
|
typedResponseBody =
|
response.body;
|
metadata = typedResponseBody.metadata;
|
this.logger.verbosePii(`tenant_discovery_endpoint is: '${typedResponseBody.tenant_discovery_endpoint}'`, this.correlationId);
|
}
|
else if (isCloudInstanceDiscoveryErrorResponse(response.body)) {
|
this.logger.warning(`A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: '${response.status}'`, this.correlationId);
|
typedResponseBody =
|
response.body;
|
if (typedResponseBody.error === INVALID_INSTANCE) {
|
this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance.", this.correlationId);
|
return null;
|
}
|
this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error is '${typedResponseBody.error}'`, this.correlationId);
|
this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error description is '${typedResponseBody.error_description}'`, this.correlationId);
|
this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network, correlationId) to []", this.correlationId);
|
metadata = [];
|
}
|
else {
|
this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse", this.correlationId);
|
return null;
|
}
|
this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request.", this.correlationId);
|
match = getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);
|
}
|
catch (error) {
|
if (error instanceof AuthError) {
|
this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata.\nError: '${error.errorCode}'\nError Description: '${error.errorMessage}'`, this.correlationId);
|
}
|
else {
|
const typedError = error;
|
this.logger.error(`A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata.\nError: '${typedError.name}'\nError Description: '${typedError.message}'`, this.correlationId);
|
}
|
return null;
|
}
|
// Custom Domain scenario, host is trusted because Instance Discovery call succeeded
|
if (!match) {
|
this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.", this.correlationId);
|
this.logger.verbose("Creating custom Authority for custom domain scenario.", this.correlationId);
|
match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
|
}
|
return match;
|
}
|
/**
|
* Helper function to determine if this host is included in the knownAuthorities config option
|
*/
|
isInKnownAuthorities() {
|
const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
|
return (authority &&
|
UrlString.getDomainFromUrl(authority).toLowerCase() ===
|
this.hostnameAndPort);
|
});
|
return matches.length > 0;
|
}
|
/**
|
* helper function to populate the authority based on azureCloudOptions
|
* @param authorityString
|
* @param azureCloudOptions
|
*/
|
static generateAuthority(authorityString, azureCloudOptions) {
|
let authorityAzureCloudInstance;
|
if (azureCloudOptions &&
|
azureCloudOptions.azureCloudInstance !== AzureCloudInstance.None) {
|
const tenant = azureCloudOptions.tenant
|
? azureCloudOptions.tenant
|
: DEFAULT_COMMON_TENANT;
|
authorityAzureCloudInstance = `${azureCloudOptions.azureCloudInstance}/${tenant}/`;
|
}
|
return authorityAzureCloudInstance
|
? authorityAzureCloudInstance
|
: authorityString;
|
}
|
/**
|
* Creates cloud discovery metadata object from a given host
|
* @param host
|
*/
|
static createCloudDiscoveryMetadataFromHost(host) {
|
return {
|
preferred_network: host,
|
preferred_cache: host,
|
aliases: [host],
|
};
|
}
|
/**
|
* helper function to generate environment from authority object
|
*/
|
getPreferredCache() {
|
if (this.managedIdentity) {
|
return DEFAULT_AUTHORITY_HOST;
|
}
|
else if (this.discoveryComplete()) {
|
return this.metadata.preferred_cache;
|
}
|
else {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
/**
|
* Returns whether or not the provided host is an alias of this authority instance
|
* @param host
|
*/
|
isAlias(host) {
|
return this.metadata.aliases.indexOf(host) > -1;
|
}
|
/**
|
* Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
|
* @param host
|
*/
|
isAliasOfKnownMicrosoftAuthority(host) {
|
return InstanceDiscoveryMetadataAliases.has(host);
|
}
|
/**
|
* Checks whether the provided host is that of a public cloud authority
|
*
|
* @param authority string
|
* @returns bool
|
*/
|
static isPublicCloudAuthority(host) {
|
return KNOWN_PUBLIC_CLOUDS.indexOf(host) >= 0;
|
}
|
/**
|
* Rebuild the authority string with the region
|
*
|
* @param host string
|
* @param region string
|
*/
|
static buildRegionalAuthorityString(host, region, queryString) {
|
// Create and validate a Url string object with the initial authority string
|
const authorityUrlInstance = new UrlString(host);
|
authorityUrlInstance.validateAsUri();
|
const authorityUrlParts = authorityUrlInstance.getUrlComponents();
|
let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
|
if (this.isPublicCloudAuthority(authorityUrlParts.HostNameAndPort)) {
|
hostNameAndPort = `${region}.${REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`;
|
}
|
// Include the query string portion of the url
|
const url = UrlString.constructAuthorityUriFromObject({
|
...authorityUrlInstance.getUrlComponents(),
|
HostNameAndPort: hostNameAndPort,
|
}).urlString;
|
// Add the query string if a query string was provided
|
if (queryString)
|
return `${url}?${queryString}`;
|
return url;
|
}
|
/**
|
* Replace the endpoints in the metadata object with their regional equivalents.
|
*
|
* @param metadata OpenIdConfigResponse
|
* @param azureRegion string
|
*/
|
static replaceWithRegionalInformation(metadata, azureRegion) {
|
const regionalMetadata = { ...metadata };
|
regionalMetadata.authorization_endpoint =
|
Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
|
regionalMetadata.token_endpoint =
|
Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
|
if (regionalMetadata.end_session_endpoint) {
|
regionalMetadata.end_session_endpoint =
|
Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
|
}
|
return regionalMetadata;
|
}
|
/**
|
* Transform CIAM_AUTHORIY as per the below rules:
|
* If no path segments found and it is a CIAM authority (hostname ends with .ciamlogin.com), then transform it
|
*
|
* NOTE: The transformation path should go away once STS supports CIAM with the format: `tenantIdorDomain.ciamlogin.com`
|
* `ciamlogin.com` can also change in the future and we should accommodate the same
|
*
|
* @param authority
|
*/
|
static transformCIAMAuthority(authority) {
|
let ciamAuthority = authority;
|
const authorityUrl = new UrlString(authority);
|
const authorityUrlComponents = authorityUrl.getUrlComponents();
|
// check if transformation is needed
|
if (authorityUrlComponents.PathSegments.length === 0 &&
|
authorityUrlComponents.HostNameAndPort.endsWith(CIAM_AUTH_URL)) {
|
const tenantIdOrDomain = authorityUrlComponents.HostNameAndPort.split(".")[0];
|
ciamAuthority = `${ciamAuthority}${tenantIdOrDomain}${AAD_TENANT_DOMAIN_SUFFIX}`;
|
}
|
return ciamAuthority;
|
}
|
}
|
// Reserved tenant domain names that will not be replaced with tenant id
|
Authority.reservedTenantDomains = new Set([
|
"{tenant}",
|
"{tenantid}",
|
AADAuthority.COMMON,
|
AADAuthority.CONSUMERS,
|
AADAuthority.ORGANIZATIONS,
|
]);
|
/**
|
* Extract tenantId from authority
|
*/
|
function getTenantFromAuthorityString(authority) {
|
const authorityUrl = new UrlString(authority);
|
const authorityUrlComponents = authorityUrl.getUrlComponents();
|
/**
|
* For credential matching purposes, tenantId is the last path segment of the authority URL:
|
* AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
|
* B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
|
* tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
|
*
|
* Note that we may not have any path segments in certain OIDC scenarios.
|
*/
|
const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0]?.toLowerCase();
|
switch (tenantId) {
|
case AADAuthority.COMMON:
|
case AADAuthority.ORGANIZATIONS:
|
case AADAuthority.CONSUMERS:
|
return undefined;
|
default:
|
return tenantId;
|
}
|
}
|
function formatAuthorityUri(authorityUri) {
|
return authorityUri.endsWith(FORWARD_SLASH)
|
? authorityUri
|
: `${authorityUri}${FORWARD_SLASH}`;
|
}
|
function buildStaticAuthorityOptions(authOptions) {
|
const rawCloudDiscoveryMetadata = authOptions.cloudDiscoveryMetadata;
|
let cloudDiscoveryMetadata = undefined;
|
if (rawCloudDiscoveryMetadata) {
|
try {
|
cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
|
}
|
catch (e) {
|
throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
|
}
|
}
|
return {
|
canonicalAuthority: authOptions.authority
|
? formatAuthorityUri(authOptions.authority)
|
: undefined,
|
knownAuthorities: authOptions.knownAuthorities,
|
cloudDiscoveryMetadata: cloudDiscoveryMetadata,
|
};
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Create an authority object of the correct type based on the url
|
* Performs basic authority validation - checks to see if the authority is of a valid type (i.e. aad, b2c, adfs)
|
*
|
* Also performs endpoint discovery.
|
*
|
* @param authorityUri
|
* @param networkClient
|
* @param cacheManager
|
* @param authorityOptions
|
* @param logger
|
* @param correlationId
|
* @param performanceClient
|
* @internal
|
*/
|
async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
|
const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri));
|
// Initialize authority and perform discovery endpoint check.
|
const acquireTokenAuthority = new Authority(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
|
try {
|
await invokeAsync(acquireTokenAuthority.resolveEndpointsAsync.bind(acquireTokenAuthority), AuthorityResolveEndpointsAsync, logger, performanceClient, correlationId)();
|
return acquireTokenAuthority;
|
}
|
catch (e) {
|
throw createClientAuthError(endpointResolutionError);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Oauth2.0 Authorization Code client
|
* @internal
|
*/
|
class AuthorizationCodeClient {
|
constructor(configuration, performanceClient) {
|
// Flag to indicate if client is for hybrid spa auth code redemption
|
this.includeRedirectUri = true;
|
// Set the configuration
|
this.config = buildClientConfiguration(configuration);
|
// Initialize the logger
|
this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
|
// Initialize crypto
|
this.cryptoUtils = this.config.cryptoInterface;
|
// Initialize storage interface
|
this.cacheManager = this.config.storageInterface;
|
// Set the network interface
|
this.networkClient = this.config.networkInterface;
|
// Set TelemetryManager
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
// set Authority
|
this.authority = this.config.authOptions.authority;
|
// set performance telemetry client
|
this.performanceClient = performanceClient;
|
this.oidcDefaultScopes =
|
this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
|
}
|
/**
|
* API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
|
* authorization_code_grant
|
* @param request
|
*/
|
async acquireToken(request, apiId, authCodePayload) {
|
if (!request.code) {
|
throw createClientAuthError(requestCannotBeMade);
|
}
|
// Check for new cloud instance
|
if (authCodePayload && authCodePayload.cloud_instance_host_name) {
|
await invokeAsync(this.updateTokenEndpointAuthority.bind(this), UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodePayload.cloud_instance_host_name, request.correlationId);
|
}
|
const reqTimestamp = nowSeconds();
|
const response = await invokeAsync(this.executeTokenRequest.bind(this), AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request, this.serverTelemetryManager);
|
// Retrieve requestId from response headers
|
const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
// Validate response. This function throws a server error if an error is returned by the server.
|
responseHandler.validateTokenResponse(response.body, request.correlationId);
|
return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
|
}
|
/**
|
* Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
|
* Default behaviour is to redirect the user to `window.location.href`.
|
* @param authorityUri
|
*/
|
getLogoutUri(logoutRequest) {
|
// Throw error if logoutRequest is null/undefined
|
if (!logoutRequest) {
|
throw createClientConfigurationError(logoutRequestEmpty);
|
}
|
const queryString = this.createLogoutUrlQueryString(logoutRequest);
|
// Construct logout URI
|
return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
|
}
|
/**
|
* Executes POST request to token endpoint
|
* @param authority
|
* @param request
|
*/
|
async executeTokenRequest(authority, request, serverTelemetryManager) {
|
const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), AuthClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
|
let ccsCredential = undefined;
|
if (request.clientInfo) {
|
try {
|
const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
|
ccsCredential = {
|
credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
};
|
}
|
catch (e) {
|
this.logger.verbose(`Could not parse client info for CCS Header: '${e}'`, request.correlationId);
|
}
|
}
|
const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, ccsCredential || request.ccsCredential);
|
const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
|
return invokeAsync(executePostToTokenEndpoint, AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, serverTelemetryManager);
|
}
|
/**
|
* Generates a map for all the params to be sent to the service
|
* @param request
|
*/
|
async createTokenRequestBody(request) {
|
const parameters = new Map();
|
addClientId(parameters, request.embeddedClientId ||
|
request.extraParameters?.[CLIENT_ID] ||
|
this.config.authOptions.clientId);
|
/*
|
* For hybrid spa flow, there will be a code but no verifier
|
* In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
|
*/
|
if (!this.includeRedirectUri) {
|
// Just validate
|
if (!request.redirectUri) {
|
throw createClientConfigurationError(redirectUriEmpty);
|
}
|
}
|
else {
|
// Validate and include redirect uri
|
addRedirectUri(parameters, request.redirectUri);
|
}
|
// Add scope array, parameter builder will add default scopes and dedupe
|
addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
|
addResource(parameters, request.resource);
|
// add code: user set, not validated
|
addAuthorizationCode(parameters, request.code);
|
// Add library metadata
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
addThrottling(parameters);
|
if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
}
|
// add code_verifier if passed
|
if (request.codeVerifier) {
|
addCodeVerifier(parameters, request.codeVerifier);
|
}
|
if (this.config.clientCredentials.clientSecret) {
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
}
|
if (this.config.clientCredentials.clientAssertion) {
|
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
}
|
addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
|
addClientInfo(parameters);
|
if (request.authenticationScheme === AuthenticationScheme.POP) {
|
const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
|
let reqCnfData;
|
if (!request.popKid) {
|
const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
|
reqCnfData = generatedReqCnfData.reqCnfString;
|
}
|
else {
|
reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
|
}
|
// SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
|
addPopToken(parameters, reqCnfData);
|
}
|
else if (request.authenticationScheme === AuthenticationScheme.SSH) {
|
if (request.sshJwk) {
|
addSshJwk(parameters, request.sshJwk);
|
}
|
else {
|
throw createClientConfigurationError(missingSshJwk);
|
}
|
}
|
let ccsCred = undefined;
|
if (request.clientInfo) {
|
try {
|
const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
|
ccsCred = {
|
credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
};
|
}
|
catch (e) {
|
this.logger.verbose(`Could not parse client info for CCS Header: '${e}'`, request.correlationId);
|
}
|
}
|
else {
|
ccsCred = request.ccsCredential;
|
}
|
// Adds these as parameters in the request instead of headers to prevent CORS preflight request
|
if (this.config.systemOptions.preventCorsPreflight && ccsCred) {
|
switch (ccsCred.type) {
|
case CcsCredentialType.HOME_ACCOUNT_ID:
|
try {
|
const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
|
addCcsOid(parameters, clientInfo);
|
}
|
catch (e) {
|
this.logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, request.correlationId);
|
}
|
break;
|
case CcsCredentialType.UPN:
|
addCcsUpn(parameters, ccsCred.credential);
|
break;
|
}
|
}
|
if (request.embeddedClientId) {
|
addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
|
}
|
if (request.extraParameters) {
|
addExtraParameters(parameters, request.extraParameters);
|
}
|
// Add hybrid spa parameters if not already provided
|
if (request.enableSpaAuthorizationCode &&
|
(!request.extraParameters ||
|
!request.extraParameters[RETURN_SPA_CODE])) {
|
addExtraParameters(parameters, {
|
[RETURN_SPA_CODE]: "1",
|
});
|
}
|
instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
|
return mapToQueryString(parameters);
|
}
|
/**
|
* This API validates the `EndSessionRequest` and creates a URL
|
* @param request
|
*/
|
createLogoutUrlQueryString(request) {
|
const parameters = new Map();
|
if (request.postLogoutRedirectUri) {
|
addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
|
}
|
if (request.correlationId) {
|
addCorrelationId(parameters, request.correlationId);
|
}
|
if (request.idTokenHint) {
|
addIdTokenHint(parameters, request.idTokenHint);
|
}
|
if (request.state) {
|
addState(parameters, request.state);
|
}
|
if (request.logoutHint) {
|
addLogoutHint(parameters, request.logoutHint);
|
}
|
if (request.extraQueryParameters) {
|
addExtraParameters(parameters, request.extraQueryParameters);
|
}
|
if (this.config.authOptions.instanceAware) {
|
addInstanceAware(parameters);
|
}
|
return mapToQueryString(parameters);
|
}
|
/**
|
* Updates the authority to the cloud instance provided in the authorization response
|
* @param cloudInstanceHostName - cloud instance host name from authorization code payload
|
* @param correlationId - request correlation id
|
*/
|
async updateTokenEndpointAuthority(cloudInstanceHostName, correlationId) {
|
const cloudInstanceAuthorityUri = `https://${cloudInstanceHostName}/${this.authority.tenant}/`;
|
const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
|
this.authority = cloudInstanceAuthority;
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
|
/**
|
* OAuth2.0 refresh token client
|
* @internal
|
*/
|
class RefreshTokenClient {
|
constructor(configuration, performanceClient) {
|
// Set the configuration
|
this.config = buildClientConfiguration(configuration);
|
// Initialize the logger
|
this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
|
// Initialize crypto
|
this.cryptoUtils = this.config.cryptoInterface;
|
// Initialize storage interface
|
this.cacheManager = this.config.storageInterface;
|
// Set the network interface
|
this.networkClient = this.config.networkInterface;
|
// Set TelemetryManager
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
// set Authority
|
this.authority = this.config.authOptions.authority;
|
// set performance telemetry client
|
this.performanceClient = performanceClient;
|
}
|
async acquireToken(request, apiId) {
|
const reqTimestamp = nowSeconds();
|
const response = await invokeAsync(this.executeTokenRequest.bind(this), RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
|
// Retrieve requestId from response headers
|
const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
responseHandler.validateTokenResponse(response.body, request.correlationId);
|
return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, undefined, undefined, true, request.forceCache, requestId);
|
}
|
/**
|
* Gets cached refresh token and attaches to request, then calls acquireToken API
|
* @param request
|
*/
|
async acquireTokenByRefreshToken(request, apiId) {
|
// Cannot renew token if no request object is given.
|
if (!request) {
|
throw createClientConfigurationError(tokenRequestEmpty);
|
}
|
// We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
|
if (!request.account) {
|
throw createClientAuthError(noAccountInSilentRequest);
|
}
|
// try checking if FOCI is enabled for the given application
|
const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
|
// if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
|
if (isFOCI) {
|
try {
|
return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true, apiId);
|
}
|
catch (e) {
|
const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
|
e.errorCode ===
|
noTokensFound;
|
const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&
|
e.errorCode === INVALID_GRANT_ERROR &&
|
e.subError === CLIENT_MISMATCH_ERROR;
|
// if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
|
if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
|
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
|
// throw in all other cases
|
}
|
else {
|
throw e;
|
}
|
}
|
}
|
// fall back to application refresh token acquisition
|
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
|
}
|
/**
|
* makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
|
* @param request
|
*/
|
async acquireTokenWithCachedRefreshToken(request, foci, apiId) {
|
// fetches family RT or application RT based on FOCI value
|
const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
|
if (!refreshToken) {
|
throw createInteractionRequiredAuthError(noTokensFound);
|
}
|
if (refreshToken.expiresOn) {
|
const offset = request.refreshTokenExpirationOffsetSeconds ||
|
DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
|
this.performanceClient?.addFields({
|
cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
|
rtOffsetSeconds: offset,
|
}, request.correlationId);
|
if (isTokenExpired(refreshToken.expiresOn, offset)) {
|
throw createInteractionRequiredAuthError(refreshTokenExpired);
|
}
|
}
|
// attach cached RT size to the current measurement
|
const refreshTokenRequest = {
|
...request,
|
refreshToken: refreshToken.secret,
|
authenticationScheme: request.authenticationScheme ||
|
AuthenticationScheme.BEARER,
|
ccsCredential: {
|
credential: request.account.homeAccountId,
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
},
|
};
|
try {
|
return await invokeAsync(this.acquireToken.bind(this), RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest, apiId);
|
}
|
catch (e) {
|
if (e instanceof InteractionRequiredAuthError) {
|
if (e.subError === badToken) {
|
// Remove bad refresh token from cache
|
this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache", request.correlationId);
|
const badRefreshTokenKey = this.cacheManager.generateCredentialKey(refreshToken);
|
this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
|
}
|
}
|
throw e;
|
}
|
}
|
/**
|
* Constructs the network message and makes a NW call to the underlying secure token service
|
* @param request
|
* @param authority
|
*/
|
async executeTokenRequest(request, authority) {
|
const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
|
const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, request.ccsCredential);
|
const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
|
return invokeAsync(executePostToTokenEndpoint, RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, this.serverTelemetryManager);
|
}
|
/**
|
* Helper function to create the token request body
|
* @param request
|
*/
|
async createTokenRequestBody(request) {
|
const parameters = new Map();
|
addClientId(parameters, request.embeddedClientId ||
|
request.extraParameters?.[CLIENT_ID] ||
|
this.config.authOptions.clientId);
|
if (request.redirectUri) {
|
addRedirectUri(parameters, request.redirectUri);
|
}
|
addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
|
addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
|
addClientInfo(parameters);
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
addThrottling(parameters);
|
if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
}
|
addRefreshToken(parameters, request.refreshToken);
|
if (this.config.clientCredentials.clientSecret) {
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
}
|
if (this.config.clientCredentials.clientAssertion) {
|
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
}
|
if (request.authenticationScheme === AuthenticationScheme.POP) {
|
const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
|
let reqCnfData;
|
if (!request.popKid) {
|
const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
|
reqCnfData = generatedReqCnfData.reqCnfString;
|
}
|
else {
|
reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
|
}
|
// SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
|
addPopToken(parameters, reqCnfData);
|
}
|
else if (request.authenticationScheme === AuthenticationScheme.SSH) {
|
if (request.sshJwk) {
|
addSshJwk(parameters, request.sshJwk);
|
}
|
else {
|
throw createClientConfigurationError(missingSshJwk);
|
}
|
}
|
if (this.config.systemOptions.preventCorsPreflight &&
|
request.ccsCredential) {
|
switch (request.ccsCredential.type) {
|
case CcsCredentialType.HOME_ACCOUNT_ID:
|
try {
|
const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
|
addCcsOid(parameters, clientInfo);
|
}
|
catch (e) {
|
this.logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, request.correlationId);
|
}
|
break;
|
case CcsCredentialType.UPN:
|
addCcsUpn(parameters, request.ccsCredential.credential);
|
break;
|
}
|
}
|
if (request.embeddedClientId) {
|
addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
|
}
|
if (request.extraParameters) {
|
addExtraParameters(parameters, {
|
...request.extraParameters,
|
});
|
}
|
instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
|
return mapToQueryString(parameters);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/** @internal */
|
class SilentFlowClient {
|
constructor(configuration, performanceClient) {
|
// Set the configuration
|
this.config = buildClientConfiguration(configuration);
|
// Initialize the logger
|
this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
|
// Initialize crypto
|
this.cryptoUtils = this.config.cryptoInterface;
|
// Initialize storage interface
|
this.cacheManager = this.config.storageInterface;
|
// Set the network interface
|
this.networkClient = this.config.networkInterface;
|
// Set TelemetryManager
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
// set Authority
|
this.authority = this.config.authOptions.authority;
|
// set performance telemetry client
|
this.performanceClient = performanceClient;
|
}
|
/**
|
* Retrieves token from cache or throws an error if it must be refreshed.
|
* @param request
|
*/
|
async acquireCachedToken(request) {
|
let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
|
if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
|
// Must refresh due to present force_refresh flag.
|
this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
|
throw createClientAuthError(tokenRefreshRequired);
|
}
|
// We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
|
if (!request.account) {
|
throw createClientAuthError(noAccountInSilentRequest);
|
}
|
const requestTenantId = request.account.tenantId ||
|
getTenantFromAuthorityString(request.authority);
|
const tokenKeys = this.cacheManager.getTokenKeys();
|
const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
|
if (!cachedAccessToken) {
|
// must refresh due to non-existent access_token
|
this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
|
throw createClientAuthError(tokenRefreshRequired);
|
}
|
else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
|
isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
|
// must refresh due to the expires_in value
|
this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
|
throw createClientAuthError(tokenRefreshRequired);
|
}
|
else if (request.resource) {
|
// cached access token must have a resource that matches the request resource for MCP scenarios
|
if (cachedAccessToken.resource !== request.resource) {
|
this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
|
throw createClientAuthError(tokenRefreshRequired);
|
}
|
}
|
else if (cachedAccessToken.refreshOn &&
|
isTokenExpired(cachedAccessToken.refreshOn, 0)) {
|
// must refresh (in the background) due to the refresh_in value
|
lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
|
// don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
|
}
|
const environment = request.authority || this.authority.getPreferredCache();
|
const cacheRecord = {
|
account: this.cacheManager.getAccount(this.cacheManager.generateAccountKey(request.account), request.correlationId),
|
accessToken: cachedAccessToken,
|
idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId),
|
refreshToken: null,
|
appMetadata: this.cacheManager.readAppMetadataFromCache(environment, request.correlationId),
|
};
|
this.setCacheOutcome(lastCacheOutcome, request.correlationId);
|
if (this.config.serverTelemetryManager) {
|
this.config.serverTelemetryManager.incrementCacheHits();
|
}
|
return [
|
await invokeAsync(this.generateResultFromCacheRecord.bind(this), SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),
|
lastCacheOutcome,
|
];
|
}
|
setCacheOutcome(cacheOutcome, correlationId) {
|
this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
|
this.performanceClient?.addFields({
|
cacheOutcome: cacheOutcome,
|
}, correlationId);
|
if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
|
this.logger.info(`Token refresh is required due to cache outcome: '${cacheOutcome}'`, correlationId);
|
}
|
}
|
/**
|
* Helper function to build response object from the CacheRecord
|
* @param cacheRecord
|
*/
|
async generateResultFromCacheRecord(cacheRecord, request) {
|
let idTokenClaims;
|
if (cacheRecord.idToken) {
|
idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
|
}
|
// token max_age check
|
if (request.maxAge || request.maxAge === 0) {
|
const authTime = idTokenClaims?.auth_time;
|
if (!authTime) {
|
throw createClientAuthError(authTimeNotFound);
|
}
|
checkMaxAge(authTime, request.maxAge);
|
}
|
return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
|
}
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
|
* @param config
|
* @param request
|
* @param logger
|
* @param performanceClient
|
* @returns
|
*/
|
function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
|
// generate the correlationId if not set by the user and add
|
const correlationId = request.correlationId;
|
const parameters = new Map();
|
addClientId(parameters, request.embeddedClientId ||
|
request.extraQueryParameters?.[CLIENT_ID] ||
|
authOptions.clientId);
|
const requestScopes = [
|
...(request.scopes || []),
|
...(request.extraScopesToConsent || []),
|
];
|
addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
|
addResource(parameters, request.resource);
|
addRedirectUri(parameters, request.redirectUri);
|
addCorrelationId(parameters, correlationId);
|
// add response_mode. If not passed in it defaults to query.
|
addResponseMode(parameters, request.responseMode);
|
// add client_info=1
|
addClientInfo(parameters);
|
// add clidata=1
|
addCliData(parameters);
|
if (request.prompt) {
|
addPrompt(parameters, request.prompt);
|
}
|
if (request.domainHint) {
|
addDomainHint(parameters, request.domainHint);
|
}
|
// Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
|
if (request.prompt !== PromptValue$1.SELECT_ACCOUNT) {
|
// AAD will throw if prompt=select_account is passed with an account hint
|
if (request.sid && request.prompt === PromptValue$1.NONE) {
|
// SessionID is only used in silent calls
|
logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request", request.correlationId);
|
addSid(parameters, request.sid);
|
}
|
else if (request.account) {
|
const accountSid = extractAccountSid(request.account);
|
let accountLoginHintClaim = extractLoginHint(request.account);
|
if (accountLoginHintClaim && request.domainHint) {
|
logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`, request.correlationId);
|
accountLoginHintClaim = null;
|
}
|
// If login_hint claim is present, use it over sid/username
|
if (accountLoginHintClaim) {
|
logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account", request.correlationId);
|
addLoginHint(parameters, accountLoginHintClaim);
|
try {
|
const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
|
addCcsOid(parameters, clientInfo);
|
}
|
catch (e) {
|
logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
|
}
|
}
|
else if (accountSid && request.prompt === PromptValue$1.NONE) {
|
/*
|
* If account and loginHint are provided, we will check account first for sid before adding loginHint
|
* SessionId is only used in silent calls
|
*/
|
logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account", request.correlationId);
|
addSid(parameters, accountSid);
|
try {
|
const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
|
addCcsOid(parameters, clientInfo);
|
}
|
catch (e) {
|
logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
|
}
|
}
|
else if (request.loginHint) {
|
logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request", request.correlationId);
|
addLoginHint(parameters, request.loginHint);
|
addCcsUpn(parameters, request.loginHint);
|
}
|
else if (request.account.username) {
|
// Fallback to account username if provided
|
logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account", request.correlationId);
|
addLoginHint(parameters, request.account.username);
|
try {
|
const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
|
addCcsOid(parameters, clientInfo);
|
}
|
catch (e) {
|
logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
|
}
|
}
|
}
|
else if (request.loginHint) {
|
logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request", request.correlationId);
|
addLoginHint(parameters, request.loginHint);
|
addCcsUpn(parameters, request.loginHint);
|
}
|
}
|
else {
|
logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints", request.correlationId);
|
}
|
if (request.nonce) {
|
addNonce(parameters, request.nonce);
|
}
|
if (request.state) {
|
addState(parameters, request.state);
|
}
|
if (request.embeddedClientId) {
|
addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
|
}
|
addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
|
// If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
|
if (authOptions.instanceAware &&
|
(!request.extraQueryParameters ||
|
!Object.keys(request.extraQueryParameters).includes(INSTANCE_AWARE))) {
|
addInstanceAware(parameters);
|
}
|
return parameters;
|
}
|
/**
|
* Returns authorize endpoint with given request parameters in the query string
|
* @param authority
|
* @param requestParameters
|
* @returns
|
*/
|
function getAuthorizeUrl(authority, requestParameters) {
|
const queryString = mapToQueryString(requestParameters);
|
return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
|
}
|
/**
|
* Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
|
* @param account
|
*/
|
function extractAccountSid(account) {
|
return account.idTokenClaims?.sid || null;
|
}
|
function extractLoginHint(account) {
|
return account.loginHint || account.idTokenClaims?.login_hint || null;
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
|
* If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
|
* This is used for MCP flows.
|
* @param isMcp - Flag indicating if application is an MCP app, from configuration
|
* @param request - Auth request
|
*/
|
function enforceResourceParameter(isMcp, request) {
|
if (!isMcp) {
|
return;
|
}
|
if (request.resource &&
|
(containsResourceParam(request.extraParameters) ||
|
containsResourceParam(request.extraQueryParameters))) {
|
throw createClientAuthError(misplacedResourceParam);
|
}
|
if (!request.resource) {
|
throw createClientAuthError(resourceParameterRequired);
|
}
|
}
|
function containsResourceParam(params) {
|
if (!params) {
|
return false;
|
}
|
return Object.prototype.hasOwnProperty.call(params, "resource");
|
}
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* AuthErrorMessage class containing string constants used by error codes and messages.
|
*/
|
const unexpectedError = "unexpected_error";
|
const postRequestFailed = "post_request_failed";
|
|
var AuthErrorCodes = /*#__PURE__*/Object.freeze({
|
__proto__: null,
|
postRequestFailed: postRequestFailed,
|
unexpectedError: unexpectedError
|
});
|
|
/*! @azure/msal-common v16.5.0 2026-04-16 */
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const skuGroupSeparator = ",";
|
const skuValueSeparator = "|";
|
function makeExtraSkuString(params) {
|
const { skus, libraryName, libraryVersion, extensionName, extensionVersion, } = params;
|
const skuMap = new Map([
|
[0, [libraryName, libraryVersion]],
|
[2, [extensionName, extensionVersion]],
|
]);
|
let skuArr = [];
|
if (skus?.length) {
|
skuArr = skus.split(skuGroupSeparator);
|
// Ignore invalid input sku param
|
if (skuArr.length < 4) {
|
return skus;
|
}
|
}
|
else {
|
skuArr = Array.from({ length: 4 }, () => skuValueSeparator);
|
}
|
skuMap.forEach((value, key) => {
|
if (value.length === 2 && value[0]?.length && value[1]?.length) {
|
setSku({
|
skuArr,
|
index: key,
|
skuName: value[0],
|
skuVersion: value[1],
|
});
|
}
|
});
|
return skuArr.join(skuGroupSeparator);
|
}
|
function setSku(params) {
|
const { skuArr, index, skuName, skuVersion } = params;
|
if (index >= skuArr.length) {
|
return;
|
}
|
skuArr[index] = [skuName, skuVersion].join(skuValueSeparator);
|
}
|
/** @internal */
|
class ServerTelemetryManager {
|
constructor(telemetryRequest, cacheManager) {
|
this.cacheOutcome = CacheOutcome.NOT_APPLICABLE;
|
this.cacheManager = cacheManager;
|
this.apiId = telemetryRequest.apiId;
|
this.correlationId = telemetryRequest.correlationId;
|
this.wrapperSKU = telemetryRequest.wrapperSKU || "";
|
this.wrapperVer = telemetryRequest.wrapperVer || "";
|
this.telemetryCacheKey =
|
SERVER_TELEM_CACHE_KEY +
|
CACHE_KEY_SEPARATOR +
|
telemetryRequest.clientId;
|
}
|
/**
|
* API to add MSER Telemetry to request
|
*/
|
generateCurrentRequestHeaderValue() {
|
const request = `${this.apiId}${SERVER_TELEM_VALUE_SEPARATOR}${this.cacheOutcome}`;
|
const platformFieldsArr = [this.wrapperSKU, this.wrapperVer];
|
const nativeBrokerErrorCode = this.getNativeBrokerErrorCode();
|
if (nativeBrokerErrorCode?.length) {
|
platformFieldsArr.push(`broker_error=${nativeBrokerErrorCode}`);
|
}
|
const platformFields = platformFieldsArr.join(SERVER_TELEM_VALUE_SEPARATOR);
|
const regionDiscoveryFields = this.getRegionDiscoveryFields();
|
const requestWithRegionDiscoveryFields = [
|
request,
|
regionDiscoveryFields,
|
].join(SERVER_TELEM_VALUE_SEPARATOR);
|
return [
|
SERVER_TELEM_SCHEMA_VERSION,
|
requestWithRegionDiscoveryFields,
|
platformFields,
|
].join(SERVER_TELEM_CATEGORY_SEPARATOR);
|
}
|
/**
|
* API to add MSER Telemetry for the last failed request
|
*/
|
generateLastRequestHeaderValue() {
|
const lastRequests = this.getLastRequests();
|
const maxErrors = ServerTelemetryManager.maxErrorsToSend(lastRequests);
|
const failedRequests = lastRequests.failedRequests
|
.slice(0, 2 * maxErrors)
|
.join(SERVER_TELEM_VALUE_SEPARATOR);
|
const errors = lastRequests.errors
|
.slice(0, maxErrors)
|
.join(SERVER_TELEM_VALUE_SEPARATOR);
|
const errorCount = lastRequests.errors.length;
|
// Indicate whether this header contains all data or partial data
|
const overflow = maxErrors < errorCount
|
? SERVER_TELEM_OVERFLOW_TRUE
|
: SERVER_TELEM_OVERFLOW_FALSE;
|
const platformFields = [errorCount, overflow].join(SERVER_TELEM_VALUE_SEPARATOR);
|
return [
|
SERVER_TELEM_SCHEMA_VERSION,
|
lastRequests.cacheHits,
|
failedRequests,
|
errors,
|
platformFields,
|
].join(SERVER_TELEM_CATEGORY_SEPARATOR);
|
}
|
/**
|
* API to cache token failures for MSER data capture
|
* @param error
|
*/
|
cacheFailedRequest(error) {
|
const lastRequests = this.getLastRequests();
|
if (lastRequests.errors.length >=
|
SERVER_TELEM_MAX_CACHED_ERRORS) {
|
// Remove a cached error to make room, first in first out
|
lastRequests.failedRequests.shift(); // apiId
|
lastRequests.failedRequests.shift(); // correlationId
|
lastRequests.errors.shift();
|
}
|
lastRequests.failedRequests.push(this.apiId, this.correlationId);
|
if (error instanceof Error && !!error && error.toString()) {
|
if (error instanceof AuthError) {
|
if (error.subError) {
|
lastRequests.errors.push(error.subError);
|
}
|
else if (error.errorCode) {
|
lastRequests.errors.push(error.errorCode);
|
}
|
else {
|
lastRequests.errors.push(error.toString());
|
}
|
}
|
else {
|
lastRequests.errors.push(error.toString());
|
}
|
}
|
else {
|
lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
|
}
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
return;
|
}
|
/**
|
* Update server telemetry cache entry by incrementing cache hit counter
|
*/
|
incrementCacheHits() {
|
const lastRequests = this.getLastRequests();
|
lastRequests.cacheHits += 1;
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
return lastRequests.cacheHits;
|
}
|
/**
|
* Get the server telemetry entity from cache or initialize a new one
|
*/
|
getLastRequests() {
|
const initialValue = {
|
failedRequests: [],
|
errors: [],
|
cacheHits: 0,
|
};
|
const lastRequests = this.cacheManager.getServerTelemetry(this.telemetryCacheKey, this.correlationId);
|
return lastRequests || initialValue;
|
}
|
/**
|
* Remove server telemetry cache entry
|
*/
|
clearTelemetryCache() {
|
const lastRequests = this.getLastRequests();
|
const numErrorsFlushed = ServerTelemetryManager.maxErrorsToSend(lastRequests);
|
const errorCount = lastRequests.errors.length;
|
if (numErrorsFlushed === errorCount) {
|
// All errors were sent on last request, clear Telemetry cache
|
this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
|
}
|
else {
|
// Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
|
const serverTelemEntity = {
|
failedRequests: lastRequests.failedRequests.slice(numErrorsFlushed * 2),
|
errors: lastRequests.errors.slice(numErrorsFlushed),
|
cacheHits: 0,
|
};
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
|
}
|
}
|
/**
|
* Returns the maximum number of errors that can be flushed to the server in the next network request
|
* @param serverTelemetryEntity
|
*/
|
static maxErrorsToSend(serverTelemetryEntity) {
|
let i;
|
let maxErrors = 0;
|
let dataSize = 0;
|
const errorCount = serverTelemetryEntity.errors.length;
|
for (i = 0; i < errorCount; i++) {
|
// failedRequests parameter contains pairs of apiId and correlationId, multiply index by 2 to preserve pairs
|
const apiId = serverTelemetryEntity.failedRequests[2 * i] || "";
|
const correlationId = serverTelemetryEntity.failedRequests[2 * i + 1] || "";
|
const errorCode = serverTelemetryEntity.errors[i] || "";
|
// Count number of characters that would be added to header, each character is 1 byte. Add 3 at the end to account for separators
|
dataSize +=
|
apiId.toString().length +
|
correlationId.toString().length +
|
errorCode.length +
|
3;
|
if (dataSize < SERVER_TELEM_MAX_LAST_HEADER_BYTES) {
|
// Adding this entry to the header would still keep header size below the limit
|
maxErrors += 1;
|
}
|
else {
|
break;
|
}
|
}
|
return maxErrors;
|
}
|
/**
|
* Get the region discovery fields
|
*
|
* @returns string
|
*/
|
getRegionDiscoveryFields() {
|
const regionDiscoveryFields = [];
|
regionDiscoveryFields.push(this.regionUsed || "");
|
regionDiscoveryFields.push(this.regionSource || "");
|
regionDiscoveryFields.push(this.regionOutcome || "");
|
return regionDiscoveryFields.join(",");
|
}
|
/**
|
* Update the region discovery metadata
|
*
|
* @param regionDiscoveryMetadata
|
* @returns void
|
*/
|
updateRegionDiscoveryMetadata(regionDiscoveryMetadata) {
|
this.regionUsed = regionDiscoveryMetadata.region_used;
|
this.regionSource = regionDiscoveryMetadata.region_source;
|
this.regionOutcome = regionDiscoveryMetadata.region_outcome;
|
}
|
/**
|
* Set cache outcome
|
*/
|
setCacheOutcome(cacheOutcome) {
|
this.cacheOutcome = cacheOutcome;
|
}
|
setNativeBrokerErrorCode(errorCode) {
|
const lastRequests = this.getLastRequests();
|
lastRequests.nativeBrokerErrorCode = errorCode;
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
}
|
getNativeBrokerErrorCode() {
|
return this.getLastRequests().nativeBrokerErrorCode;
|
}
|
clearNativeBrokerErrorCode() {
|
const lastRequests = this.getLastRequests();
|
delete lastRequests.nativeBrokerErrorCode;
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
}
|
static makeExtraSkuString(params) {
|
return makeExtraSkuString(params);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* This class deserializes cache entities read from the file into in-memory object types defined internally
|
* @internal
|
*/
|
class Deserializer {
|
/**
|
* Parse the JSON blob in memory and deserialize the content
|
* @param cachedJson - JSON blob cache
|
*/
|
static deserializeJSONBlob(jsonFile) {
|
const deserializedCache = !jsonFile ? {} : JSON.parse(jsonFile);
|
return deserializedCache;
|
}
|
/**
|
* Deserializes accounts to AccountEntity objects
|
* @param accounts - accounts of type SerializedAccountEntity
|
*/
|
static deserializeAccounts(accounts) {
|
const accountObjects = {};
|
if (accounts) {
|
Object.keys(accounts).map(function (key) {
|
const serializedAcc = accounts[key];
|
const mappedAcc = {
|
homeAccountId: serializedAcc.home_account_id,
|
environment: serializedAcc.environment,
|
realm: serializedAcc.realm,
|
localAccountId: serializedAcc.local_account_id,
|
username: serializedAcc.username,
|
authorityType: serializedAcc.authority_type,
|
name: serializedAcc.name,
|
clientInfo: serializedAcc.client_info,
|
lastModificationTime: serializedAcc.last_modification_time,
|
lastModificationApp: serializedAcc.last_modification_app,
|
tenantProfiles: serializedAcc.tenantProfiles?.map((serializedTenantProfile) => {
|
return JSON.parse(serializedTenantProfile);
|
}),
|
lastUpdatedAt: Date.now().toString(),
|
};
|
const account = {};
|
CacheManager.toObject(account, mappedAcc);
|
accountObjects[key] = account;
|
});
|
}
|
return accountObjects;
|
}
|
/**
|
* Deserializes id tokens to IdTokenEntity objects
|
* @param idTokens - credentials of type SerializedIdTokenEntity
|
*/
|
static deserializeIdTokens(idTokens) {
|
const idObjects = {};
|
if (idTokens) {
|
Object.keys(idTokens).map(function (key) {
|
const serializedIdT = idTokens[key];
|
const idToken = {
|
homeAccountId: serializedIdT.home_account_id,
|
environment: serializedIdT.environment,
|
credentialType: serializedIdT.credential_type,
|
clientId: serializedIdT.client_id,
|
secret: serializedIdT.secret,
|
realm: serializedIdT.realm,
|
lastUpdatedAt: Date.now().toString(),
|
};
|
idObjects[key] = idToken;
|
});
|
}
|
return idObjects;
|
}
|
/**
|
* Deserializes access tokens to AccessTokenEntity objects
|
* @param accessTokens - access tokens of type SerializedAccessTokenEntity
|
*/
|
static deserializeAccessTokens(accessTokens) {
|
const atObjects = {};
|
if (accessTokens) {
|
Object.keys(accessTokens).map(function (key) {
|
const serializedAT = accessTokens[key];
|
const accessToken = {
|
homeAccountId: serializedAT.home_account_id,
|
environment: serializedAT.environment,
|
credentialType: serializedAT.credential_type,
|
clientId: serializedAT.client_id,
|
secret: serializedAT.secret,
|
realm: serializedAT.realm,
|
target: serializedAT.target,
|
cachedAt: serializedAT.cached_at,
|
expiresOn: serializedAT.expires_on,
|
extendedExpiresOn: serializedAT.extended_expires_on,
|
refreshOn: serializedAT.refresh_on,
|
keyId: serializedAT.key_id,
|
tokenType: serializedAT.token_type,
|
userAssertionHash: serializedAT.userAssertionHash,
|
resource: serializedAT.resource,
|
lastUpdatedAt: Date.now().toString(),
|
};
|
atObjects[key] = accessToken;
|
});
|
}
|
return atObjects;
|
}
|
/**
|
* Deserializes refresh tokens to RefreshTokenEntity objects
|
* @param refreshTokens - refresh tokens of type SerializedRefreshTokenEntity
|
*/
|
static deserializeRefreshTokens(refreshTokens) {
|
const rtObjects = {};
|
if (refreshTokens) {
|
Object.keys(refreshTokens).map(function (key) {
|
const serializedRT = refreshTokens[key];
|
const refreshToken = {
|
homeAccountId: serializedRT.home_account_id,
|
environment: serializedRT.environment,
|
credentialType: serializedRT.credential_type,
|
clientId: serializedRT.client_id,
|
secret: serializedRT.secret,
|
familyId: serializedRT.family_id,
|
target: serializedRT.target,
|
realm: serializedRT.realm,
|
lastUpdatedAt: Date.now().toString(),
|
};
|
rtObjects[key] = refreshToken;
|
});
|
}
|
return rtObjects;
|
}
|
/**
|
* Deserializes appMetadata to AppMetaData objects
|
* @param appMetadata - app metadata of type SerializedAppMetadataEntity
|
*/
|
static deserializeAppMetadata(appMetadata) {
|
const appMetadataObjects = {};
|
if (appMetadata) {
|
Object.keys(appMetadata).map(function (key) {
|
const serializedAmdt = appMetadata[key];
|
appMetadataObjects[key] = {
|
clientId: serializedAmdt.client_id,
|
environment: serializedAmdt.environment,
|
familyId: serializedAmdt.family_id,
|
};
|
});
|
}
|
return appMetadataObjects;
|
}
|
/**
|
* Deserialize an inMemory Cache
|
* @param jsonCache - JSON blob cache
|
*/
|
static deserializeAllCache(jsonCache) {
|
return {
|
accounts: jsonCache.Account
|
? this.deserializeAccounts(jsonCache.Account)
|
: {},
|
idTokens: jsonCache.IdToken
|
? this.deserializeIdTokens(jsonCache.IdToken)
|
: {},
|
accessTokens: jsonCache.AccessToken
|
? this.deserializeAccessTokens(jsonCache.AccessToken)
|
: {},
|
refreshTokens: jsonCache.RefreshToken
|
? this.deserializeRefreshTokens(jsonCache.RefreshToken)
|
: {},
|
appMetadata: jsonCache.AppMetadata
|
? this.deserializeAppMetadata(jsonCache.AppMetadata)
|
: {},
|
};
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Warning: This set of exports is purely intended to be used by other MSAL libraries, and should be considered potentially unstable. We strongly discourage using them directly, you do so at your own risk.
|
* Breaking changes to these APIs will be shipped under a minor version, instead of a major version.
|
*/
|
|
var internals = /*#__PURE__*/Object.freeze({
|
__proto__: null,
|
Deserializer: Deserializer,
|
Serializer: Serializer
|
});
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
// MSI Constants. Docs for MSI are available here https://docs.microsoft.com/azure/app-service/overview-managed-identity
|
const DEFAULT_MANAGED_IDENTITY_ID = "system_assigned_managed_identity";
|
const MANAGED_IDENTITY_DEFAULT_TENANT = "managed_identity";
|
const DEFAULT_AUTHORITY_FOR_MANAGED_IDENTITY = `https://login.microsoftonline.com/${MANAGED_IDENTITY_DEFAULT_TENANT}/`;
|
/**
|
* Managed Identity Headers - used in network requests
|
*/
|
const ManagedIdentityHeaders = {
|
AUTHORIZATION_HEADER_NAME: "Authorization",
|
METADATA_HEADER_NAME: "Metadata",
|
APP_SERVICE_SECRET_HEADER_NAME: "X-IDENTITY-HEADER",
|
ML_AND_SF_SECRET_HEADER_NAME: "secret",
|
};
|
/**
|
* Managed Identity Query Parameters - used in network requests
|
*/
|
const ManagedIdentityQueryParameters = {
|
API_VERSION: "api-version",
|
RESOURCE: "resource",
|
SHA256_TOKEN_TO_REFRESH: "token_sha256_to_refresh",
|
XMS_CC: "xms_cc",
|
};
|
/**
|
* Managed Identity Environment Variable Names
|
*/
|
const ManagedIdentityEnvironmentVariableNames = {
|
AZURE_POD_IDENTITY_AUTHORITY_HOST: "AZURE_POD_IDENTITY_AUTHORITY_HOST",
|
DEFAULT_IDENTITY_CLIENT_ID: "DEFAULT_IDENTITY_CLIENT_ID",
|
IDENTITY_ENDPOINT: "IDENTITY_ENDPOINT",
|
IDENTITY_HEADER: "IDENTITY_HEADER",
|
IDENTITY_SERVER_THUMBPRINT: "IDENTITY_SERVER_THUMBPRINT",
|
IMDS_ENDPOINT: "IMDS_ENDPOINT",
|
MSI_ENDPOINT: "MSI_ENDPOINT",
|
MSI_SECRET: "MSI_SECRET",
|
};
|
/**
|
* Managed Identity Source Names
|
* @public
|
*/
|
const ManagedIdentitySourceNames = {
|
APP_SERVICE: "AppService",
|
AZURE_ARC: "AzureArc",
|
CLOUD_SHELL: "CloudShell",
|
DEFAULT_TO_IMDS: "DefaultToImds",
|
IMDS: "Imds",
|
MACHINE_LEARNING: "MachineLearning",
|
SERVICE_FABRIC: "ServiceFabric",
|
};
|
/**
|
* Managed Identity Ids
|
*/
|
const ManagedIdentityIdType = {
|
SYSTEM_ASSIGNED: "system-assigned",
|
USER_ASSIGNED_CLIENT_ID: "user-assigned-client-id",
|
USER_ASSIGNED_RESOURCE_ID: "user-assigned-resource-id",
|
USER_ASSIGNED_OBJECT_ID: "user-assigned-object-id",
|
};
|
/**
|
* http methods
|
*/
|
const HttpMethod = {
|
GET: "GET",
|
POST: "POST",
|
};
|
/**
|
* Constants used for region discovery
|
*/
|
const REGION_ENVIRONMENT_VARIABLE = "REGION_NAME";
|
const MSAL_FORCE_REGION = "MSAL_FORCE_REGION";
|
/**
|
* Constant used for PKCE
|
*/
|
const RANDOM_OCTET_SIZE = 32;
|
/**
|
* Constants used in PKCE
|
*/
|
const Hash = {
|
SHA256: "sha256",
|
};
|
/**
|
* Constants for encoding schemes
|
*/
|
const CharSet = {
|
CV_CHARSET: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~",
|
};
|
/**
|
* Cache Constants
|
*/
|
const CACHE = {
|
KEY_SEPARATOR: "-",
|
};
|
/**
|
* Constants
|
*/
|
const Constants = {
|
MSAL_SKU: "msal.js.node",
|
JWT_BEARER_ASSERTION_TYPE: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
|
HTTP_PROTOCOL: "http://",
|
LOCALHOST: "localhost",
|
};
|
/**
|
* API Codes for Telemetry purposes.
|
* Before adding a new code you must claim it in the MSAL Telemetry tracker as these number spaces are shared across all MSALs
|
* 0-99 Silent Flow
|
* 600-699 Device Code Flow
|
* 800-899 Auth Code Flow
|
*/
|
const ApiId = {
|
acquireTokenSilent: 62,
|
acquireTokenByUsernamePassword: 371,
|
acquireTokenByDeviceCode: 671,
|
acquireTokenByClientCredential: 771,
|
acquireTokenByOBO: 772,
|
acquireTokenWithManagedIdentity: 773,
|
acquireTokenByCode: 871,
|
acquireTokenByRefreshToken: 872,
|
};
|
/**
|
* JWT constants
|
*/
|
const JwtConstants = {
|
RSA_256: "RS256",
|
PSS_256: "PS256",
|
X5T_256: "x5t#S256",
|
X5T: "x5t",
|
X5C: "x5c",
|
AUDIENCE: "aud",
|
EXPIRATION_TIME: "exp",
|
ISSUER: "iss",
|
SUBJECT: "sub",
|
NOT_BEFORE: "nbf",
|
JWT_ID: "jti",
|
};
|
const LOOPBACK_SERVER_CONSTANTS = {
|
INTERVAL_MS: 100,
|
TIMEOUT_MS: 5000,
|
};
|
const AZURE_ARC_SECRET_FILE_MAX_SIZE_BYTES = 4096; // 4 KB
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* HTTP client implementation using Node.js native fetch API.
|
*
|
* This class provides a clean interface for making HTTP requests using the modern
|
* fetch API available in Node.js 18+. It replaces the previous implementation that
|
* relied on custom proxy handling and the legacy http/https modules.
|
*/
|
class HttpClient {
|
/**
|
* Sends an HTTP GET request to the specified URL.
|
*
|
* This method handles GET requests with optional timeout support. The timeout
|
* is implemented using AbortController, which provides a clean way to cancel
|
* fetch requests that take too long to complete.
|
*
|
* @param url - The target URL for the GET request
|
* @param options - Optional request configuration including headers
|
* @param timeout - Optional timeout in milliseconds. If specified, the request
|
* will be aborted if it doesn't complete within this time
|
* @returns Promise that resolves to a NetworkResponse containing headers, body, and status
|
* @throws {AuthError} When the request times out or response parsing fails
|
* @throws {NetworkError} When the network request fails
|
*/
|
async sendGetRequestAsync(url, options, timeout) {
|
return this.sendRequest(url, HttpMethod.GET, options, timeout);
|
}
|
/**
|
* Sends an HTTP POST request to the specified URL.
|
*
|
* This method handles POST requests with request body support. Currently,
|
* timeout functionality is not exposed for POST requests, but the underlying
|
* implementation supports it through the shared sendRequest method.
|
*
|
* @param url - The target URL for the POST request
|
* @param options - Optional request configuration including headers and body
|
* @returns Promise that resolves to a NetworkResponse containing headers, body, and status
|
* @throws {AuthError} When the request times out or response parsing fails
|
* @throws {NetworkError} When the network request fails
|
*/
|
async sendPostRequestAsync(url, options) {
|
return this.sendRequest(url, HttpMethod.POST, options);
|
}
|
/**
|
* Core HTTP request implementation using native fetch API.
|
*
|
* This method handles GET and POST HTTP requests with comprehensive
|
* timeout support and error handling. The timeout mechanism works as follows:
|
*
|
* 1. An AbortController is created for each request
|
* 2. If a timeout is specified, setTimeout is used to call abort() after the delay
|
* 3. The abort signal is passed to fetch, which will reject the promise if aborted
|
* 4. Cleanup occurs in both success and error cases to prevent timer leaks
|
*
|
* Error handling priority:
|
* 1. Timeout errors (AbortError) are converted to "Request timeout" messages
|
* 2. Network/connection errors are wrapped with "Network request failed" prefix
|
* 3. JSON parsing errors are wrapped with "Failed to parse response" prefix
|
*
|
* @param url - The target URL for the request
|
* @param method - HTTP method (GET or POST)
|
* @param options - Optional request configuration (headers, body)
|
* @param timeout - Optional timeout in milliseconds for request cancellation
|
* @returns Promise resolving to NetworkResponse with parsed JSON body
|
* @throws {AuthError} For timeouts or JSON parsing errors
|
* @throws {NetworkError} For network failures
|
*/
|
async sendRequest(url, method, options, timeout) {
|
/*
|
* Setup timeout mechanism using AbortController
|
* This provides a standard way to cancel fetch requests
|
*/
|
const controller = new AbortController();
|
let timeoutId;
|
/*
|
* Configure timeout if specified
|
* The setTimeout will trigger abort() if the request takes too long
|
*/
|
if (timeout) {
|
timeoutId = setTimeout(() => {
|
// Calling abort() will cause fetch to reject with AbortError
|
controller.abort();
|
}, timeout);
|
}
|
const fetchOptions = {
|
method: method,
|
headers: getFetchHeaders(options),
|
signal: controller.signal, // Enable cancellation via AbortController
|
};
|
if (method === HttpMethod.POST) {
|
fetchOptions.body = options?.body || "";
|
}
|
let response;
|
try {
|
response = await fetch(url, fetchOptions);
|
}
|
catch (error) {
|
// Clean up timeout to prevent memory leaks
|
if (timeoutId) {
|
clearTimeout(timeoutId);
|
}
|
if (error instanceof Error && error.name === "AbortError") {
|
throw createAuthError(networkError, "Request timeout");
|
}
|
const baseAuthError = createAuthError(networkError, `Network request failed: ${error instanceof Error ? error.message : "unknown"}`);
|
throw createNetworkError(baseAuthError, undefined, undefined, error instanceof Error ? error : undefined);
|
}
|
// Clean up timeout to prevent memory leaks
|
if (timeoutId) {
|
clearTimeout(timeoutId);
|
}
|
try {
|
return {
|
headers: getHeaderDict(response.headers),
|
body: (await response.json()),
|
status: response.status,
|
};
|
}
|
catch (error) {
|
throw createAuthError(tokenParsingError, `Failed to parse response: ${error instanceof Error ? error.message : "unknown"}`);
|
}
|
}
|
}
|
/**
|
* Converts a fetch Headers object to a plain JavaScript object.
|
*
|
* The fetch API returns headers as a Headers object with methods like get(), has(),
|
* etc. However, the rest of the MSAL codebase expects headers as a simple key-value
|
* object. This function performs that conversion.
|
*
|
* @param headers - The Headers object returned by fetch response
|
* @returns A plain object with header names as keys and values as strings
|
*/
|
function getHeaderDict(headers) {
|
const headerDict = {};
|
headers.forEach((value, key) => {
|
headerDict[key] = value;
|
});
|
return headerDict;
|
}
|
/**
|
* Converts NetworkRequestOptions headers to a fetch-compatible Headers object.
|
*
|
* The MSAL library uses plain objects for headers in NetworkRequestOptions,
|
* but the fetch API expects either a Headers object, plain object, or array
|
* of arrays. Using the Headers constructor provides better compatibility
|
* and validation.
|
*
|
* @param options - Optional NetworkRequestOptions containing headers
|
* @returns A Headers object ready for use with fetch API
|
*/
|
function getFetchHeaders(options) {
|
const headers = new Headers();
|
if (!(options && options.headers)) {
|
return headers;
|
}
|
Object.entries(options.headers).forEach(([key, value]) => {
|
headers.append(key, value);
|
});
|
return headers;
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const invalidFileExtension = "invalid_file_extension";
|
const invalidFilePath = "invalid_file_path";
|
const invalidManagedIdentityIdType = "invalid_managed_identity_id_type";
|
const invalidSecret = "invalid_secret";
|
const missingId = "missing_client_id";
|
const networkUnavailable = "network_unavailable";
|
const platformNotSupported = "platform_not_supported";
|
const unableToCreateAzureArc = "unable_to_create_azure_arc";
|
const unableToCreateCloudShell = "unable_to_create_cloud_shell";
|
const unableToCreateSource = "unable_to_create_source";
|
const unableToReadSecretFile = "unable_to_read_secret_file";
|
const userAssignedNotAvailableAtRuntime = "user_assigned_not_available_at_runtime";
|
const wwwAuthenticateHeaderMissing = "www_authenticate_header_missing";
|
const wwwAuthenticateHeaderUnsupportedFormat = "www_authenticate_header_unsupported_format";
|
const MsiEnvironmentVariableUrlMalformedErrorCodes = {
|
[ManagedIdentityEnvironmentVariableNames.AZURE_POD_IDENTITY_AUTHORITY_HOST]: "azure_pod_identity_authority_host_url_malformed",
|
[ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT]: "identity_endpoint_url_malformed",
|
[ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT]: "imds_endpoint_url_malformed",
|
[ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT]: "msi_endpoint_url_malformed",
|
};
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* ManagedIdentityErrorMessage class containing string constants used by error codes and messages.
|
*/
|
const ManagedIdentityErrorMessages = {
|
[invalidFileExtension]: "The file path in the WWW-Authenticate header does not contain a .key file.",
|
[invalidFilePath]: "The file path in the WWW-Authenticate header is not in a valid Windows or Linux Format.",
|
[invalidManagedIdentityIdType]: "More than one ManagedIdentityIdType was provided.",
|
[invalidSecret]: "The secret in the file on the file path in the WWW-Authenticate header is greater than 4096 bytes.",
|
[platformNotSupported]: "The platform is not supported by Azure Arc. Azure Arc only supports Windows and Linux.",
|
[missingId]: "A ManagedIdentityId id was not provided.",
|
[MsiEnvironmentVariableUrlMalformedErrorCodes
|
.AZURE_POD_IDENTITY_AUTHORITY_HOST]: `The Managed Identity's '${ManagedIdentityEnvironmentVariableNames.AZURE_POD_IDENTITY_AUTHORITY_HOST}' environment variable is malformed.`,
|
[MsiEnvironmentVariableUrlMalformedErrorCodes
|
.IDENTITY_ENDPOINT]: `The Managed Identity's '${ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT}' environment variable is malformed.`,
|
[MsiEnvironmentVariableUrlMalformedErrorCodes
|
.IMDS_ENDPOINT]: `The Managed Identity's '${ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT}' environment variable is malformed.`,
|
[MsiEnvironmentVariableUrlMalformedErrorCodes
|
.MSI_ENDPOINT]: `The Managed Identity's '${ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT}' environment variable is malformed.`,
|
[networkUnavailable]: "Authentication unavailable. The request to the managed identity endpoint timed out.",
|
[unableToCreateAzureArc]: "Azure Arc Managed Identities can only be system assigned.",
|
[unableToCreateCloudShell]: "Cloud Shell Managed Identities can only be system assigned.",
|
[unableToCreateSource]: "Unable to create a Managed Identity source based on environment variables.",
|
[unableToReadSecretFile]: "Unable to read the secret file.",
|
[userAssignedNotAvailableAtRuntime]: "Service Fabric user assigned managed identity ClientId or ResourceId is not configurable at runtime.",
|
[wwwAuthenticateHeaderMissing]: "A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is missing.",
|
[wwwAuthenticateHeaderUnsupportedFormat]: "A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is in an unsupported format.",
|
};
|
class ManagedIdentityError extends AuthError {
|
constructor(errorCode) {
|
super(errorCode, ManagedIdentityErrorMessages[errorCode]);
|
this.name = "ManagedIdentityError";
|
Object.setPrototypeOf(this, ManagedIdentityError.prototype);
|
}
|
}
|
function createManagedIdentityError(errorCode) {
|
return new ManagedIdentityError(errorCode);
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class ManagedIdentityId {
|
get id() {
|
return this._id;
|
}
|
set id(value) {
|
this._id = value;
|
}
|
get idType() {
|
return this._idType;
|
}
|
set idType(value) {
|
this._idType = value;
|
}
|
constructor(managedIdentityIdParams) {
|
const userAssignedClientId = managedIdentityIdParams?.userAssignedClientId;
|
const userAssignedResourceId = managedIdentityIdParams?.userAssignedResourceId;
|
const userAssignedObjectId = managedIdentityIdParams?.userAssignedObjectId;
|
if (userAssignedClientId) {
|
if (userAssignedResourceId || userAssignedObjectId) {
|
throw createManagedIdentityError(invalidManagedIdentityIdType);
|
}
|
this.id = userAssignedClientId;
|
this.idType = ManagedIdentityIdType.USER_ASSIGNED_CLIENT_ID;
|
}
|
else if (userAssignedResourceId) {
|
if (userAssignedClientId || userAssignedObjectId) {
|
throw createManagedIdentityError(invalidManagedIdentityIdType);
|
}
|
this.id = userAssignedResourceId;
|
this.idType = ManagedIdentityIdType.USER_ASSIGNED_RESOURCE_ID;
|
}
|
else if (userAssignedObjectId) {
|
if (userAssignedClientId || userAssignedResourceId) {
|
throw createManagedIdentityError(invalidManagedIdentityIdType);
|
}
|
this.id = userAssignedObjectId;
|
this.idType = ManagedIdentityIdType.USER_ASSIGNED_OBJECT_ID;
|
}
|
else {
|
this.id = DEFAULT_MANAGED_IDENTITY_ID;
|
this.idType = ManagedIdentityIdType.SYSTEM_ASSIGNED;
|
}
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* NodeAuthErrorMessage class containing string constants used by error codes and messages.
|
*/
|
const NodeAuthErrorMessage = {
|
invalidLoopbackAddressType: {
|
code: "invalid_loopback_server_address_type",
|
desc: "Loopback server address is not type string. This is unexpected.",
|
},
|
unableToLoadRedirectUri: {
|
code: "unable_to_load_redirectUrl",
|
desc: "Loopback server callback was invoked without a url. This is unexpected.",
|
},
|
noAuthCodeInResponse: {
|
code: "no_auth_code_in_response",
|
desc: "No auth code found in the server response. Please check your network trace to determine what happened.",
|
},
|
noLoopbackServerExists: {
|
code: "no_loopback_server_exists",
|
desc: "No loopback server exists yet.",
|
},
|
loopbackServerAlreadyExists: {
|
code: "loopback_server_already_exists",
|
desc: "Loopback server already exists. Cannot create another.",
|
},
|
loopbackServerTimeout: {
|
code: "loopback_server_timeout",
|
desc: "Timed out waiting for auth code listener to be registered.",
|
},
|
stateNotFoundError: {
|
code: "state_not_found",
|
desc: "State not found. Please verify that the request originated from msal.",
|
},
|
thumbprintMissing: {
|
code: "thumbprint_missing_from_client_certificate",
|
desc: "Client certificate does not contain a SHA-1 or SHA-256 thumbprint.",
|
},
|
redirectUriNotSupported: {
|
code: "redirect_uri_not_supported",
|
desc: "RedirectUri is not supported in this scenario. Please remove redirectUri from the request.",
|
},
|
};
|
class NodeAuthError extends AuthError {
|
constructor(errorCode, errorMessage) {
|
super(errorCode, errorMessage);
|
this.name = "NodeAuthError";
|
}
|
/**
|
* Creates an error thrown if loopback server address is of type string.
|
*/
|
static createInvalidLoopbackAddressTypeError() {
|
return new NodeAuthError(NodeAuthErrorMessage.invalidLoopbackAddressType.code, `${NodeAuthErrorMessage.invalidLoopbackAddressType.desc}`);
|
}
|
/**
|
* Creates an error thrown if the loopback server is unable to get a url.
|
*/
|
static createUnableToLoadRedirectUrlError() {
|
return new NodeAuthError(NodeAuthErrorMessage.unableToLoadRedirectUri.code, `${NodeAuthErrorMessage.unableToLoadRedirectUri.desc}`);
|
}
|
/**
|
* Creates an error thrown if the server response does not contain an auth code.
|
*/
|
static createNoAuthCodeInResponseError() {
|
return new NodeAuthError(NodeAuthErrorMessage.noAuthCodeInResponse.code, `${NodeAuthErrorMessage.noAuthCodeInResponse.desc}`);
|
}
|
/**
|
* Creates an error thrown if the loopback server has not been spun up yet.
|
*/
|
static createNoLoopbackServerExistsError() {
|
return new NodeAuthError(NodeAuthErrorMessage.noLoopbackServerExists.code, `${NodeAuthErrorMessage.noLoopbackServerExists.desc}`);
|
}
|
/**
|
* Creates an error thrown if a loopback server already exists when attempting to create another one.
|
*/
|
static createLoopbackServerAlreadyExistsError() {
|
return new NodeAuthError(NodeAuthErrorMessage.loopbackServerAlreadyExists.code, `${NodeAuthErrorMessage.loopbackServerAlreadyExists.desc}`);
|
}
|
/**
|
* Creates an error thrown if the loopback server times out registering the auth code listener.
|
*/
|
static createLoopbackServerTimeoutError() {
|
return new NodeAuthError(NodeAuthErrorMessage.loopbackServerTimeout.code, `${NodeAuthErrorMessage.loopbackServerTimeout.desc}`);
|
}
|
/**
|
* Creates an error thrown when the state is not present.
|
*/
|
static createStateNotFoundError() {
|
return new NodeAuthError(NodeAuthErrorMessage.stateNotFoundError.code, NodeAuthErrorMessage.stateNotFoundError.desc);
|
}
|
/**
|
* Creates an error thrown when client certificate was provided, but neither the SHA-1 or SHA-256 thumbprints were provided
|
*/
|
static createThumbprintMissingError() {
|
return new NodeAuthError(NodeAuthErrorMessage.thumbprintMissing.code, NodeAuthErrorMessage.thumbprintMissing.desc);
|
}
|
/**
|
* Creates an error thrown when redirectUri is provided in an unsupported scenario
|
*/
|
static createRedirectUriNotSupportedError() {
|
return new NodeAuthError(NodeAuthErrorMessage.redirectUriNotSupported.code, NodeAuthErrorMessage.redirectUriNotSupported.desc);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const DEFAULT_AUTH_OPTIONS = {
|
clientId: "",
|
authority: DEFAULT_AUTHORITY,
|
clientSecret: "",
|
clientAssertion: "",
|
clientCertificate: {
|
thumbprint: "",
|
thumbprintSha256: "",
|
privateKey: "",
|
x5c: "",
|
},
|
knownAuthorities: [],
|
cloudDiscoveryMetadata: "",
|
authorityMetadata: "",
|
clientCapabilities: [],
|
azureCloudOptions: {
|
azureCloudInstance: AzureCloudInstance.None,
|
tenant: "",
|
},
|
isMcp: false,
|
};
|
const DEFAULT_LOGGER_OPTIONS = {
|
loggerCallback: () => {
|
// allow users to not set logger call back
|
},
|
piiLoggingEnabled: false,
|
logLevel: exports.LogLevel.Info,
|
};
|
const DEFAULT_SYSTEM_OPTIONS = {
|
loggerOptions: DEFAULT_LOGGER_OPTIONS,
|
networkClient: new HttpClient(),
|
disableInternalRetries: false,
|
protocolMode: ProtocolMode.AAD,
|
};
|
const DEFAULT_TELEMETRY_OPTIONS = {
|
application: {
|
appName: "",
|
appVersion: "",
|
},
|
};
|
/**
|
* Sets the default options when not explicitly configured from app developer
|
*
|
* @param auth - Authentication options
|
* @param cache - Cache options
|
* @param system - System options
|
* @param telemetry - Telemetry options
|
*
|
* @returns Configuration
|
* @internal
|
*/
|
function buildAppConfiguration({ auth, broker, cache, system, telemetry, }) {
|
const systemOptions = {
|
...DEFAULT_SYSTEM_OPTIONS,
|
networkClient: new HttpClient(),
|
loggerOptions: system?.loggerOptions || DEFAULT_LOGGER_OPTIONS,
|
disableInternalRetries: system?.disableInternalRetries || false,
|
};
|
// if client certificate was provided, ensure that at least one of the SHA-1 or SHA-256 thumbprints were provided
|
if (!!auth.clientCertificate &&
|
!!!auth.clientCertificate.thumbprint &&
|
!!!auth.clientCertificate.thumbprintSha256) {
|
throw NodeAuthError.createStateNotFoundError();
|
}
|
return {
|
auth: { ...DEFAULT_AUTH_OPTIONS, ...auth },
|
broker: { ...broker },
|
cache: { ...cache },
|
system: { ...systemOptions, ...system },
|
telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
|
};
|
}
|
function buildManagedIdentityConfiguration({ clientCapabilities, managedIdentityIdParams, system, }) {
|
const managedIdentityId = new ManagedIdentityId(managedIdentityIdParams);
|
const loggerOptions = system?.loggerOptions || DEFAULT_LOGGER_OPTIONS;
|
let networkClient;
|
// use developer provided network client if passed in
|
if (system?.networkClient) {
|
networkClient = system.networkClient;
|
// otherwise, create a new one
|
}
|
else {
|
networkClient = new HttpClient();
|
}
|
return {
|
clientCapabilities: clientCapabilities || [],
|
managedIdentityId: managedIdentityId,
|
system: {
|
loggerOptions,
|
networkClient,
|
},
|
disableInternalRetries: system?.disableInternalRetries || false,
|
};
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class GuidGenerator {
|
/**
|
*
|
* RFC4122: The version 4 UUID is meant for generating UUIDs from truly-random or pseudo-random numbers.
|
* uuidv4 generates guids from cryprtographically-string random
|
*/
|
generateGuid() {
|
return uuid.v4();
|
}
|
/**
|
* verifies if a string is GUID
|
* @param guid
|
*/
|
isGuid(guid) {
|
const regexGuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
return regexGuid.test(guid);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class EncodingUtils {
|
/**
|
* 'utf8': Multibyte encoded Unicode characters. Many web pages and other document formats use UTF-8.
|
* 'base64': Base64 encoding.
|
*
|
* @param str text
|
*/
|
static base64Encode(str, encoding) {
|
return Buffer.from(str, encoding).toString(EncodingTypes.BASE64);
|
}
|
/**
|
* encode a URL
|
* @param str
|
*/
|
static base64EncodeUrl(str, encoding) {
|
return EncodingUtils.base64Encode(str, encoding)
|
.replace(/=/g, "")
|
.replace(/\+/g, "-")
|
.replace(/\//g, "_");
|
}
|
/**
|
* 'utf8': Multibyte encoded Unicode characters. Many web pages and other document formats use UTF-8.
|
* 'base64': Base64 encoding.
|
*
|
* @param base64Str Base64 encoded text
|
*/
|
static base64Decode(base64Str) {
|
return Buffer.from(base64Str, EncodingTypes.BASE64).toString("utf8");
|
}
|
/**
|
* @param base64Str Base64 encoded Url
|
*/
|
static base64DecodeUrl(base64Str) {
|
let str = base64Str.replace(/-/g, "+").replace(/_/g, "/");
|
while (str.length % 4) {
|
str += "=";
|
}
|
return EncodingUtils.base64Decode(str);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class HashUtils {
|
/**
|
* generate 'SHA256' hash
|
* @param buffer
|
*/
|
sha256(buffer) {
|
return crypto.createHash(Hash.SHA256).update(buffer).digest();
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* https://tools.ietf.org/html/rfc7636#page-8
|
*/
|
class PkceGenerator {
|
constructor() {
|
this.hashUtils = new HashUtils();
|
}
|
/**
|
* generates the codeVerfier and the challenge from the codeVerfier
|
* reference: https://tools.ietf.org/html/rfc7636#section-4.1 and https://tools.ietf.org/html/rfc7636#section-4.2
|
*/
|
async generatePkceCodes() {
|
const verifier = this.generateCodeVerifier();
|
const challenge = this.generateCodeChallengeFromVerifier(verifier);
|
return { verifier, challenge };
|
}
|
/**
|
* generates the codeVerfier; reference: https://tools.ietf.org/html/rfc7636#section-4.1
|
*/
|
generateCodeVerifier() {
|
const charArr = [];
|
const maxNumber = 256 - (256 % CharSet.CV_CHARSET.length);
|
while (charArr.length <= RANDOM_OCTET_SIZE) {
|
const byte = crypto.randomBytes(1)[0];
|
if (byte >= maxNumber) {
|
/*
|
* Ignore this number to maintain randomness.
|
* Including it would result in an unequal distribution of characters after doing the modulo
|
*/
|
continue;
|
}
|
const index = byte % CharSet.CV_CHARSET.length;
|
charArr.push(CharSet.CV_CHARSET[index]);
|
}
|
const verifier = charArr.join("");
|
return EncodingUtils.base64EncodeUrl(verifier);
|
}
|
/**
|
* generate the challenge from the codeVerfier; reference: https://tools.ietf.org/html/rfc7636#section-4.2
|
* @param codeVerifier
|
*/
|
generateCodeChallengeFromVerifier(codeVerifier) {
|
return EncodingUtils.base64EncodeUrl(this.hashUtils
|
.sha256(codeVerifier)
|
.toString(EncodingTypes.BASE64), EncodingTypes.BASE64);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* This class implements MSAL node's crypto interface, which allows it to perform base64 encoding and decoding, generating cryptographically random GUIDs and
|
* implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
|
* @public
|
*/
|
class CryptoProvider {
|
constructor() {
|
// Browser crypto needs to be validated first before any other classes can be set.
|
this.pkceGenerator = new PkceGenerator();
|
this.guidGenerator = new GuidGenerator();
|
this.hashUtils = new HashUtils();
|
}
|
/**
|
* base64 URL safe encoded string
|
*/
|
base64UrlEncode() {
|
throw new Error("Method not implemented.");
|
}
|
/**
|
* Stringifies and base64Url encodes input public key
|
* @param inputKid - public key id
|
* @returns Base64Url encoded public key
|
*/
|
encodeKid() {
|
throw new Error("Method not implemented.");
|
}
|
/**
|
* Creates a new random GUID - used to populate state and nonce.
|
* @returns string (GUID)
|
*/
|
createNewGuid() {
|
return this.guidGenerator.generateGuid();
|
}
|
/**
|
* Encodes input string to base64.
|
* @param input - string to be encoded
|
*/
|
base64Encode(input) {
|
return EncodingUtils.base64Encode(input);
|
}
|
/**
|
* Decodes input string from base64.
|
* @param input - string to be decoded
|
*/
|
base64Decode(input) {
|
return EncodingUtils.base64Decode(input);
|
}
|
/**
|
* Generates PKCE codes used in Authorization Code Flow.
|
*/
|
generatePkceCodes() {
|
return this.pkceGenerator.generatePkceCodes();
|
}
|
/**
|
* Generates a keypair, stores it and returns a thumbprint - not yet implemented for node
|
*/
|
getPublicKeyThumbprint() {
|
throw new Error("Method not implemented.");
|
}
|
/**
|
* Removes cryptographic keypair from key store matching the keyId passed in
|
* @param kid - public key id
|
*/
|
removeTokenBindingKey() {
|
throw new Error("Method not implemented.");
|
}
|
/**
|
* Removes all cryptographic keys from Keystore
|
*/
|
clearKeystore() {
|
throw new Error("Method not implemented.");
|
}
|
/**
|
* Signs the given object as a jwt payload with private key retrieved by given kid - currently not implemented for node
|
*/
|
signJwt() {
|
throw new Error("Method not implemented.");
|
}
|
/**
|
* Returns the SHA-256 hash of an input string
|
*/
|
async hashString(plainText) {
|
return EncodingUtils.base64EncodeUrl(this.hashUtils
|
.sha256(plainText)
|
.toString(EncodingTypes.BASE64), EncodingTypes.BASE64);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
function generateCredentialKey(credential) {
|
const familyId = (credential.credentialType === CredentialType.REFRESH_TOKEN &&
|
credential.familyId) ||
|
credential.clientId;
|
const scheme = credential.tokenType &&
|
credential.tokenType.toLowerCase() !==
|
AuthenticationScheme.BEARER.toLowerCase()
|
? credential.tokenType.toLowerCase()
|
: "";
|
const credentialKey = [
|
credential.homeAccountId,
|
credential.environment,
|
credential.credentialType,
|
familyId,
|
credential.realm || "",
|
credential.target || "",
|
scheme,
|
];
|
return credentialKey.join(CACHE.KEY_SEPARATOR).toLowerCase();
|
}
|
function generateAccountKey(account) {
|
const homeTenantId = account.homeAccountId.split(".")[1];
|
const accountKey = [
|
account.homeAccountId,
|
account.environment,
|
homeTenantId || account.tenantId || "",
|
];
|
return accountKey.join(CACHE.KEY_SEPARATOR).toLowerCase();
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* This class implements Storage for node, reading cache from user specified storage location or an extension library
|
* @public
|
*/
|
class NodeStorage extends CacheManager {
|
constructor(logger, clientId, cryptoImpl, staticAuthorityOptions) {
|
super(clientId, cryptoImpl, logger, new StubPerformanceClient(), staticAuthorityOptions);
|
this.cache = {};
|
this.changeEmitters = [];
|
this.logger = logger;
|
}
|
/**
|
* Queue up callbacks
|
* @param func - a callback function for cache change indication
|
*/
|
registerChangeEmitter(func) {
|
this.changeEmitters.push(func);
|
}
|
/**
|
* Invoke the callback when cache changes
|
*/
|
emitChange() {
|
this.changeEmitters.forEach((func) => func.call(null));
|
}
|
/**
|
* Converts cacheKVStore to InMemoryCache
|
* @param cache - key value store
|
*/
|
cacheToInMemoryCache(cache) {
|
const inMemoryCache = {
|
accounts: {},
|
idTokens: {},
|
accessTokens: {},
|
refreshTokens: {},
|
appMetadata: {},
|
};
|
for (const key in cache) {
|
const value = cache[key];
|
if (typeof value !== "object") {
|
continue;
|
}
|
if (isAccountEntity(value)) {
|
inMemoryCache.accounts[key] = value;
|
}
|
else if (isIdTokenEntity(value)) {
|
inMemoryCache.idTokens[key] = value;
|
}
|
else if (isAccessTokenEntity(value)) {
|
inMemoryCache.accessTokens[key] = value;
|
}
|
else if (isRefreshTokenEntity(value)) {
|
inMemoryCache.refreshTokens[key] = value;
|
}
|
else if (isAppMetadataEntity(key, value)) {
|
inMemoryCache.appMetadata[key] = value;
|
}
|
else {
|
continue;
|
}
|
}
|
return inMemoryCache;
|
}
|
/**
|
* converts inMemoryCache to CacheKVStore
|
* @param inMemoryCache - kvstore map for inmemory
|
*/
|
inMemoryCacheToCache(inMemoryCache) {
|
// convert in memory cache to a flat Key-Value map
|
let cache = this.getCache();
|
cache = {
|
...cache,
|
...inMemoryCache.accounts,
|
...inMemoryCache.idTokens,
|
...inMemoryCache.accessTokens,
|
...inMemoryCache.refreshTokens,
|
...inMemoryCache.appMetadata,
|
};
|
// convert in memory cache to a flat Key-Value map
|
return cache;
|
}
|
/**
|
* gets the current in memory cache for the client
|
*/
|
getInMemoryCache() {
|
this.logger.trace("Getting in-memory cache", "");
|
// convert the cache key value store to inMemoryCache
|
const inMemoryCache = this.cacheToInMemoryCache(this.getCache());
|
return inMemoryCache;
|
}
|
/**
|
* sets the current in memory cache for the client
|
* @param inMemoryCache - key value map in memory
|
*/
|
setInMemoryCache(inMemoryCache) {
|
this.logger.trace("Setting in-memory cache", "");
|
// convert and append the inMemoryCache to cacheKVStore
|
const cache = this.inMemoryCacheToCache(inMemoryCache);
|
this.setCache(cache);
|
this.emitChange();
|
}
|
/**
|
* get the current cache key-value store
|
*/
|
getCache() {
|
this.logger.trace("Getting cache key-value store", "");
|
return this.cache;
|
}
|
/**
|
* sets the current cache (key value store)
|
* @param cacheMap - key value map
|
*/
|
setCache(cache) {
|
this.logger.trace("Setting cache key value store", "");
|
this.cache = cache;
|
// mark change in cache
|
this.emitChange();
|
}
|
/**
|
* Gets cache item with given key.
|
* @param key - lookup key for the cache entry
|
*/
|
getItem(key) {
|
this.logger.tracePii(`Item key: ${key}`, "");
|
// read cache
|
const cache = this.getCache();
|
return cache[key];
|
}
|
/**
|
* Gets cache item with given key-value
|
* @param key - lookup key for the cache entry
|
* @param value - value of the cache entry
|
*/
|
setItem(key, value) {
|
this.logger.tracePii(`Item key: ${key}`, "");
|
// read cache
|
const cache = this.getCache();
|
cache[key] = value;
|
// write to cache
|
this.setCache(cache);
|
}
|
generateCredentialKey(credential) {
|
return generateCredentialKey(credential);
|
}
|
generateAccountKey(account) {
|
return generateAccountKey(account);
|
}
|
getAccountKeys() {
|
const inMemoryCache = this.getInMemoryCache();
|
const accountKeys = Object.keys(inMemoryCache.accounts);
|
return accountKeys;
|
}
|
getTokenKeys() {
|
const inMemoryCache = this.getInMemoryCache();
|
const tokenKeys = {
|
idToken: Object.keys(inMemoryCache.idTokens),
|
accessToken: Object.keys(inMemoryCache.accessTokens),
|
refreshToken: Object.keys(inMemoryCache.refreshTokens),
|
};
|
return tokenKeys;
|
}
|
/**
|
* Reads account from cache, builds it into an account entity and returns it.
|
* @param accountKey - lookup key to fetch cache type AccountEntity
|
* @returns
|
*/
|
getAccount(accountKey) {
|
const cachedAccount = this.getItem(accountKey);
|
return cachedAccount && typeof cachedAccount === "object"
|
? { ...cachedAccount }
|
: null;
|
}
|
/**
|
* set account entity
|
* @param account - cache value to be set of type AccountEntity
|
*/
|
async setAccount(account) {
|
const accountKey = this.generateAccountKey(getAccountInfo(account));
|
this.setItem(accountKey, account);
|
}
|
/**
|
* fetch the idToken credential
|
* @param idTokenKey - lookup key to fetch cache type IdTokenEntity
|
*/
|
getIdTokenCredential(idTokenKey) {
|
const idToken = this.getItem(idTokenKey);
|
if (isIdTokenEntity(idToken)) {
|
return idToken;
|
}
|
return null;
|
}
|
/**
|
* set idToken credential
|
* @param idToken - cache value to be set of type IdTokenEntity
|
*/
|
async setIdTokenCredential(idToken) {
|
const idTokenKey = this.generateCredentialKey(idToken);
|
this.setItem(idTokenKey, idToken);
|
}
|
/**
|
* fetch the accessToken credential
|
* @param accessTokenKey - lookup key to fetch cache type AccessTokenEntity
|
*/
|
getAccessTokenCredential(accessTokenKey) {
|
const accessToken = this.getItem(accessTokenKey);
|
if (isAccessTokenEntity(accessToken)) {
|
return accessToken;
|
}
|
return null;
|
}
|
/**
|
* set accessToken credential
|
* @param accessToken - cache value to be set of type AccessTokenEntity
|
*/
|
async setAccessTokenCredential(accessToken) {
|
const accessTokenKey = this.generateCredentialKey(accessToken);
|
this.setItem(accessTokenKey, accessToken);
|
}
|
/**
|
* fetch the refreshToken credential
|
* @param refreshTokenKey - lookup key to fetch cache type RefreshTokenEntity
|
*/
|
getRefreshTokenCredential(refreshTokenKey) {
|
const refreshToken = this.getItem(refreshTokenKey);
|
if (isRefreshTokenEntity(refreshToken)) {
|
return refreshToken;
|
}
|
return null;
|
}
|
/**
|
* set refreshToken credential
|
* @param refreshToken - cache value to be set of type RefreshTokenEntity
|
*/
|
async setRefreshTokenCredential(refreshToken) {
|
const refreshTokenKey = this.generateCredentialKey(refreshToken);
|
this.setItem(refreshTokenKey, refreshToken);
|
}
|
/**
|
* fetch appMetadata entity from the platform cache
|
* @param appMetadataKey - lookup key to fetch cache type AppMetadataEntity
|
*/
|
getAppMetadata(appMetadataKey) {
|
const appMetadata = this.getItem(appMetadataKey);
|
if (isAppMetadataEntity(appMetadataKey, appMetadata)) {
|
return appMetadata;
|
}
|
return null;
|
}
|
/**
|
* set appMetadata entity to the platform cache
|
* @param appMetadata - cache value to be set of type AppMetadataEntity
|
*/
|
setAppMetadata(appMetadata) {
|
const appMetadataKey = generateAppMetadataKey(appMetadata);
|
this.setItem(appMetadataKey, appMetadata);
|
}
|
/**
|
* fetch server telemetry entity from the platform cache
|
* @param serverTelemetrykey - lookup key to fetch cache type ServerTelemetryEntity
|
*/
|
getServerTelemetry(serverTelemetrykey) {
|
const serverTelemetryEntity = this.getItem(serverTelemetrykey);
|
if (serverTelemetryEntity &&
|
isServerTelemetryEntity(serverTelemetrykey, serverTelemetryEntity)) {
|
return serverTelemetryEntity;
|
}
|
return null;
|
}
|
/**
|
* set server telemetry entity to the platform cache
|
* @param serverTelemetryKey - lookup key to fetch cache type ServerTelemetryEntity
|
* @param serverTelemetry - cache value to be set of type ServerTelemetryEntity
|
*/
|
setServerTelemetry(serverTelemetryKey, serverTelemetry) {
|
this.setItem(serverTelemetryKey, serverTelemetry);
|
}
|
/**
|
* fetch authority metadata entity from the platform cache
|
* @param key - lookup key to fetch cache type AuthorityMetadataEntity
|
*/
|
getAuthorityMetadata(key) {
|
const authorityMetadataEntity = this.getItem(key);
|
if (authorityMetadataEntity &&
|
isAuthorityMetadataEntity(key, authorityMetadataEntity)) {
|
return authorityMetadataEntity;
|
}
|
return null;
|
}
|
/**
|
* Get all authority metadata keys
|
*/
|
getAuthorityMetadataKeys() {
|
return this.getKeys().filter((key) => {
|
return this.isAuthorityMetadata(key);
|
});
|
}
|
/**
|
* set authority metadata entity to the platform cache
|
* @param key - lookup key to fetch cache type AuthorityMetadataEntity
|
* @param metadata - cache value to be set of type AuthorityMetadataEntity
|
*/
|
setAuthorityMetadata(key, metadata) {
|
this.setItem(key, metadata);
|
}
|
/**
|
* fetch throttling entity from the platform cache
|
* @param throttlingCacheKey - lookup key to fetch cache type ThrottlingEntity
|
*/
|
getThrottlingCache(throttlingCacheKey) {
|
const throttlingCache = this.getItem(throttlingCacheKey);
|
if (throttlingCache &&
|
isThrottlingEntity(throttlingCacheKey, throttlingCache)) {
|
return throttlingCache;
|
}
|
return null;
|
}
|
/**
|
* set throttling entity to the platform cache
|
* @param throttlingCacheKey - lookup key to fetch cache type ThrottlingEntity
|
* @param throttlingCache - cache value to be set of type ThrottlingEntity
|
*/
|
setThrottlingCache(throttlingCacheKey, throttlingCache) {
|
this.setItem(throttlingCacheKey, throttlingCache);
|
}
|
/**
|
* Removes the cache item from memory with the given key.
|
* @param key - lookup key to remove a cache entity
|
* @param inMemory - key value map of the cache
|
*/
|
removeItem(key) {
|
this.logger.tracePii(`Item key: ${key}`, "");
|
// read inMemoryCache
|
let result = false;
|
const cache = this.getCache();
|
if (!!cache[key]) {
|
delete cache[key];
|
result = true;
|
}
|
// write to the cache after removal
|
if (result) {
|
this.setCache(cache);
|
this.emitChange();
|
}
|
return result;
|
}
|
/**
|
* Remove account entity from the platform cache if it's outdated
|
* @param accountKey - lookup key to fetch cache type AccountEntity
|
*/
|
removeOutdatedAccount(accountKey) {
|
this.removeItem(accountKey);
|
}
|
/**
|
* Checks whether key is in cache.
|
* @param key - look up key for a cache entity
|
*/
|
containsKey(key) {
|
return this.getKeys().includes(key);
|
}
|
/**
|
* Gets all keys in window.
|
*/
|
getKeys() {
|
this.logger.trace("Retrieving all cache keys", "");
|
// read cache
|
const cache = this.getCache();
|
return [...Object.keys(cache)];
|
}
|
/**
|
* Clears all cache entries created by MSAL (except tokens).
|
*/
|
clear() {
|
this.logger.trace("Clearing cache entries created by MSAL", "");
|
// read inMemoryCache
|
const cacheKeys = this.getKeys();
|
// delete each element
|
cacheKeys.forEach((key) => {
|
this.removeItem(key);
|
});
|
this.emitChange();
|
}
|
/**
|
* Initialize in memory cache from an exisiting cache vault
|
* @param cache - blob formatted cache (JSON)
|
*/
|
static generateInMemoryCache(cache) {
|
return Deserializer.deserializeAllCache(Deserializer.deserializeJSONBlob(cache));
|
}
|
/**
|
* retrieves the final JSON
|
* @param inMemoryCache - itemised cache read from the JSON
|
*/
|
static generateJsonCache(inMemoryCache) {
|
return Serializer.serializeAllCache(inMemoryCache);
|
}
|
/**
|
* Updates a credential's cache key if the current cache key is outdated
|
*/
|
updateCredentialCacheKey(currentCacheKey, credential) {
|
const updatedCacheKey = this.generateCredentialKey(credential);
|
if (currentCacheKey !== updatedCacheKey) {
|
const cacheItem = this.getItem(currentCacheKey);
|
if (cacheItem) {
|
this.removeItem(currentCacheKey);
|
this.setItem(updatedCacheKey, cacheItem);
|
this.logger.verbose(`Updated an outdated ${credential.credentialType} cache key`, "");
|
return updatedCacheKey;
|
}
|
else {
|
this.logger.error(`Attempted to update an outdated ${credential.credentialType} cache key but no item matching the outdated key was found in storage`, "");
|
}
|
}
|
return currentCacheKey;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const defaultSerializedCache = {
|
Account: {},
|
IdToken: {},
|
AccessToken: {},
|
RefreshToken: {},
|
AppMetadata: {},
|
};
|
/**
|
* In-memory token cache manager
|
* @public
|
*/
|
class TokenCache {
|
constructor(storage, logger, cachePlugin) {
|
this.cacheHasChanged = false;
|
this.storage = storage;
|
this.storage.registerChangeEmitter(this.handleChangeEvent.bind(this));
|
if (cachePlugin) {
|
this.persistence = cachePlugin;
|
}
|
this.logger = logger;
|
}
|
/**
|
* Set to true if cache state has changed since last time serialize or writeToPersistence was called
|
*/
|
hasChanged() {
|
return this.cacheHasChanged;
|
}
|
/**
|
* Serializes in memory cache to JSON
|
*/
|
serialize() {
|
this.logger.trace("Serializing in-memory cache", "");
|
let finalState = Serializer.serializeAllCache(this.storage.getInMemoryCache());
|
// if cacheSnapshot not null or empty, merge
|
if (this.cacheSnapshot) {
|
this.logger.trace("Reading cache snapshot from disk", "");
|
finalState = this.mergeState(JSON.parse(this.cacheSnapshot), finalState);
|
}
|
else {
|
this.logger.trace("No cache snapshot to merge", "");
|
}
|
this.cacheHasChanged = false;
|
return JSON.stringify(finalState);
|
}
|
/**
|
* Deserializes JSON to in-memory cache. JSON should be in MSAL cache schema format
|
* @param cache - blob formatted cache
|
*/
|
deserialize(cache) {
|
this.logger.trace("Deserializing JSON to in-memory cache", "");
|
this.cacheSnapshot = cache;
|
if (this.cacheSnapshot) {
|
this.logger.trace("Reading cache snapshot from disk", "");
|
const deserializedCache = Deserializer.deserializeAllCache(this.overlayDefaults(JSON.parse(this.cacheSnapshot)));
|
this.storage.setInMemoryCache(deserializedCache);
|
}
|
else {
|
this.logger.trace("No cache snapshot to deserialize", "");
|
}
|
}
|
/**
|
* Fetches the cache key-value map
|
*/
|
getKVStore() {
|
return this.storage.getCache();
|
}
|
/**
|
* Gets cache snapshot in CacheKVStore format
|
*/
|
getCacheSnapshot() {
|
const deserializedPersistentStorage = NodeStorage.generateInMemoryCache(this.cacheSnapshot);
|
return this.storage.inMemoryCacheToCache(deserializedPersistentStorage);
|
}
|
/**
|
* API that retrieves all accounts currently in cache to the user
|
*/
|
async getAllAccounts(correlationId = new CryptoProvider().createNewGuid()) {
|
this.logger.trace("getAllAccounts called", correlationId);
|
let cacheContext;
|
try {
|
if (this.persistence) {
|
cacheContext = new TokenCacheContext(this, false);
|
await this.persistence.beforeCacheAccess(cacheContext);
|
}
|
return this.storage.getAllAccounts({}, correlationId);
|
}
|
finally {
|
if (this.persistence && cacheContext) {
|
await this.persistence.afterCacheAccess(cacheContext);
|
}
|
}
|
}
|
/**
|
* Returns the signed in account matching homeAccountId.
|
* (the account object is created at the time of successful login)
|
* or null when no matching account is found
|
* @param homeAccountId - unique identifier for an account (uid.utid)
|
*/
|
async getAccountByHomeId(homeAccountId) {
|
const allAccounts = await this.getAllAccounts();
|
if (homeAccountId && allAccounts && allAccounts.length) {
|
return (allAccounts.filter((accountObj) => accountObj.homeAccountId === homeAccountId)[0] || null);
|
}
|
else {
|
return null;
|
}
|
}
|
/**
|
* Returns the signed in account matching localAccountId.
|
* (the account object is created at the time of successful login)
|
* or null when no matching account is found
|
* @param localAccountId - unique identifier of an account (sub/obj when homeAccountId cannot be populated)
|
*/
|
async getAccountByLocalId(localAccountId) {
|
const allAccounts = await this.getAllAccounts();
|
if (localAccountId && allAccounts && allAccounts.length) {
|
return (allAccounts.filter((accountObj) => accountObj.localAccountId === localAccountId)[0] || null);
|
}
|
else {
|
return null;
|
}
|
}
|
/**
|
* API to remove a specific account and the relevant data from cache
|
* @param account - AccountInfo passed by the user
|
*/
|
async removeAccount(account, correlationId) {
|
this.logger.trace("removeAccount called", correlationId || "");
|
let cacheContext;
|
try {
|
if (this.persistence) {
|
cacheContext = new TokenCacheContext(this, true);
|
await this.persistence.beforeCacheAccess(cacheContext);
|
}
|
this.storage.removeAccount(account, correlationId || new GuidGenerator().generateGuid());
|
}
|
finally {
|
if (this.persistence && cacheContext) {
|
await this.persistence.afterCacheAccess(cacheContext);
|
}
|
}
|
}
|
/**
|
* Overwrites in-memory cache with persistent cache
|
*/
|
async overwriteCache() {
|
if (!this.persistence) {
|
this.logger.info("No persistence layer specified, cache cannot be overwritten", "");
|
return;
|
}
|
this.logger.info("Overwriting in-memory cache with persistent cache", "");
|
this.storage.clear();
|
const cacheContext = new TokenCacheContext(this, false);
|
await this.persistence.beforeCacheAccess(cacheContext);
|
const cacheSnapshot = this.getCacheSnapshot();
|
this.storage.setCache(cacheSnapshot);
|
await this.persistence.afterCacheAccess(cacheContext);
|
}
|
/**
|
* Called when the cache has changed state.
|
*/
|
handleChangeEvent() {
|
this.cacheHasChanged = true;
|
}
|
/**
|
* Merge in memory cache with the cache snapshot.
|
* @param oldState - cache before changes
|
* @param currentState - current cache state in the library
|
*/
|
mergeState(oldState, currentState) {
|
this.logger.trace("Merging in-memory cache with cache snapshot", "");
|
const stateAfterRemoval = this.mergeRemovals(oldState, currentState);
|
return this.mergeUpdates(stateAfterRemoval, currentState);
|
}
|
/**
|
* Deep update of oldState based on newState values
|
* @param oldState - cache before changes
|
* @param newState - updated cache
|
*/
|
mergeUpdates(oldState, newState) {
|
Object.keys(newState).forEach((newKey) => {
|
const newValue = newState[newKey];
|
// if oldState does not contain value but newValue does, add it
|
if (!oldState.hasOwnProperty(newKey)) {
|
if (newValue !== null) {
|
oldState[newKey] = newValue;
|
}
|
}
|
else {
|
// both oldState and newState contain the key, do deep update
|
const newValueNotNull = newValue !== null;
|
const newValueIsObject = typeof newValue === "object";
|
const newValueIsNotArray = !Array.isArray(newValue);
|
const oldStateNotUndefinedOrNull = typeof oldState[newKey] !== "undefined" &&
|
oldState[newKey] !== null;
|
if (newValueNotNull &&
|
newValueIsObject &&
|
newValueIsNotArray &&
|
oldStateNotUndefinedOrNull) {
|
this.mergeUpdates(oldState[newKey], newValue);
|
}
|
else {
|
oldState[newKey] = newValue;
|
}
|
}
|
});
|
return oldState;
|
}
|
/**
|
* Removes entities in oldState that the were removed from newState. If there are any unknown values in root of
|
* oldState that are not recognized, they are left untouched.
|
* @param oldState - cache before changes
|
* @param newState - updated cache
|
*/
|
mergeRemovals(oldState, newState) {
|
this.logger.trace("Remove updated entries in cache", "");
|
const accounts = oldState.Account
|
? this.mergeRemovalsDict(oldState.Account, newState.Account)
|
: oldState.Account;
|
const accessTokens = oldState.AccessToken
|
? this.mergeRemovalsDict(oldState.AccessToken, newState.AccessToken)
|
: oldState.AccessToken;
|
const refreshTokens = oldState.RefreshToken
|
? this.mergeRemovalsDict(oldState.RefreshToken, newState.RefreshToken)
|
: oldState.RefreshToken;
|
const idTokens = oldState.IdToken
|
? this.mergeRemovalsDict(oldState.IdToken, newState.IdToken)
|
: oldState.IdToken;
|
const appMetadata = oldState.AppMetadata
|
? this.mergeRemovalsDict(oldState.AppMetadata, newState.AppMetadata)
|
: oldState.AppMetadata;
|
return {
|
...oldState,
|
Account: accounts,
|
AccessToken: accessTokens,
|
RefreshToken: refreshTokens,
|
IdToken: idTokens,
|
AppMetadata: appMetadata,
|
};
|
}
|
/**
|
* Helper to merge new cache with the old one
|
* @param oldState - cache before changes
|
* @param newState - updated cache
|
*/
|
mergeRemovalsDict(oldState, newState) {
|
const finalState = { ...oldState };
|
Object.keys(oldState).forEach((oldKey) => {
|
if (!newState || !newState.hasOwnProperty(oldKey)) {
|
delete finalState[oldKey];
|
}
|
});
|
return finalState;
|
}
|
/**
|
* Helper to overlay as a part of cache merge
|
* @param passedInCache - cache read from the blob
|
*/
|
overlayDefaults(passedInCache) {
|
this.logger.trace("Overlaying input cache with the default cache", "");
|
return {
|
Account: {
|
...defaultSerializedCache.Account,
|
...passedInCache.Account,
|
},
|
IdToken: {
|
...defaultSerializedCache.IdToken,
|
...passedInCache.IdToken,
|
},
|
AccessToken: {
|
...defaultSerializedCache.AccessToken,
|
...passedInCache.AccessToken,
|
},
|
RefreshToken: {
|
...defaultSerializedCache.RefreshToken,
|
...passedInCache.RefreshToken,
|
},
|
AppMetadata: {
|
...defaultSerializedCache.AppMetadata,
|
...passedInCache.AppMetadata,
|
},
|
};
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const missingTenantIdError = "missing_tenant_id_error";
|
const userTimeoutReached = "user_timeout_reached";
|
const invalidAssertion = "invalid_assertion";
|
const invalidClientCredential = "invalid_client_credential";
|
const deviceCodePollingCancelled = "device_code_polling_cancelled";
|
const deviceCodeExpired = "device_code_expired";
|
const deviceCodeUnknownError = "device_code_unknown_error";
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Client assertion of type jwt-bearer used in confidential client flows
|
* @public
|
*/
|
class ClientAssertion {
|
/**
|
* Initialize the ClientAssertion class from the clientAssertion passed by the user
|
* @param assertion - refer https://tools.ietf.org/html/rfc7521
|
*/
|
static fromAssertion(assertion) {
|
const clientAssertion = new ClientAssertion();
|
clientAssertion.jwt = assertion;
|
return clientAssertion;
|
}
|
/**
|
* @deprecated Use fromCertificateWithSha256Thumbprint instead, with a SHA-256 thumprint
|
* Initialize the ClientAssertion class from the certificate passed by the user
|
* @param thumbprint - identifier of a certificate
|
* @param privateKey - secret key
|
* @param publicCertificate - electronic document provided to prove the ownership of the public key
|
*/
|
static fromCertificate(thumbprint, privateKey, publicCertificate) {
|
const clientAssertion = new ClientAssertion();
|
clientAssertion.privateKey = privateKey;
|
clientAssertion.thumbprint = thumbprint;
|
clientAssertion.useSha256 = false;
|
if (publicCertificate) {
|
clientAssertion.publicCertificate =
|
this.parseCertificate(publicCertificate);
|
}
|
return clientAssertion;
|
}
|
/**
|
* Initialize the ClientAssertion class from the certificate passed by the user
|
* @param thumbprint - identifier of a certificate
|
* @param privateKey - secret key
|
* @param publicCertificate - electronic document provided to prove the ownership of the public key
|
*/
|
static fromCertificateWithSha256Thumbprint(thumbprint, privateKey, publicCertificate) {
|
const clientAssertion = new ClientAssertion();
|
clientAssertion.privateKey = privateKey;
|
clientAssertion.thumbprint = thumbprint;
|
clientAssertion.useSha256 = true;
|
if (publicCertificate) {
|
clientAssertion.publicCertificate =
|
this.parseCertificate(publicCertificate);
|
}
|
return clientAssertion;
|
}
|
/**
|
* Update JWT for certificate based clientAssertion, if passed by the user, uses it as is
|
* @param cryptoProvider - library's crypto helper
|
* @param issuer - iss claim
|
* @param jwtAudience - aud claim
|
*/
|
getJwt(cryptoProvider, issuer, jwtAudience) {
|
// if assertion was created from certificate, check if jwt is expired and create new one.
|
if (this.privateKey && this.thumbprint) {
|
if (this.jwt &&
|
!this.isExpired() &&
|
issuer === this.issuer &&
|
jwtAudience === this.jwtAudience) {
|
return this.jwt;
|
}
|
return this.createJwt(cryptoProvider, issuer, jwtAudience);
|
}
|
/*
|
* if assertion was created by caller, then we just append it. It is up to the caller to
|
* ensure that it contains necessary claims and that it is not expired.
|
*/
|
if (this.jwt) {
|
return this.jwt;
|
}
|
throw createClientAuthError(invalidAssertion);
|
}
|
/**
|
* JWT format and required claims specified: https://tools.ietf.org/html/rfc7523#section-3
|
*/
|
createJwt(cryptoProvider, issuer, jwtAudience) {
|
this.issuer = issuer;
|
this.jwtAudience = jwtAudience;
|
const issuedAt = nowSeconds();
|
this.expirationTime = issuedAt + 600;
|
const algorithm = this.useSha256
|
? JwtConstants.PSS_256
|
: JwtConstants.RSA_256;
|
const header = {
|
alg: algorithm,
|
};
|
const thumbprintHeader = this.useSha256
|
? JwtConstants.X5T_256
|
: JwtConstants.X5T;
|
Object.assign(header, {
|
[thumbprintHeader]: EncodingUtils.base64EncodeUrl(this.thumbprint, EncodingTypes.HEX),
|
});
|
if (this.publicCertificate) {
|
Object.assign(header, {
|
[JwtConstants.X5C]: this.publicCertificate,
|
});
|
}
|
const payload = {
|
[JwtConstants.AUDIENCE]: this.jwtAudience,
|
[JwtConstants.EXPIRATION_TIME]: this.expirationTime,
|
[JwtConstants.ISSUER]: this.issuer,
|
[JwtConstants.SUBJECT]: this.issuer,
|
[JwtConstants.NOT_BEFORE]: issuedAt,
|
[JwtConstants.JWT_ID]: cryptoProvider.createNewGuid(),
|
};
|
this.jwt = jwt.sign(payload, this.privateKey, { header });
|
return this.jwt;
|
}
|
/**
|
* Utility API to check expiration
|
*/
|
isExpired() {
|
return this.expirationTime < nowSeconds();
|
}
|
/**
|
* Extracts the raw certs from a given certificate string and returns them in an array.
|
* @param publicCertificate - electronic document provided to prove the ownership of the public key
|
*/
|
static parseCertificate(publicCertificate) {
|
/**
|
* This is regex to identify the certs in a given certificate string.
|
* We want to look for the contents between the BEGIN and END certificate strings, without the associated newlines.
|
* The information in parens "(.+?)" is the capture group to represent the cert we want isolated.
|
* "." means any string character, "+" means match 1 or more times, and "?" means the shortest match.
|
* The "g" at the end of the regex means search the string globally, and the "s" enables the "." to match newlines.
|
*/
|
const regexToFindCerts = /-----BEGIN CERTIFICATE-----\r*\n(.+?)\r*\n-----END CERTIFICATE-----/gs;
|
const certs = [];
|
let matches;
|
while ((matches = regexToFindCerts.exec(publicCertificate)) !== null) {
|
// matches[1] represents the first parens capture group in the regex.
|
certs.push(matches[1].replace(/\r*\n/g, ""));
|
}
|
return certs;
|
}
|
}
|
|
/* eslint-disable header/header */
|
const name = "@azure/msal-node";
|
const version = "5.1.3";
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
|
* @internal
|
*/
|
class BaseClient {
|
constructor(configuration) {
|
// Set the configuration
|
this.config = buildClientConfiguration(configuration);
|
// Initialize the logger
|
this.logger = new Logger(this.config.loggerOptions, name, version);
|
// Initialize crypto
|
this.cryptoUtils = this.config.cryptoInterface;
|
// Initialize storage interface
|
this.cacheManager = this.config.storageInterface;
|
// Set the network interface
|
this.networkClient = this.config.networkInterface;
|
// Set TelemetryManager
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
// set Authority
|
this.authority = this.config.authOptions.authority;
|
this.performanceClient = new StubPerformanceClient();
|
}
|
/**
|
* Creates default headers for requests to token endpoint
|
*/
|
createTokenRequestHeaders(ccsCred) {
|
return createTokenRequestHeaders(this.logger, false, ccsCred);
|
}
|
/**
|
* Http post to token endpoint
|
* @param tokenEndpoint
|
* @param queryString
|
* @param headers
|
* @param thumbprint
|
*/
|
async executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId) {
|
return executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, this.serverTelemetryManager);
|
}
|
/**
|
* Wraps sendPostRequestAsync with necessary preflight and postflight logic
|
* @param thumbprint - Request thumbprint for throttling
|
* @param tokenEndpoint - Endpoint to make the POST to
|
* @param options - Body and Headers to include on the POST request
|
* @param correlationId - CorrelationId for telemetry
|
*/
|
async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
|
return sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient);
|
}
|
/**
|
* Creates query string for the /token request
|
* @param request
|
*/
|
createTokenQueryParameters(request) {
|
return createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Oauth2.0 Password grant client
|
* Note: We are only supporting public clients for password grant and for purely testing purposes
|
* @public
|
* @deprecated - Use a more secure flow instead
|
*/
|
class UsernamePasswordClient extends BaseClient {
|
constructor(configuration) {
|
super(configuration);
|
}
|
/**
|
* API to acquire a token by passing the username and password to the service in exchage of credentials
|
* password_grant
|
* @param request - CommonUsernamePasswordRequest
|
*/
|
async acquireToken(request) {
|
this.logger.info("in acquireToken call in username-password client", request.correlationId);
|
const reqTimestamp = nowSeconds();
|
const response = await this.executeTokenRequest(this.authority, request);
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
// Validate response. This function throws a server error if an error is returned by the server.
|
responseHandler.validateTokenResponse(response.body, request.correlationId);
|
const tokenResponse = responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, ApiId.acquireTokenByUsernamePassword);
|
return tokenResponse;
|
}
|
/**
|
* Executes POST request to token endpoint
|
* @param authority - authority object
|
* @param request - CommonUsernamePasswordRequest provided by the developer
|
*/
|
async executeTokenRequest(authority, request) {
|
const queryParametersString = this.createTokenQueryParameters(request);
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
const requestBody = await this.createTokenRequestBody(request);
|
const headers = this.createTokenRequestHeaders({
|
credential: request.username,
|
type: CcsCredentialType.UPN,
|
});
|
const thumbprint = {
|
clientId: this.config.authOptions.clientId,
|
authority: authority.canonicalAuthority,
|
scopes: request.scopes,
|
claims: request.claims,
|
authenticationScheme: request.authenticationScheme,
|
resourceRequestMethod: request.resourceRequestMethod,
|
resourceRequestUri: request.resourceRequestUri,
|
shrClaims: request.shrClaims,
|
sshKid: request.sshKid,
|
};
|
return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint, request.correlationId);
|
}
|
/**
|
* Generates a map for all the params to be sent to the service
|
* @param request - CommonUsernamePasswordRequest provided by the developer
|
*/
|
async createTokenRequestBody(request) {
|
const parameters = new Map();
|
addClientId(parameters, this.config.authOptions.clientId);
|
addUsername(parameters, request.username);
|
addPassword(parameters, request.password);
|
addScopes(parameters, request.scopes);
|
addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN);
|
addGrantType(parameters, GrantType.RESOURCE_OWNER_PASSWORD_GRANT);
|
addClientInfo(parameters);
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
addThrottling(parameters);
|
if (this.serverTelemetryManager) {
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
}
|
const correlationId = request.correlationId ||
|
this.config.cryptoInterface.createNewGuid();
|
addCorrelationId(parameters, correlationId);
|
if (this.config.clientCredentials.clientSecret) {
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
}
|
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
if (clientAssertion) {
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
}
|
if (!StringUtils.isEmptyObj(request.claims) ||
|
(this.config.authOptions.clientCapabilities &&
|
this.config.authOptions.clientCapabilities.length > 0)) {
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
|
}
|
if (this.config.systemOptions.preventCorsPreflight &&
|
request.username) {
|
addCcsUpn(parameters, request.username);
|
}
|
return mapToQueryString(parameters);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Constructs the full /authorize URL with request parameters
|
* @param config
|
* @param authority
|
* @param request
|
* @param logger
|
* @returns
|
*/
|
function getAuthCodeRequestUrl(config, authority, request, logger) {
|
const parameters = getStandardAuthorizeRequestParameters({
|
...config.auth,
|
authority: authority,
|
redirectUri: request.redirectUri || "",
|
}, request, logger);
|
addLibraryInfo(parameters, {
|
sku: Constants.MSAL_SKU,
|
version: version,
|
cpu: process.arch || "",
|
os: process.platform || "",
|
});
|
if (config.system.protocolMode !== ProtocolMode.OIDC) {
|
addApplicationTelemetry(parameters, config.telemetry.application);
|
}
|
addResponseType(parameters, OAuthResponseType.CODE);
|
if (request.codeChallenge && request.codeChallengeMethod) {
|
addCodeChallengeParams(parameters, request.codeChallenge, request.codeChallengeMethod);
|
}
|
addExtraParameters(parameters, request.extraQueryParameters || {});
|
return getAuthorizeUrl(authority, parameters);
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Base abstract class for all ClientApplications - public and confidential
|
* @public
|
*/
|
class ClientApplication {
|
/**
|
* Constructor for the ClientApplication
|
*/
|
constructor(configuration) {
|
this.config = buildAppConfiguration(configuration);
|
this.cryptoProvider = new CryptoProvider();
|
this.logger = new Logger(this.config.system.loggerOptions, name, version);
|
this.storage = new NodeStorage(this.logger, this.config.auth.clientId, this.cryptoProvider, buildStaticAuthorityOptions(this.config.auth));
|
this.tokenCache = new TokenCache(this.storage, this.logger, this.config.cache.cachePlugin);
|
}
|
/**
|
* Creates the URL of the authorization request, letting the user input credentials and consent to the
|
* application. The URL targets the /authorize endpoint of the authority configured in the
|
* application object.
|
*
|
* Once the user inputs their credentials and consents, the authority will send a response to the redirect URI
|
* sent in the request and should contain an authorization code, which can then be used to acquire tokens via
|
* `acquireTokenByCode(AuthorizationCodeRequest)`.
|
*/
|
async getAuthCodeUrl(request) {
|
this.logger.info("getAuthCodeUrl called", request.correlationId || "");
|
const validRequest = {
|
...request,
|
...(await this.initializeBaseRequest(request)),
|
responseMode: request.responseMode || ResponseMode$1.QUERY,
|
authenticationScheme: AuthenticationScheme.BEARER,
|
state: request.state || "",
|
nonce: request.nonce || "",
|
};
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
|
return getAuthCodeRequestUrl(this.config, discoveredAuthority, validRequest, this.logger);
|
}
|
/**
|
* Acquires a token by exchanging the Authorization Code received from the first step of OAuth2.0
|
* Authorization Code flow.
|
*
|
* `getAuthCodeUrl(AuthorizationCodeUrlRequest)` can be used to create the URL for the first step of OAuth2.0
|
* Authorization Code flow. Ensure that values for redirectUri and scopes in AuthorizationCodeUrlRequest and
|
* AuthorizationCodeRequest are the same.
|
*/
|
async acquireTokenByCode(request, authCodePayLoad) {
|
this.logger.info("acquireTokenByCode called", request.correlationId || "");
|
if (request.state && authCodePayLoad) {
|
this.logger.info("acquireTokenByCode - validating state", request.correlationId || "");
|
this.validateState(request.state, authCodePayLoad.state || "");
|
// eslint-disable-next-line no-param-reassign
|
authCodePayLoad = { ...authCodePayLoad, state: "" };
|
}
|
const validRequest = {
|
...request,
|
...(await this.initializeBaseRequest(request)),
|
authenticationScheme: AuthenticationScheme.BEARER,
|
};
|
const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenByCode, validRequest.correlationId);
|
try {
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
|
const authClientConfig = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, validRequest.redirectUri, serverTelemetryManager);
|
const authorizationCodeClient = new AuthorizationCodeClient(authClientConfig, new StubPerformanceClient());
|
this.logger.verbose("Auth code client created", validRequest.correlationId);
|
return await authorizationCodeClient.acquireToken(validRequest, ApiId.acquireTokenByCode, authCodePayLoad);
|
}
|
catch (e) {
|
if (e instanceof AuthError) {
|
e.setCorrelationId(validRequest.correlationId);
|
}
|
serverTelemetryManager.cacheFailedRequest(e);
|
throw e;
|
}
|
}
|
/**
|
* Acquires a token by exchanging the refresh token provided for a new set of tokens.
|
*
|
* This API is provided only for scenarios where you would like to migrate from ADAL to MSAL. Otherwise, it is
|
* recommended that you use `acquireTokenSilent()` for silent scenarios. When using `acquireTokenSilent()`, MSAL will
|
* handle the caching and refreshing of tokens automatically.
|
*/
|
async acquireTokenByRefreshToken(request) {
|
this.logger.info("acquireTokenByRefreshToken called", request.correlationId || "");
|
const validRequest = {
|
...request,
|
...(await this.initializeBaseRequest(request)),
|
authenticationScheme: AuthenticationScheme.BEARER,
|
};
|
const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenByRefreshToken, validRequest.correlationId);
|
try {
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
|
const refreshTokenClientConfig = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, validRequest.redirectUri || "", serverTelemetryManager);
|
const refreshTokenClient = new RefreshTokenClient(refreshTokenClientConfig, new StubPerformanceClient());
|
this.logger.verbose("Refresh token client created", validRequest.correlationId);
|
return await refreshTokenClient.acquireToken(validRequest, ApiId.acquireTokenByRefreshToken);
|
}
|
catch (e) {
|
if (e instanceof AuthError) {
|
e.setCorrelationId(validRequest.correlationId);
|
}
|
serverTelemetryManager.cacheFailedRequest(e);
|
throw e;
|
}
|
}
|
/**
|
* Acquires a token silently when a user specifies the account the token is requested for.
|
*
|
* This API expects the user to provide an account object and looks into the cache to retrieve the token if present.
|
* There is also an optional "forceRefresh" boolean the user can send to bypass the cache for access_token and id_token.
|
* In case the refresh_token is expired or not found, an error is thrown
|
* and the guidance is for the user to call any interactive token acquisition API (eg: `acquireTokenByCode()`).
|
*/
|
async acquireTokenSilent(request) {
|
const validRequest = {
|
...request,
|
...(await this.initializeBaseRequest(request)),
|
forceRefresh: request.forceRefresh || false,
|
};
|
const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenSilent, validRequest.correlationId, validRequest.forceRefresh);
|
try {
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
|
const clientConfiguration = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, validRequest.redirectUri || "", serverTelemetryManager);
|
const silentFlowClient = new SilentFlowClient(clientConfiguration, new StubPerformanceClient());
|
this.logger.verbose("Silent flow client created", validRequest.correlationId);
|
try {
|
// always overwrite the in-memory cache with the persistence cache (if it exists) before a cache lookup
|
await this.tokenCache.overwriteCache();
|
return await this.acquireCachedTokenSilent(validRequest, silentFlowClient, clientConfiguration);
|
}
|
catch (error) {
|
if (error instanceof ClientAuthError &&
|
error.errorCode ===
|
tokenRefreshRequired) {
|
const refreshTokenClient = new RefreshTokenClient(clientConfiguration, new StubPerformanceClient());
|
return refreshTokenClient.acquireTokenByRefreshToken(validRequest, ApiId.acquireTokenSilent);
|
}
|
throw error;
|
}
|
}
|
catch (error) {
|
if (error instanceof AuthError) {
|
error.setCorrelationId(validRequest.correlationId);
|
}
|
serverTelemetryManager.cacheFailedRequest(error);
|
throw error;
|
}
|
}
|
async acquireCachedTokenSilent(validRequest, silentFlowClient, clientConfiguration) {
|
const [authResponse, cacheOutcome] = await silentFlowClient.acquireCachedToken({
|
...validRequest,
|
scopes: validRequest.scopes?.length
|
? validRequest.scopes
|
: [...OIDC_DEFAULT_SCOPES],
|
});
|
if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
|
this.logger.info("ClientApplication:acquireCachedTokenSilent - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.", validRequest.correlationId);
|
// refresh the access token in the background
|
const refreshTokenClient = new RefreshTokenClient(clientConfiguration, new StubPerformanceClient());
|
try {
|
await refreshTokenClient.acquireTokenByRefreshToken(validRequest, ApiId.acquireTokenSilent);
|
}
|
catch {
|
// do nothing, this is running in the background and no action is to be taken upon success or failure
|
}
|
}
|
// return the cached token
|
return authResponse;
|
}
|
/**
|
* Acquires tokens with password grant by exchanging client applications username and password for credentials
|
*
|
* The latest OAuth 2.0 Security Best Current Practice disallows the password grant entirely.
|
* More details on this recommendation at https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-3.4
|
* Microsoft's documentation and recommendations are at:
|
* https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-authentication-flows#usernamepassword
|
*
|
* @param request - UsenamePasswordRequest
|
* @deprecated - Use a more secure flow instead
|
*/
|
async acquireTokenByUsernamePassword(request) {
|
this.logger.info("acquireTokenByUsernamePassword called", request.correlationId || "");
|
const validRequest = {
|
...request,
|
...(await this.initializeBaseRequest(request)),
|
};
|
const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenByUsernamePassword, validRequest.correlationId);
|
try {
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
|
const usernamePasswordClientConfig = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, "", serverTelemetryManager);
|
const usernamePasswordClient = new UsernamePasswordClient(usernamePasswordClientConfig);
|
this.logger.verbose("Username password client created", validRequest.correlationId);
|
return await usernamePasswordClient.acquireToken(validRequest);
|
}
|
catch (e) {
|
if (e instanceof AuthError) {
|
e.setCorrelationId(validRequest.correlationId);
|
}
|
serverTelemetryManager.cacheFailedRequest(e);
|
throw e;
|
}
|
}
|
/**
|
* Gets the token cache for the application.
|
*/
|
getTokenCache() {
|
this.logger.info("getTokenCache called", "");
|
return this.tokenCache;
|
}
|
/**
|
* Validates OIDC state by comparing the user cached state with the state received from the server.
|
*
|
* This API is provided for scenarios where you would use OAuth2.0 state parameter to mitigate against
|
* CSRF attacks.
|
* For more information about state, visit https://datatracker.ietf.org/doc/html/rfc6819#section-3.6.
|
* @param state - Unique GUID generated by the user that is cached by the user and sent to the server during the first leg of the flow
|
* @param cachedState - This string is sent back by the server with the authorization code
|
*/
|
validateState(state, cachedState) {
|
if (!state) {
|
throw NodeAuthError.createStateNotFoundError();
|
}
|
if (state !== cachedState) {
|
throw createClientAuthError(stateMismatch);
|
}
|
}
|
/**
|
* Returns the logger instance
|
*/
|
getLogger() {
|
return this.logger;
|
}
|
/**
|
* Replaces the default logger set in configurations with new Logger with new configurations
|
* @param logger - Logger instance
|
*/
|
setLogger(logger) {
|
this.logger = logger;
|
}
|
/**
|
* Builds the common configuration to be passed to the common component based on the platform configurarion
|
* @param authority - user passed authority in configuration
|
* @param serverTelemetryManager - initializes servertelemetry if passed
|
*/
|
async buildOauthClientConfiguration(discoveredAuthority, requestCorrelationId, redirectUri, serverTelemetryManager) {
|
this.logger.verbose("buildOauthClientConfiguration called", requestCorrelationId);
|
this.logger.info(`Building oauth client configuration with the following authority: ${discoveredAuthority.tokenEndpoint}.`, requestCorrelationId);
|
serverTelemetryManager?.updateRegionDiscoveryMetadata(discoveredAuthority.regionDiscoveryMetadata);
|
const clientConfiguration = {
|
authOptions: {
|
clientId: this.config.auth.clientId,
|
authority: discoveredAuthority,
|
clientCapabilities: this.config.auth.clientCapabilities,
|
redirectUri,
|
isMcp: this.config.auth.isMcp,
|
},
|
loggerOptions: {
|
logLevel: this.config.system.loggerOptions.logLevel,
|
loggerCallback: this.config.system.loggerOptions.loggerCallback,
|
piiLoggingEnabled: this.config.system.loggerOptions.piiLoggingEnabled,
|
correlationId: requestCorrelationId,
|
},
|
cryptoInterface: this.cryptoProvider,
|
networkInterface: this.config.system.networkClient,
|
storageInterface: this.storage,
|
serverTelemetryManager: serverTelemetryManager,
|
clientCredentials: {
|
clientSecret: this.clientSecret,
|
clientAssertion: await this.getClientAssertion(discoveredAuthority),
|
},
|
libraryInfo: {
|
sku: Constants.MSAL_SKU,
|
version: version,
|
cpu: process.arch || "",
|
os: process.platform || "",
|
},
|
telemetry: this.config.telemetry,
|
persistencePlugin: this.config.cache.cachePlugin,
|
serializableCache: this.tokenCache,
|
};
|
return clientConfiguration;
|
}
|
async getClientAssertion(authority) {
|
if (this.developerProvidedClientAssertion) {
|
this.clientAssertion = ClientAssertion.fromAssertion(await getClientAssertion(this.developerProvidedClientAssertion, this.config.auth.clientId, authority.tokenEndpoint));
|
}
|
return (this.clientAssertion && {
|
assertion: this.clientAssertion.getJwt(this.cryptoProvider, this.config.auth.clientId, authority.tokenEndpoint),
|
assertionType: Constants.JWT_BEARER_ASSERTION_TYPE,
|
});
|
}
|
/**
|
* Generates a request with the default scopes & generates a correlationId.
|
* @param authRequest - BaseAuthRequest for initialization
|
*/
|
async initializeBaseRequest(authRequest) {
|
const correlationId = authRequest.correlationId || this.cryptoProvider.createNewGuid();
|
this.logger.verbose("initializeRequestScopes called", correlationId);
|
// Default authenticationScheme to Bearer, log that POP isn't supported yet
|
if (authRequest.authenticationScheme &&
|
authRequest.authenticationScheme ===
|
AuthenticationScheme.POP) {
|
this.logger.verbose("Authentication Scheme 'pop' is not supported yet, setting Authentication Scheme to 'Bearer' for request", correlationId);
|
}
|
authRequest.authenticationScheme =
|
AuthenticationScheme.BEARER;
|
return {
|
...authRequest,
|
scopes: [
|
...((authRequest && authRequest.scopes) || []),
|
...OIDC_DEFAULT_SCOPES,
|
],
|
correlationId,
|
authority: authRequest.authority || this.config.auth.authority,
|
};
|
}
|
/**
|
* Initializes the server telemetry payload
|
* @param apiId - Id for a specific request
|
* @param correlationId - GUID
|
* @param forceRefresh - boolean to indicate network call
|
*/
|
initializeServerTelemetryManager(apiId, correlationId, forceRefresh) {
|
const telemetryPayload = {
|
clientId: this.config.auth.clientId,
|
correlationId: correlationId,
|
apiId: apiId,
|
forceRefresh: forceRefresh || false,
|
};
|
return new ServerTelemetryManager(telemetryPayload, this.storage);
|
}
|
/**
|
* Create authority instance. If authority not passed in request, default to authority set on the application
|
* object. If no authority set in application object, then default to common authority.
|
* @param authorityString - authority from user configuration
|
*/
|
async createAuthority(authorityString, requestCorrelationId, azureRegionConfiguration, azureCloudOptions) {
|
this.logger.verbose("createAuthority called", requestCorrelationId);
|
// build authority string based on auth params - azureCloudInstance is prioritized if provided
|
const authorityUrl = Authority.generateAuthority(authorityString, azureCloudOptions || this.config.auth.azureCloudOptions);
|
const authorityOptions = {
|
protocolMode: this.config.system.protocolMode,
|
knownAuthorities: this.config.auth.knownAuthorities,
|
cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
|
authorityMetadata: this.config.auth.authorityMetadata,
|
azureRegionConfiguration,
|
};
|
return createDiscoveredInstance(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions, this.logger, requestCorrelationId, new StubPerformanceClient());
|
}
|
/**
|
* Clear the cache
|
*/
|
clearCache() {
|
this.storage.clear();
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class LoopbackClient {
|
/**
|
* Spins up a loopback server which returns the server response when the localhost redirectUri is hit
|
* @param successTemplate
|
* @param errorTemplate
|
* @returns
|
*/
|
async listenForAuthCode(successTemplate, errorTemplate) {
|
if (this.server) {
|
throw NodeAuthError.createLoopbackServerAlreadyExistsError();
|
}
|
return new Promise((resolve, reject) => {
|
this.server = http.createServer((req, res) => {
|
const url = req.url;
|
if (!url) {
|
res.end(errorTemplate ||
|
"Error occurred loading redirectUrl");
|
reject(NodeAuthError.createUnableToLoadRedirectUrlError());
|
return;
|
}
|
else if (url === FORWARD_SLASH) {
|
res.end(successTemplate ||
|
"Auth code was successfully acquired. You can close this window now.");
|
return;
|
}
|
const redirectUri = this.getRedirectUri();
|
const parsedUrl = new URL(url, redirectUri);
|
const authCodeResponse = getDeserializedResponse(parsedUrl.search) ||
|
{};
|
if (authCodeResponse.code) {
|
res.writeHead(HTTP_REDIRECT, {
|
location: redirectUri,
|
}); // Prevent auth code from being saved in the browser history
|
res.end();
|
}
|
if (authCodeResponse.error) {
|
res.end(errorTemplate ||
|
`Error occurred: ${authCodeResponse.error}`);
|
}
|
resolve(authCodeResponse);
|
});
|
this.server.listen(0, "127.0.0.1"); // Listen on any available port
|
});
|
}
|
/**
|
* Get the port that the loopback server is running on
|
* @returns
|
*/
|
getRedirectUri() {
|
if (!this.server || !this.server.listening) {
|
throw NodeAuthError.createNoLoopbackServerExistsError();
|
}
|
const address = this.server.address();
|
if (!address || typeof address === "string" || !address.port) {
|
this.closeServer();
|
throw NodeAuthError.createInvalidLoopbackAddressTypeError();
|
}
|
const port = address && address.port;
|
return `${Constants.HTTP_PROTOCOL}${Constants.LOCALHOST}:${port}`;
|
}
|
/**
|
* Close the loopback server
|
*/
|
closeServer() {
|
if (this.server) {
|
// Only stops accepting new connections, server will close once open/idle connections are closed.
|
this.server.close();
|
if (typeof this.server.closeAllConnections === "function") {
|
/*
|
* Close open/idle connections. This API is available in Node versions 18.2 and higher
|
*/
|
this.server.closeAllConnections();
|
}
|
this.server.unref();
|
this.server = undefined;
|
}
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* OAuth2.0 Device code client
|
* @public
|
*/
|
class DeviceCodeClient extends BaseClient {
|
constructor(configuration) {
|
super(configuration);
|
}
|
/**
|
* Gets device code from device code endpoint, calls back to with device code response, and
|
* polls token endpoint to exchange device code for tokens
|
* @param request - developer provided CommonDeviceCodeRequest
|
*/
|
async acquireToken(request) {
|
const deviceCodeResponse = await this.getDeviceCode(request);
|
request.deviceCodeCallback(deviceCodeResponse);
|
const reqTimestamp = nowSeconds();
|
const response = await this.acquireTokenWithDeviceCode(request, deviceCodeResponse);
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
// Validate response. This function throws a server error if an error is returned by the server.
|
responseHandler.validateTokenResponse(response, request.correlationId);
|
return responseHandler.handleServerTokenResponse(response, this.authority, reqTimestamp, request, ApiId.acquireTokenByDeviceCode);
|
}
|
/**
|
* Creates device code request and executes http GET
|
* @param request - developer provided CommonDeviceCodeRequest
|
*/
|
async getDeviceCode(request) {
|
const queryParametersString = this.createExtraQueryParameters(request);
|
const endpoint = UrlString.appendQueryString(this.authority.deviceCodeEndpoint, queryParametersString);
|
const queryString = this.createQueryString(request);
|
const headers = this.createTokenRequestHeaders();
|
const thumbprint = {
|
clientId: this.config.authOptions.clientId,
|
authority: request.authority,
|
scopes: request.scopes,
|
claims: request.claims,
|
authenticationScheme: request.authenticationScheme,
|
resourceRequestMethod: request.resourceRequestMethod,
|
resourceRequestUri: request.resourceRequestUri,
|
shrClaims: request.shrClaims,
|
sshKid: request.sshKid,
|
};
|
return this.executePostRequestToDeviceCodeEndpoint(endpoint, queryString, headers, thumbprint, request.correlationId);
|
}
|
/**
|
* Creates query string for the device code request
|
* @param request - developer provided CommonDeviceCodeRequest
|
*/
|
createExtraQueryParameters(request) {
|
const parameters = new Map();
|
if (request.extraQueryParameters) {
|
addExtraParameters(parameters, request.extraQueryParameters);
|
}
|
return mapToQueryString(parameters);
|
}
|
/**
|
* Executes POST request to device code endpoint
|
* @param deviceCodeEndpoint - token endpoint
|
* @param queryString - string to be used in the body of the request
|
* @param headers - headers for the request
|
* @param thumbprint - unique request thumbprint
|
* @param correlationId - correlation id to be used in the request
|
*/
|
async executePostRequestToDeviceCodeEndpoint(deviceCodeEndpoint, queryString, headers, thumbprint, correlationId) {
|
const { body: { user_code: userCode, device_code: deviceCode, verification_uri: verificationUri, expires_in: expiresIn, interval, message, }, } = await this.sendPostRequest(thumbprint, deviceCodeEndpoint, {
|
body: queryString,
|
headers: headers,
|
}, correlationId);
|
return {
|
userCode,
|
deviceCode,
|
verificationUri,
|
expiresIn,
|
interval,
|
message,
|
};
|
}
|
/**
|
* Create device code endpoint query parameters and returns string
|
* @param request - developer provided CommonDeviceCodeRequest
|
*/
|
createQueryString(request) {
|
const parameters = new Map();
|
addScopes(parameters, request.scopes);
|
addClientId(parameters, this.config.authOptions.clientId);
|
if (request.extraQueryParameters) {
|
addExtraParameters(parameters, request.extraQueryParameters);
|
}
|
if (request.claims ||
|
(this.config.authOptions.clientCapabilities &&
|
this.config.authOptions.clientCapabilities.length > 0)) {
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
|
}
|
return mapToQueryString(parameters);
|
}
|
/**
|
* Breaks the polling with specific conditions
|
* @param deviceCodeExpirationTime - expiration time for the device code request
|
* @param userSpecifiedTimeout - developer provided timeout, to be compared against deviceCodeExpirationTime
|
* @param userSpecifiedCancelFlag - boolean indicating the developer would like to cancel the request
|
*/
|
continuePolling(deviceCodeExpirationTime, userSpecifiedTimeout, userSpecifiedCancelFlag) {
|
if (userSpecifiedCancelFlag) {
|
this.logger.error("Token request cancelled by setting DeviceCodeRequest.cancel = true", "");
|
throw createClientAuthError(deviceCodePollingCancelled);
|
}
|
else if (userSpecifiedTimeout &&
|
userSpecifiedTimeout < deviceCodeExpirationTime &&
|
nowSeconds() > userSpecifiedTimeout) {
|
this.logger.error(`User defined timeout for device code polling reached. The timeout was set for ${userSpecifiedTimeout}`, "");
|
throw createClientAuthError(userTimeoutReached);
|
}
|
else if (nowSeconds() > deviceCodeExpirationTime) {
|
if (userSpecifiedTimeout) {
|
this.logger.verbose(`User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${userSpecifiedTimeout}`, "");
|
}
|
this.logger.error(`Device code expired. Expiration time of device code was ${deviceCodeExpirationTime}`, "");
|
throw createClientAuthError(deviceCodeExpired);
|
}
|
return true;
|
}
|
/**
|
* Creates token request with device code response and polls token endpoint at interval set by the device code response
|
* @param request - developer provided CommonDeviceCodeRequest
|
* @param deviceCodeResponse - DeviceCodeResponse returned by the security token service device code endpoint
|
*/
|
async acquireTokenWithDeviceCode(request, deviceCodeResponse) {
|
const queryParametersString = this.createTokenQueryParameters(request);
|
const endpoint = UrlString.appendQueryString(this.authority.tokenEndpoint, queryParametersString);
|
const requestBody = this.createTokenRequestBody(request, deviceCodeResponse);
|
const headers = this.createTokenRequestHeaders();
|
const userSpecifiedTimeout = request.timeout
|
? nowSeconds() + request.timeout
|
: undefined;
|
const deviceCodeExpirationTime = nowSeconds() + deviceCodeResponse.expiresIn;
|
const pollingIntervalMilli = deviceCodeResponse.interval * 1000;
|
/*
|
* Poll token endpoint while (device code is not expired AND operation has not been cancelled by
|
* setting CancellationToken.cancel = true). POST request is sent at interval set by pollingIntervalMilli
|
*/
|
while (this.continuePolling(deviceCodeExpirationTime, userSpecifiedTimeout, request.cancel)) {
|
const thumbprint = {
|
clientId: this.config.authOptions.clientId,
|
authority: request.authority,
|
scopes: request.scopes,
|
claims: request.claims,
|
authenticationScheme: request.authenticationScheme,
|
resourceRequestMethod: request.resourceRequestMethod,
|
resourceRequestUri: request.resourceRequestUri,
|
shrClaims: request.shrClaims,
|
sshKid: request.sshKid,
|
};
|
const response = await this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint, request.correlationId);
|
if (response.body && response.body.error) {
|
// user authorization is pending. Sleep for polling interval and try again
|
if (response.body.error === AUTHORIZATION_PENDING) {
|
this.logger.info("Authorization pending. Continue polling.", request.correlationId);
|
await delay(pollingIntervalMilli);
|
}
|
else {
|
// for any other error, throw
|
this.logger.info("Unexpected error in polling from the server", request.correlationId);
|
throw createAuthError(postRequestFailed, response.body.error);
|
}
|
}
|
else {
|
this.logger.verbose("Authorization completed successfully. Polling stopped.", request.correlationId);
|
return response.body;
|
}
|
}
|
/*
|
* The above code should've thrown by this point, but to satisfy TypeScript,
|
* and in the rare case the conditionals in continuePolling() may not catch everything...
|
*/
|
this.logger.error("Polling stopped for unknown reasons.", request.correlationId);
|
throw createClientAuthError(deviceCodeUnknownError);
|
}
|
/**
|
* Creates query parameters and converts to string.
|
* @param request - developer provided CommonDeviceCodeRequest
|
* @param deviceCodeResponse - DeviceCodeResponse returned by the security token service device code endpoint
|
*/
|
createTokenRequestBody(request, deviceCodeResponse) {
|
const parameters = new Map();
|
addScopes(parameters, request.scopes);
|
addClientId(parameters, this.config.authOptions.clientId);
|
addGrantType(parameters, GrantType.DEVICE_CODE_GRANT);
|
addDeviceCode(parameters, deviceCodeResponse.deviceCode);
|
const correlationId = request.correlationId ||
|
this.config.cryptoInterface.createNewGuid();
|
addCorrelationId(parameters, correlationId);
|
addClientInfo(parameters);
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
addThrottling(parameters);
|
if (this.serverTelemetryManager) {
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
}
|
if (!StringUtils.isEmptyObj(request.claims) ||
|
(this.config.authOptions.clientCapabilities &&
|
this.config.authOptions.clientCapabilities.length > 0)) {
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
|
}
|
return mapToQueryString(parameters);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* This class is to be used to acquire tokens for public client applications (desktop, mobile). Public client applications
|
* are not trusted to safely store application secrets, and therefore can only request tokens in the name of an user.
|
* @public
|
*/
|
class PublicClientApplication extends ClientApplication {
|
/**
|
* Important attributes in the Configuration object for auth are:
|
* - clientID: the application ID of your application. You can obtain one by registering your application with our Application registration portal.
|
* - authority: the authority URL for your application.
|
*
|
* AAD authorities are of the form https://login.microsoftonline.com/\{Enter_the_Tenant_Info_Here\}.
|
* - If your application supports Accounts in one organizational directory, replace "Enter_the_Tenant_Info_Here" value with the Tenant Id or Tenant name (for example, contoso.microsoft.com).
|
* - If your application supports Accounts in any organizational directory, replace "Enter_the_Tenant_Info_Here" value with organizations.
|
* - If your application supports Accounts in any organizational directory and personal Microsoft accounts, replace "Enter_the_Tenant_Info_Here" value with common.
|
* - To restrict support to Personal Microsoft accounts only, replace "Enter_the_Tenant_Info_Here" value with consumers.
|
*
|
* Azure B2C authorities are of the form https://\{instance\}/\{tenant\}/\{policy\}. Each policy is considered
|
* its own authority. You will have to set the all of the knownAuthorities at the time of the client application
|
* construction.
|
*
|
* ADFS authorities are of the form https://\{instance\}/adfs.
|
*/
|
constructor(configuration) {
|
super(configuration);
|
if (this.config.broker.nativeBrokerPlugin) {
|
if (this.config.broker.nativeBrokerPlugin.isBrokerAvailable) {
|
this.nativeBrokerPlugin = this.config.broker.nativeBrokerPlugin;
|
this.nativeBrokerPlugin.setLogger(this.config.system.loggerOptions);
|
}
|
else {
|
this.logger.warning("NativeBroker implementation was provided but the broker is unavailable.", "");
|
}
|
}
|
this.skus = ServerTelemetryManager.makeExtraSkuString({
|
libraryName: Constants.MSAL_SKU,
|
libraryVersion: version,
|
});
|
}
|
/**
|
* Acquires a token from the authority using OAuth2.0 device code flow.
|
* This flow is designed for devices that do not have access to a browser or have input constraints.
|
* The authorization server issues a DeviceCode object with a verification code, an end-user code,
|
* and the end-user verification URI. The DeviceCode object is provided through a callback, and the end-user should be
|
* instructed to use another device to navigate to the verification URI to input credentials.
|
* Since the client cannot receive incoming requests, it polls the authorization server repeatedly
|
* until the end-user completes input of credentials.
|
*/
|
async acquireTokenByDeviceCode(request) {
|
this.logger.info("acquireTokenByDeviceCode called", request.correlationId || "");
|
enforceResourceParameter(this.config.auth.isMcp, request);
|
const validRequest = Object.assign(request, await this.initializeBaseRequest(request));
|
const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenByDeviceCode, validRequest.correlationId);
|
try {
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
|
const deviceCodeConfig = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, "", serverTelemetryManager);
|
const deviceCodeClient = new DeviceCodeClient(deviceCodeConfig);
|
this.logger.verbose("Device code client created", validRequest.correlationId);
|
return await deviceCodeClient.acquireToken(validRequest);
|
}
|
catch (e) {
|
if (e instanceof AuthError) {
|
e.setCorrelationId(validRequest.correlationId);
|
}
|
serverTelemetryManager.cacheFailedRequest(e);
|
throw e;
|
}
|
}
|
/**
|
* Acquires a token interactively via the browser by requesting an authorization code then exchanging it for a token.
|
*/
|
async acquireTokenInteractive(request) {
|
const correlationId = request.correlationId || this.cryptoProvider.createNewGuid();
|
this.logger.trace("acquireTokenInteractive called", correlationId);
|
enforceResourceParameter(this.config.auth.isMcp, request);
|
const { openBrowser, successTemplate, errorTemplate, windowHandle, loopbackClient: customLoopbackClient, ...remainingProperties } = request;
|
if (this.nativeBrokerPlugin) {
|
const brokerRequest = {
|
...remainingProperties,
|
clientId: this.config.auth.clientId,
|
scopes: request.scopes || OIDC_DEFAULT_SCOPES,
|
redirectUri: request.redirectUri || "",
|
authority: request.authority || this.config.auth.authority,
|
correlationId: correlationId,
|
extraParameters: {
|
...remainingProperties.extraQueryParameters,
|
...remainingProperties.extraParameters,
|
[X_CLIENT_EXTRA_SKU]: this.skus,
|
},
|
accountId: remainingProperties.account?.nativeAccountId,
|
};
|
return this.nativeBrokerPlugin.acquireTokenInteractive(brokerRequest, windowHandle);
|
}
|
if (request.redirectUri) {
|
// If it's not a broker fallback scenario, we throw an error
|
if (!this.config.broker.nativeBrokerPlugin) {
|
throw NodeAuthError.createRedirectUriNotSupportedError();
|
}
|
// If a redirect URI is provided for a broker flow but MSAL runtime startup failed, we fall back to the browser flow and will ignore the redirect URI provided for the broker flow
|
request.redirectUri = "";
|
}
|
const { verifier, challenge } = await this.cryptoProvider.generatePkceCodes();
|
const loopbackClient = customLoopbackClient || new LoopbackClient();
|
let authCodeResponse = {};
|
let authCodeListenerError = null;
|
try {
|
const authCodeListener = loopbackClient
|
.listenForAuthCode(successTemplate, errorTemplate)
|
.then((response) => {
|
authCodeResponse = response;
|
})
|
.catch((e) => {
|
// Store the promise instead of throwing so we can control when its thrown
|
authCodeListenerError = e;
|
});
|
// Wait for server to be listening
|
const redirectUri = await this.waitForRedirectUri(loopbackClient);
|
const validRequest = {
|
...remainingProperties,
|
correlationId: correlationId,
|
scopes: request.scopes || OIDC_DEFAULT_SCOPES,
|
redirectUri: redirectUri,
|
responseMode: ResponseMode$1.QUERY,
|
codeChallenge: challenge,
|
codeChallengeMethod: CodeChallengeMethodValues.S256,
|
};
|
const authCodeUrl = await this.getAuthCodeUrl(validRequest);
|
await openBrowser(authCodeUrl);
|
await authCodeListener;
|
if (authCodeListenerError) {
|
throw authCodeListenerError;
|
}
|
if (authCodeResponse.error) {
|
throw new ServerError(authCodeResponse.error, authCodeResponse.error_description, authCodeResponse.suberror);
|
}
|
else if (!authCodeResponse.code) {
|
throw NodeAuthError.createNoAuthCodeInResponseError();
|
}
|
const clientInfo = authCodeResponse.client_info;
|
const tokenRequest = {
|
code: authCodeResponse.code,
|
codeVerifier: verifier,
|
clientInfo: clientInfo || "",
|
...validRequest,
|
};
|
return await this.acquireTokenByCode(tokenRequest); // Await this so the server doesn't close prematurely
|
}
|
finally {
|
loopbackClient.closeServer();
|
}
|
}
|
/**
|
* Returns a token retrieved either from the cache or by exchanging the refresh token for a fresh access token. If brokering is enabled the token request will be serviced by the broker.
|
* @param request - developer provided SilentFlowRequest
|
* @returns
|
*/
|
async acquireTokenSilent(request) {
|
const correlationId = request.correlationId || this.cryptoProvider.createNewGuid();
|
this.logger.trace("acquireTokenSilent called", correlationId);
|
enforceResourceParameter(this.config.auth.isMcp, request);
|
if (this.nativeBrokerPlugin) {
|
const brokerRequest = {
|
...request,
|
clientId: this.config.auth.clientId,
|
scopes: request.scopes || OIDC_DEFAULT_SCOPES,
|
redirectUri: request.redirectUri || "",
|
authority: request.authority || this.config.auth.authority,
|
correlationId: correlationId,
|
extraParameters: {
|
...request.extraQueryParameters,
|
...request.extraParameters,
|
[X_CLIENT_EXTRA_SKU]: this.skus,
|
},
|
accountId: request.account.nativeAccountId,
|
forceRefresh: request.forceRefresh || false,
|
};
|
return this.nativeBrokerPlugin.acquireTokenSilent(brokerRequest);
|
}
|
if (request.redirectUri) {
|
// If it's not a broker fallback scenario, we throw an error
|
if (!this.config.broker.nativeBrokerPlugin) {
|
throw NodeAuthError.createRedirectUriNotSupportedError();
|
}
|
request.redirectUri = "";
|
}
|
return super.acquireTokenSilent(request);
|
}
|
/**
|
* Acquires a token by exchanging the authorization code received from the first step of OAuth 2.0 Authorization Code Flow.
|
* In MCP mode, a resource parameter is required on the request.
|
*/
|
async acquireTokenByCode(request, authCodePayLoad) {
|
enforceResourceParameter(this.config.auth.isMcp, request);
|
return super.acquireTokenByCode(request, authCodePayLoad);
|
}
|
/**
|
* Acquires a token by exchanging the refresh token provided for a new set of tokens.
|
* In MCP mode, a resource parameter is required on the request.
|
*/
|
async acquireTokenByRefreshToken(request) {
|
enforceResourceParameter(this.config.auth.isMcp, request);
|
return super.acquireTokenByRefreshToken(request);
|
}
|
/**
|
* Removes cache artifacts associated with the given account
|
* @param request - developer provided SignOutRequest
|
* @returns
|
*/
|
async signOut(request) {
|
if (this.nativeBrokerPlugin && request.account.nativeAccountId) {
|
const signoutRequest = {
|
clientId: this.config.auth.clientId,
|
accountId: request.account.nativeAccountId,
|
correlationId: request.correlationId ||
|
this.cryptoProvider.createNewGuid(),
|
};
|
await this.nativeBrokerPlugin.signOut(signoutRequest);
|
}
|
await this.getTokenCache().removeAccount(request.account, request.correlationId);
|
}
|
/**
|
* Returns all cached accounts for this application. If brokering is enabled this request will be serviced by the broker.
|
* @returns
|
*/
|
async getAllAccounts() {
|
if (this.nativeBrokerPlugin) {
|
const correlationId = this.cryptoProvider.createNewGuid();
|
return this.nativeBrokerPlugin.getAllAccounts(this.config.auth.clientId, correlationId);
|
}
|
return this.getTokenCache().getAllAccounts();
|
}
|
/**
|
* Attempts to retrieve the redirectUri from the loopback server. If the loopback server does not start listening for requests within the timeout this will throw.
|
* @param loopbackClient - developer provided custom loopback server implementation
|
* @returns
|
*/
|
async waitForRedirectUri(loopbackClient) {
|
return new Promise((resolve, reject) => {
|
let ticks = 0;
|
const id = setInterval(() => {
|
if (LOOPBACK_SERVER_CONSTANTS.TIMEOUT_MS /
|
LOOPBACK_SERVER_CONSTANTS.INTERVAL_MS <
|
ticks) {
|
clearInterval(id);
|
reject(NodeAuthError.createLoopbackServerTimeoutError());
|
return;
|
}
|
try {
|
const r = loopbackClient.getRedirectUri();
|
clearInterval(id);
|
resolve(r);
|
return;
|
}
|
catch (e) {
|
if (e instanceof AuthError &&
|
e.errorCode ===
|
NodeAuthErrorMessage.noLoopbackServerExists.code) {
|
// Loopback server is not listening yet
|
ticks++;
|
return;
|
}
|
clearInterval(id);
|
reject(e);
|
return;
|
}
|
}, LOOPBACK_SERVER_CONSTANTS.INTERVAL_MS);
|
});
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* OAuth2.0 client credential grant
|
* @public
|
*/
|
class ClientCredentialClient extends BaseClient {
|
constructor(configuration, appTokenProvider) {
|
super(configuration);
|
this.appTokenProvider = appTokenProvider;
|
}
|
/**
|
* Public API to acquire a token with ClientCredential Flow for Confidential clients
|
* @param request - CommonClientCredentialRequest provided by the developer
|
*/
|
async acquireToken(request) {
|
if (request.skipCache || request.claims) {
|
return this.executeTokenRequest(request, this.authority);
|
}
|
const [cachedAuthenticationResult, lastCacheOutcome] = await this.getCachedAuthenticationResult(request, this.config, this.cryptoUtils, this.authority, this.cacheManager, this.serverTelemetryManager);
|
if (cachedAuthenticationResult) {
|
// if the token is not expired but must be refreshed; get a new one in the background
|
if (lastCacheOutcome ===
|
CacheOutcome.PROACTIVELY_REFRESHED) {
|
this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.", request.correlationId);
|
// refresh the access token in the background
|
const refreshAccessToken = true;
|
await this.executeTokenRequest(request, this.authority, refreshAccessToken);
|
}
|
// return the cached token
|
return cachedAuthenticationResult;
|
}
|
else {
|
return this.executeTokenRequest(request, this.authority);
|
}
|
}
|
/**
|
* looks up cache if the tokens are cached already
|
*/
|
async getCachedAuthenticationResult(request, config, cryptoUtils, authority, cacheManager, serverTelemetryManager) {
|
const clientConfiguration = config;
|
const managedIdentityConfiguration = config;
|
let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
|
// read the user-supplied cache into memory, if applicable
|
let cacheContext;
|
if (clientConfiguration.serializableCache &&
|
clientConfiguration.persistencePlugin) {
|
cacheContext = new TokenCacheContext(clientConfiguration.serializableCache, false);
|
await clientConfiguration.persistencePlugin.beforeCacheAccess(cacheContext);
|
}
|
const cachedAccessToken = this.readAccessTokenFromCache(authority, managedIdentityConfiguration.managedIdentityId?.id ||
|
clientConfiguration.authOptions.clientId, new ScopeSet(request.scopes || []), cacheManager, request.correlationId);
|
if (clientConfiguration.serializableCache &&
|
clientConfiguration.persistencePlugin &&
|
cacheContext) {
|
await clientConfiguration.persistencePlugin.afterCacheAccess(cacheContext);
|
}
|
// must refresh due to non-existent access_token
|
if (!cachedAccessToken) {
|
serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
|
return [null, CacheOutcome.NO_CACHED_ACCESS_TOKEN];
|
}
|
// must refresh due to the expires_in value
|
if (isTokenExpired(cachedAccessToken.expiresOn, clientConfiguration.systemOptions?.tokenRenewalOffsetSeconds ||
|
DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
|
serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
|
return [null, CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED];
|
}
|
// must refresh (in the background) due to the refresh_in value
|
if (cachedAccessToken.refreshOn &&
|
isTokenExpired(cachedAccessToken.refreshOn.toString(), 0)) {
|
lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
|
serverTelemetryManager?.setCacheOutcome(CacheOutcome.PROACTIVELY_REFRESHED);
|
}
|
return [
|
await ResponseHandler.generateAuthenticationResult(cryptoUtils, authority, {
|
account: null,
|
idToken: null,
|
accessToken: cachedAccessToken,
|
refreshToken: null,
|
appMetadata: null,
|
}, true, request, this.performanceClient),
|
lastCacheOutcome,
|
];
|
}
|
/**
|
* Reads access token from the cache
|
*/
|
readAccessTokenFromCache(authority, id, scopeSet, cacheManager, correlationId) {
|
const accessTokenFilter = {
|
homeAccountId: "",
|
environment: authority.canonicalAuthorityUrlComponents.HostNameAndPort,
|
credentialType: CredentialType.ACCESS_TOKEN,
|
clientId: id,
|
realm: authority.tenant,
|
target: ScopeSet.createSearchScopes(scopeSet.asArray()),
|
};
|
const accessTokens = cacheManager.getAccessTokensByFilter(accessTokenFilter, correlationId);
|
if (accessTokens.length < 1) {
|
return null;
|
}
|
else if (accessTokens.length > 1) {
|
throw createClientAuthError(multipleMatchingTokens);
|
}
|
return accessTokens[0];
|
}
|
/**
|
* Makes a network call to request the token from the service
|
* @param request - CommonClientCredentialRequest provided by the developer
|
* @param authority - authority object
|
*/
|
async executeTokenRequest(request, authority, refreshAccessToken) {
|
let serverTokenResponse;
|
let reqTimestamp;
|
if (this.appTokenProvider) {
|
this.logger.info("Using appTokenProvider extensibility.", request.correlationId);
|
const appTokenPropviderParameters = {
|
correlationId: request.correlationId,
|
tenantId: this.config.authOptions.authority.tenant,
|
scopes: request.scopes,
|
claims: request.claims,
|
};
|
reqTimestamp = nowSeconds();
|
const appTokenProviderResult = await this.appTokenProvider(appTokenPropviderParameters);
|
serverTokenResponse = {
|
access_token: appTokenProviderResult.accessToken,
|
expires_in: appTokenProviderResult.expiresInSeconds,
|
refresh_in: appTokenProviderResult.refreshInSeconds,
|
token_type: AuthenticationScheme.BEARER,
|
};
|
}
|
else {
|
const queryParametersString = this.createTokenQueryParameters(request);
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
const requestBody = await this.createTokenRequestBody(request);
|
const headers = this.createTokenRequestHeaders();
|
const thumbprint = {
|
clientId: this.config.authOptions.clientId,
|
authority: request.authority,
|
scopes: request.scopes,
|
claims: request.claims,
|
authenticationScheme: request.authenticationScheme,
|
resourceRequestMethod: request.resourceRequestMethod,
|
resourceRequestUri: request.resourceRequestUri,
|
shrClaims: request.shrClaims,
|
sshKid: request.sshKid,
|
};
|
this.logger.info("Sending token request to endpoint: " + authority.tokenEndpoint, request.correlationId);
|
reqTimestamp = nowSeconds();
|
const response = await this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint, request.correlationId);
|
serverTokenResponse = response.body;
|
serverTokenResponse.status = response.status;
|
}
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
responseHandler.validateTokenResponse(serverTokenResponse, request.correlationId, refreshAccessToken);
|
const tokenResponse = await responseHandler.handleServerTokenResponse(serverTokenResponse, this.authority, reqTimestamp, request, ApiId.acquireTokenByClientCredential);
|
return tokenResponse;
|
}
|
/**
|
* generate the request to the server in the acceptable format
|
* @param request - CommonClientCredentialRequest provided by the developer
|
*/
|
async createTokenRequestBody(request) {
|
const parameters = new Map();
|
addClientId(parameters, this.config.authOptions.clientId);
|
addScopes(parameters, request.scopes, false);
|
addGrantType(parameters, GrantType.CLIENT_CREDENTIALS_GRANT);
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
addThrottling(parameters);
|
if (this.serverTelemetryManager) {
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
}
|
const correlationId = request.correlationId ||
|
this.config.cryptoInterface.createNewGuid();
|
addCorrelationId(parameters, correlationId);
|
if (this.config.clientCredentials.clientSecret) {
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
}
|
// Use clientAssertion from request, fallback to client assertion in base configuration
|
const clientAssertion = request.clientAssertion ||
|
this.config.clientCredentials.clientAssertion;
|
if (clientAssertion) {
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
}
|
if (!StringUtils.isEmptyObj(request.claims) ||
|
(this.config.authOptions.clientCapabilities &&
|
this.config.authOptions.clientCapabilities.length > 0)) {
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
|
}
|
return mapToQueryString(parameters);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* On-Behalf-Of client
|
* @public
|
*/
|
class OnBehalfOfClient extends BaseClient {
|
constructor(configuration) {
|
super(configuration);
|
}
|
/**
|
* Public API to acquire tokens with on behalf of flow
|
* @param request - developer provided CommonOnBehalfOfRequest
|
*/
|
async acquireToken(request) {
|
this.scopeSet = new ScopeSet(request.scopes || []);
|
// generate the user_assertion_hash for OBOAssertion
|
this.userAssertionHash = await this.cryptoUtils.hashString(request.oboAssertion);
|
if (request.skipCache || request.claims) {
|
return this.executeTokenRequest(request, this.authority, this.userAssertionHash);
|
}
|
try {
|
return await this.getCachedAuthenticationResult(request);
|
}
|
catch (e) {
|
// Any failure falls back to interactive request, once we implement distributed cache, we plan to handle `createRefreshRequiredError` to refresh using the RT
|
return await this.executeTokenRequest(request, this.authority, this.userAssertionHash);
|
}
|
}
|
/**
|
* look up cache for tokens
|
* Find idtoken in the cache
|
* Find accessToken based on user assertion and account info in the cache
|
* Please note we are not yet supported OBO tokens refreshed with long lived RT. User will have to send a new assertion if the current access token expires
|
* This is to prevent security issues when the assertion changes over time, however, longlived RT helps retaining the session
|
* @param request - developer provided CommonOnBehalfOfRequest
|
*/
|
async getCachedAuthenticationResult(request) {
|
// look in the cache for the access_token which matches the incoming_assertion
|
const cachedAccessToken = this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId, request);
|
if (!cachedAccessToken) {
|
// Must refresh due to non-existent access_token.
|
this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
|
this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.", request.correlationId);
|
throw createClientAuthError(tokenRefreshRequired);
|
}
|
else if (isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
|
// Access token expired, will need to renewed
|
this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
|
this.logger.info(`OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`, request.correlationId);
|
throw createClientAuthError(tokenRefreshRequired);
|
}
|
// fetch the idToken from cache
|
const cachedIdToken = this.readIdTokenFromCacheForOBO(cachedAccessToken.homeAccountId, request.correlationId);
|
let idTokenClaims;
|
let cachedAccount = null;
|
if (cachedIdToken) {
|
idTokenClaims = extractTokenClaims(cachedIdToken.secret, EncodingUtils.base64Decode);
|
const localAccountId = idTokenClaims.oid || idTokenClaims.sub;
|
const accountInfo = {
|
homeAccountId: cachedIdToken.homeAccountId,
|
environment: cachedIdToken.environment,
|
tenantId: cachedIdToken.realm,
|
username: "",
|
localAccountId: localAccountId || "",
|
};
|
cachedAccount = this.cacheManager.getAccount(this.cacheManager.generateAccountKey(accountInfo), request.correlationId);
|
}
|
// increment telemetry cache hit counter
|
if (this.config.serverTelemetryManager) {
|
this.config.serverTelemetryManager.incrementCacheHits();
|
}
|
return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, {
|
account: cachedAccount,
|
accessToken: cachedAccessToken,
|
idToken: cachedIdToken,
|
refreshToken: null,
|
appMetadata: null,
|
}, true, request, this.performanceClient, idTokenClaims);
|
}
|
/**
|
* read idtoken from cache, this is a specific implementation for OBO as the requirements differ from a generic lookup in the cacheManager
|
* Certain use cases of OBO flow do not expect an idToken in the cache/or from the service
|
* @param atHomeAccountId - account id
|
*/
|
readIdTokenFromCacheForOBO(atHomeAccountId, correlationId) {
|
const idTokenFilter = {
|
homeAccountId: atHomeAccountId,
|
environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
|
credentialType: CredentialType.ID_TOKEN,
|
clientId: this.config.authOptions.clientId,
|
realm: this.authority.tenant,
|
};
|
const idTokenMap = this.cacheManager.getIdTokensByFilter(idTokenFilter, correlationId);
|
// When acquiring a token on behalf of an application, there might not be an id token in the cache
|
if (Object.values(idTokenMap).length < 1) {
|
return null;
|
}
|
return Object.values(idTokenMap)[0];
|
}
|
/**
|
* Fetches the cached access token based on incoming assertion
|
* @param clientId - client id
|
* @param request - developer provided CommonOnBehalfOfRequest
|
*/
|
readAccessTokenFromCacheForOBO(clientId, request) {
|
const authScheme = request.authenticationScheme ||
|
AuthenticationScheme.BEARER;
|
/*
|
* Distinguish between Bearer and PoP/SSH token cache types
|
* Cast to lowercase to handle "bearer" from ADFS
|
*/
|
const credentialType = authScheme.toLowerCase() !==
|
AuthenticationScheme.BEARER.toLowerCase()
|
? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
|
: CredentialType.ACCESS_TOKEN;
|
const accessTokenFilter = {
|
credentialType: credentialType,
|
clientId,
|
target: ScopeSet.createSearchScopes(this.scopeSet.asArray()),
|
tokenType: authScheme,
|
keyId: request.sshKid,
|
userAssertionHash: this.userAssertionHash,
|
};
|
const accessTokens = this.cacheManager.getAccessTokensByFilter(accessTokenFilter, request.correlationId);
|
const numAccessTokens = accessTokens.length;
|
if (numAccessTokens < 1) {
|
return null;
|
}
|
else if (numAccessTokens > 1) {
|
throw createClientAuthError(multipleMatchingTokens);
|
}
|
return accessTokens[0];
|
}
|
/**
|
* Make a network call to the server requesting credentials
|
* @param request - developer provided CommonOnBehalfOfRequest
|
* @param authority - authority object
|
*/
|
async executeTokenRequest(request, authority, userAssertionHash) {
|
const queryParametersString = this.createTokenQueryParameters(request);
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
const requestBody = await this.createTokenRequestBody(request);
|
const headers = this.createTokenRequestHeaders();
|
const thumbprint = {
|
clientId: this.config.authOptions.clientId,
|
authority: request.authority,
|
scopes: request.scopes,
|
claims: request.claims,
|
authenticationScheme: request.authenticationScheme,
|
resourceRequestMethod: request.resourceRequestMethod,
|
resourceRequestUri: request.resourceRequestUri,
|
shrClaims: request.shrClaims,
|
sshKid: request.sshKid,
|
};
|
const reqTimestamp = nowSeconds();
|
const response = await this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint, request.correlationId);
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
responseHandler.validateTokenResponse(response.body, request.correlationId);
|
const tokenResponse = await responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, ApiId.acquireTokenByOBO, undefined, userAssertionHash);
|
return tokenResponse;
|
}
|
/**
|
* generate a server request in accepable format
|
* @param request - developer provided CommonOnBehalfOfRequest
|
*/
|
async createTokenRequestBody(request) {
|
const parameters = new Map();
|
addClientId(parameters, this.config.authOptions.clientId);
|
addScopes(parameters, request.scopes);
|
addGrantType(parameters, GrantType.JWT_BEARER);
|
addClientInfo(parameters);
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
addThrottling(parameters);
|
if (this.serverTelemetryManager) {
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
}
|
const correlationId = request.correlationId ||
|
this.config.cryptoInterface.createNewGuid();
|
addCorrelationId(parameters, correlationId);
|
addRequestTokenUse(parameters, ON_BEHALF_OF);
|
addOboAssertion(parameters, request.oboAssertion);
|
if (this.config.clientCredentials.clientSecret) {
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
}
|
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
if (clientAssertion) {
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
}
|
if (request.claims ||
|
(this.config.authOptions.clientCapabilities &&
|
this.config.authOptions.clientCapabilities.length > 0)) {
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
|
}
|
return mapToQueryString(parameters);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
// AADAuthorityConstants
|
/**
|
* This class is to be used to acquire tokens for confidential client applications (webApp, webAPI). Confidential client applications
|
* will configure application secrets, client certificates/assertions as applicable
|
* @public
|
*/
|
class ConfidentialClientApplication extends ClientApplication {
|
/**
|
* Constructor for the ConfidentialClientApplication
|
*
|
* Required attributes in the Configuration object are:
|
* - clientID: the application ID of your application. You can obtain one by registering your application with our application registration portal
|
* - authority: the authority URL for your application.
|
* - client credential: Must set either client secret, certificate, or assertion for confidential clients. You can obtain a client secret from the application registration portal.
|
*
|
* In Azure AD, authority is a URL indicating of the form https://login.microsoftonline.com/\{Enter_the_Tenant_Info_Here\}.
|
* If your application supports Accounts in one organizational directory, replace "Enter_the_Tenant_Info_Here" value with the Tenant Id or Tenant name (for example, contoso.microsoft.com).
|
* If your application supports Accounts in any organizational directory, replace "Enter_the_Tenant_Info_Here" value with organizations.
|
* If your application supports Accounts in any organizational directory and personal Microsoft accounts, replace "Enter_the_Tenant_Info_Here" value with common.
|
* To restrict support to Personal Microsoft accounts only, replace "Enter_the_Tenant_Info_Here" value with consumers.
|
*
|
* In Azure B2C, authority is of the form https://\{instance\}/tfp/\{tenant\}/\{policyName\}/
|
* Full B2C functionality will be available in this library in future versions.
|
*
|
* @param Configuration - configuration object for the MSAL ConfidentialClientApplication instance
|
*/
|
constructor(configuration) {
|
super(configuration);
|
const clientSecretNotEmpty = !!this.config.auth.clientSecret;
|
const clientAssertionNotEmpty = !!this.config.auth.clientAssertion;
|
const certificateNotEmpty = (!!this.config.auth.clientCertificate?.thumbprint ||
|
!!this.config.auth.clientCertificate?.thumbprintSha256) &&
|
!!this.config.auth.clientCertificate?.privateKey;
|
/*
|
* If app developer configures this callback, they don't need a credential
|
* i.e. AzureSDK can get token from Managed Identity without a cert / secret
|
*/
|
if (this.appTokenProvider) {
|
return;
|
}
|
// Check that at most one credential is set on the application
|
if ((clientSecretNotEmpty && clientAssertionNotEmpty) ||
|
(clientAssertionNotEmpty && certificateNotEmpty) ||
|
(clientSecretNotEmpty && certificateNotEmpty)) {
|
throw createClientAuthError(invalidClientCredential);
|
}
|
if (this.config.auth.clientSecret) {
|
this.clientSecret = this.config.auth.clientSecret;
|
return;
|
}
|
if (this.config.auth.clientAssertion) {
|
this.developerProvidedClientAssertion =
|
this.config.auth.clientAssertion;
|
return;
|
}
|
if (!certificateNotEmpty) {
|
throw createClientAuthError(invalidClientCredential);
|
}
|
else {
|
this.clientAssertion = !!this.config.auth.clientCertificate
|
.thumbprintSha256
|
? ClientAssertion.fromCertificateWithSha256Thumbprint(this.config.auth.clientCertificate.thumbprintSha256, this.config.auth.clientCertificate.privateKey, this.config.auth.clientCertificate.x5c)
|
: ClientAssertion.fromCertificate(
|
// guaranteed to be a string, due to prior error checking in this function
|
this.config.auth.clientCertificate.thumbprint, this.config.auth.clientCertificate.privateKey, this.config.auth.clientCertificate.x5c);
|
}
|
this.appTokenProvider = undefined;
|
}
|
/**
|
* This extensibility point only works for the client_credential flow, i.e. acquireTokenByClientCredential and
|
* is meant for Azure SDK to enhance Managed Identity support.
|
*
|
* @param IAppTokenProvider - Extensibility interface, which allows the app developer to return a token from a custom source.
|
*/
|
SetAppTokenProvider(provider) {
|
this.appTokenProvider = provider;
|
}
|
/**
|
* Acquires tokens from the authority for the application (not for an end user).
|
*/
|
async acquireTokenByClientCredential(request) {
|
this.logger.info("acquireTokenByClientCredential called", request.correlationId || "");
|
// If there is a client assertion present in the request, it overrides the one present in the client configuration
|
let clientAssertion;
|
if (request.clientAssertion) {
|
clientAssertion = {
|
assertion: await getClientAssertion(request.clientAssertion, this.config.auth.clientId
|
// tokenEndpoint will be undefined. resourceRequestUri is omitted in ClientCredentialRequest
|
),
|
assertionType: Constants.JWT_BEARER_ASSERTION_TYPE,
|
};
|
}
|
const baseRequest = await this.initializeBaseRequest(request);
|
// valid base request should not contain oidc scopes in this grant type
|
const validBaseRequest = {
|
...baseRequest,
|
scopes: baseRequest.scopes.filter((scope) => !OIDC_DEFAULT_SCOPES.includes(scope)),
|
};
|
const validRequest = {
|
...request,
|
...validBaseRequest,
|
clientAssertion,
|
};
|
/*
|
* valid request should not have "common" or "organizations" in lieu of the tenant_id in the authority in the auth configuration
|
* example authority: "https://login.microsoftonline.com/TenantId",
|
*/
|
const authority = new UrlString(validRequest.authority);
|
const tenantId = authority.getUrlComponents().PathSegments[0];
|
if (Object.values(AADAuthority).includes(tenantId)) {
|
throw createClientAuthError(missingTenantIdError);
|
}
|
/*
|
* if this env variable is set, and the developer provided region isn't defined and isn't "DisableMsalForceRegion",
|
* MSAL shall opt-in to ESTS-R with the value of this variable
|
*/
|
const ENV_MSAL_FORCE_REGION = process.env[MSAL_FORCE_REGION];
|
let region;
|
if (validRequest.azureRegion !== "DisableMsalForceRegion") {
|
if (!validRequest.azureRegion && ENV_MSAL_FORCE_REGION) {
|
region = ENV_MSAL_FORCE_REGION;
|
}
|
else {
|
region = validRequest.azureRegion;
|
}
|
}
|
const azureRegionConfiguration = {
|
azureRegion: region,
|
environmentRegion: process.env[REGION_ENVIRONMENT_VARIABLE],
|
};
|
const serverTelemetryManager = this.initializeServerTelemetryManager(ApiId.acquireTokenByClientCredential, validRequest.correlationId, validRequest.skipCache);
|
try {
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, azureRegionConfiguration, request.azureCloudOptions);
|
const clientCredentialConfig = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, "", serverTelemetryManager);
|
const clientCredentialClient = new ClientCredentialClient(clientCredentialConfig, this.appTokenProvider);
|
this.logger.verbose("Client credential client created", validRequest.correlationId);
|
return await clientCredentialClient.acquireToken(validRequest);
|
}
|
catch (e) {
|
if (e instanceof AuthError) {
|
e.setCorrelationId(validRequest.correlationId);
|
}
|
serverTelemetryManager.cacheFailedRequest(e);
|
throw e;
|
}
|
}
|
/**
|
* Acquires tokens from the authority for the application.
|
*
|
* Used in scenarios where the current app is a middle-tier service which was called with a token
|
* representing an end user. The current app can use the token (oboAssertion) to request another
|
* token to access downstream web API, on behalf of that user.
|
*
|
* The current middle-tier app has no user interaction to obtain consent.
|
* See how to gain consent upfront for your middle-tier app from this article.
|
* https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow#gaining-consent-for-the-middle-tier-application
|
*/
|
async acquireTokenOnBehalfOf(request) {
|
this.logger.info("acquireTokenOnBehalfOf called", request.correlationId || "");
|
const validRequest = {
|
...request,
|
...(await this.initializeBaseRequest(request)),
|
};
|
try {
|
const discoveredAuthority = await this.createAuthority(validRequest.authority, validRequest.correlationId, undefined, request.azureCloudOptions);
|
const onBehalfOfConfig = await this.buildOauthClientConfiguration(discoveredAuthority, validRequest.correlationId, "", undefined);
|
const oboClient = new OnBehalfOfClient(onBehalfOfConfig);
|
this.logger.verbose("On behalf of client created", validRequest.correlationId);
|
return await oboClient.acquireToken(validRequest);
|
}
|
catch (e) {
|
if (e instanceof AuthError) {
|
e.setCorrelationId(validRequest.correlationId);
|
}
|
throw e;
|
}
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* @internal
|
* Checks if a given date string is in ISO 8601 format.
|
*
|
* @param dateString - The date string to be checked.
|
* @returns boolean - Returns true if the date string is in ISO 8601 format, otherwise false.
|
*/
|
function isIso8601(dateString) {
|
if (typeof dateString !== "string") {
|
return false;
|
}
|
const date = new Date(dateString);
|
return !isNaN(date.getTime()) && date.toISOString() === dateString;
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class HttpClientWithRetries {
|
constructor(httpClientNoRetries, retryPolicy, logger) {
|
this.httpClientNoRetries = httpClientNoRetries;
|
this.retryPolicy = retryPolicy;
|
this.logger = logger;
|
}
|
async sendNetworkRequestAsyncHelper(httpMethod, url, options) {
|
if (httpMethod === HttpMethod.GET) {
|
return this.httpClientNoRetries.sendGetRequestAsync(url, options);
|
}
|
else {
|
return this.httpClientNoRetries.sendPostRequestAsync(url, options);
|
}
|
}
|
async sendNetworkRequestAsync(httpMethod, url, options) {
|
// the underlying network module (custom or HttpClient) will make the call
|
let response = await this.sendNetworkRequestAsyncHelper(httpMethod, url, options);
|
if ("isNewRequest" in this.retryPolicy) {
|
this.retryPolicy.isNewRequest = true;
|
}
|
let currentRetry = 0;
|
while (await this.retryPolicy.pauseForRetry(response.status, currentRetry, this.logger, response.headers[HeaderNames.RETRY_AFTER])) {
|
response = await this.sendNetworkRequestAsyncHelper(httpMethod, url, options);
|
currentRetry++;
|
}
|
return response;
|
}
|
async sendGetRequestAsync(url, options) {
|
return this.sendNetworkRequestAsync(HttpMethod.GET, url, options);
|
}
|
async sendPostRequestAsync(url, options) {
|
return this.sendNetworkRequestAsync(HttpMethod.POST, url, options);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Managed Identity User Assigned Id Query Parameter Names
|
*/
|
const ManagedIdentityUserAssignedIdQueryParameterNames = {
|
MANAGED_IDENTITY_CLIENT_ID_2017: "clientid",
|
MANAGED_IDENTITY_CLIENT_ID: "client_id",
|
MANAGED_IDENTITY_OBJECT_ID: "object_id",
|
MANAGED_IDENTITY_RESOURCE_ID_IMDS: "msi_res_id",
|
MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS: "mi_res_id",
|
};
|
/**
|
* Base class for all Managed Identity sources. Provides common functionality for
|
* authenticating with Azure Managed Identity endpoints across different Azure services
|
* including IMDS, App Service, Azure Arc, Service Fabric, Cloud Shell, and Machine Learning.
|
*
|
* This abstract class handles token acquisition, response processing, and network communication
|
* while allowing concrete implementations to define source-specific request creation logic.
|
*/
|
class BaseManagedIdentitySource {
|
/**
|
* Creates an instance of BaseManagedIdentitySource.
|
*
|
* @param logger - Logger instance for diagnostic information
|
* @param nodeStorage - Storage interface for caching tokens
|
* @param networkClient - Network client for making HTTP requests
|
* @param cryptoProvider - Cryptographic provider for token operations
|
* @param disableInternalRetries - Whether to disable automatic retry logic
|
*/
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries) {
|
this.logger = logger;
|
this.nodeStorage = nodeStorage;
|
this.networkClient = networkClient;
|
this.cryptoProvider = cryptoProvider;
|
this.disableInternalRetries = disableInternalRetries;
|
}
|
/**
|
* Processes the network response and converts it to a standardized server token response.
|
* This async version allows for source-specific response processing logic while maintaining
|
* backward compatibility with the synchronous version.
|
*
|
* @param response - The network response containing the managed identity token
|
* @param _networkClient - Network client used for the request (unused in base implementation)
|
* @param _networkRequest - The original network request parameters (unused in base implementation)
|
* @param _networkRequestOptions - The network request options (unused in base implementation)
|
*
|
* @returns Promise resolving to a standardized server authorization token response
|
*/
|
async getServerTokenResponseAsync(response,
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
_networkClient,
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
_networkRequest,
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
_networkRequestOptions) {
|
return this.getServerTokenResponse(response);
|
}
|
/**
|
* Converts a managed identity token response to a standardized server authorization token response.
|
* Handles time format conversion, expiration calculation, and error mapping to ensure
|
* compatibility with the MSAL response handling pipeline.
|
*
|
* @param response - The network response containing the managed identity token
|
*
|
* @returns Standardized server authorization token response with normalized fields
|
*/
|
getServerTokenResponse(response) {
|
let refreshIn, expiresIn;
|
if (response.body.expires_on) {
|
// if the expires_on field in the response body is a string and in ISO 8601 format, convert it to a Unix timestamp (seconds since epoch)
|
if (isIso8601(response.body.expires_on)) {
|
response.body.expires_on =
|
new Date(response.body.expires_on).getTime() / 1000;
|
}
|
expiresIn = response.body.expires_on - nowSeconds();
|
// compute refresh_in as 1/2 of expires_in, but only if expires_in > 2h
|
if (expiresIn > 2 * 3600) {
|
refreshIn = expiresIn / 2;
|
}
|
}
|
const serverTokenResponse = {
|
status: response.status,
|
// success
|
access_token: response.body.access_token,
|
expires_in: expiresIn,
|
scope: response.body.resource,
|
token_type: response.body.token_type,
|
refresh_in: refreshIn,
|
// error
|
correlation_id: response.body.correlation_id || response.body.correlationId,
|
error: typeof response.body.error === "string"
|
? response.body.error
|
: response.body.error?.code,
|
error_description: response.body.message ||
|
(typeof response.body.error === "string"
|
? response.body.error_description
|
: response.body.error?.message),
|
error_codes: response.body.error_codes,
|
timestamp: response.body.timestamp,
|
trace_id: response.body.trace_id,
|
};
|
return serverTokenResponse;
|
}
|
/**
|
* Acquires an access token using the managed identity endpoint for the specified resource.
|
* This is the primary method for token acquisition, handling the complete flow from
|
* request creation through response processing and token caching.
|
*
|
* @param managedIdentityRequest - The managed identity request containing resource and optional parameters
|
* @param managedIdentityId - The managed identity configuration (system or user-assigned)
|
* @param fakeAuthority - Authority instance used for token caching (managed identity uses a placeholder authority)
|
* @param refreshAccessToken - Whether this is a token refresh operation
|
*
|
* @returns Promise resolving to an authentication result containing the access token and metadata
|
*
|
* @throws {AuthError} When network requests fail or token validation fails
|
* @throws {ClientAuthError} When network errors occur during the request
|
*/
|
async acquireTokenWithManagedIdentity(managedIdentityRequest, managedIdentityId, fakeAuthority, refreshAccessToken) {
|
const networkRequest = this.createRequest(managedIdentityRequest.resource, managedIdentityId);
|
if (managedIdentityRequest.revokedTokenSha256Hash) {
|
this.logger.info(`[Managed Identity] The following claims are present in the request: ${managedIdentityRequest.claims}`, "");
|
networkRequest.queryParameters[ManagedIdentityQueryParameters.SHA256_TOKEN_TO_REFRESH] = managedIdentityRequest.revokedTokenSha256Hash;
|
}
|
if (managedIdentityRequest.clientCapabilities?.length) {
|
const clientCapabilities = managedIdentityRequest.clientCapabilities.toString();
|
this.logger.info(`[Managed Identity] The following client capabilities are present in the request: ${clientCapabilities}`, "");
|
networkRequest.queryParameters[ManagedIdentityQueryParameters.XMS_CC] = clientCapabilities;
|
}
|
const headers = networkRequest.headers;
|
headers[HeaderNames.CONTENT_TYPE] =
|
URL_FORM_CONTENT_TYPE;
|
const networkRequestOptions = { headers };
|
if (Object.keys(networkRequest.bodyParameters).length) {
|
networkRequestOptions.body =
|
networkRequest.computeParametersBodyString();
|
}
|
/**
|
* Initializes the network client helper based on the retry policy configuration.
|
* If internal retries are disabled, it uses the provided network client directly.
|
* Otherwise, it wraps the network client with an HTTP client that supports retries.
|
*/
|
const networkClientHelper = this.disableInternalRetries
|
? this.networkClient
|
: new HttpClientWithRetries(this.networkClient, networkRequest.retryPolicy, this.logger);
|
const reqTimestamp = nowSeconds();
|
let response;
|
try {
|
// Sources that send POST requests: Cloud Shell
|
if (networkRequest.httpMethod === HttpMethod.POST) {
|
response =
|
await networkClientHelper.sendPostRequestAsync(networkRequest.computeUri(), networkRequestOptions);
|
// Sources that send GET requests: App Service, Azure Arc, IMDS, Service Fabric
|
}
|
else {
|
response =
|
await networkClientHelper.sendGetRequestAsync(networkRequest.computeUri(), networkRequestOptions);
|
}
|
}
|
catch (error) {
|
if (error instanceof AuthError) {
|
throw error;
|
}
|
else {
|
throw createClientAuthError(networkError);
|
}
|
}
|
const responseHandler = new ResponseHandler(managedIdentityId.id, this.nodeStorage, this.cryptoProvider, this.logger, new StubPerformanceClient(), null, null);
|
const serverTokenResponse = await this.getServerTokenResponseAsync(response, networkClientHelper, networkRequest, networkRequestOptions);
|
responseHandler.validateTokenResponse(serverTokenResponse, serverTokenResponse.correlation_id || "", refreshAccessToken);
|
// caches the token
|
return responseHandler.handleServerTokenResponse(serverTokenResponse, fakeAuthority, reqTimestamp, managedIdentityRequest, ApiId.acquireTokenWithManagedIdentity);
|
}
|
/**
|
* Determines the appropriate query parameter name for user-assigned managed identity
|
* based on the identity type, API version, and endpoint characteristics.
|
* Different Azure services and API versions use different parameter names for the same identity types.
|
*
|
* @param managedIdentityIdType - The type of user-assigned managed identity (client ID, object ID, or resource ID)
|
* @param isImds - Whether the request is being made to the IMDS (Instance Metadata Service) endpoint
|
* @param usesApi2017 - Whether the endpoint uses the 2017-09-01 API version (affects client ID parameter name)
|
*
|
* @returns The correct query parameter name for the specified identity type and endpoint
|
*
|
* @throws {ManagedIdentityError} When an invalid managed identity ID type is provided
|
*/
|
getManagedIdentityUserAssignedIdQueryParameterKey(managedIdentityIdType, isImds, usesApi2017) {
|
switch (managedIdentityIdType) {
|
case ManagedIdentityIdType.USER_ASSIGNED_CLIENT_ID:
|
this.logger.info(`[Managed Identity] [API version ${usesApi2017 ? "2017+" : "2019+"}] Adding user assigned client id to the request.`, "");
|
// The Machine Learning source uses the 2017-09-01 API version, which uses "clientid" instead of "client_id"
|
return usesApi2017
|
? ManagedIdentityUserAssignedIdQueryParameterNames.MANAGED_IDENTITY_CLIENT_ID_2017
|
: ManagedIdentityUserAssignedIdQueryParameterNames.MANAGED_IDENTITY_CLIENT_ID;
|
case ManagedIdentityIdType.USER_ASSIGNED_RESOURCE_ID:
|
this.logger.info("[Managed Identity] Adding user assigned resource id to the request.", "");
|
return isImds
|
? ManagedIdentityUserAssignedIdQueryParameterNames.MANAGED_IDENTITY_RESOURCE_ID_IMDS
|
: ManagedIdentityUserAssignedIdQueryParameterNames.MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS;
|
case ManagedIdentityIdType.USER_ASSIGNED_OBJECT_ID:
|
this.logger.info("[Managed Identity] Adding user assigned object id to the request.", "");
|
return ManagedIdentityUserAssignedIdQueryParameterNames.MANAGED_IDENTITY_OBJECT_ID;
|
default:
|
throw createManagedIdentityError(invalidManagedIdentityIdType);
|
}
|
}
|
}
|
/**
|
* Validates and normalizes an environment variable containing a URL string.
|
* This static utility method ensures that environment variables used for managed identity
|
* endpoints contain properly formatted URLs and provides informative error messages when validation fails.
|
*
|
* @param envVariableStringName - The name of the environment variable being validated (for error reporting)
|
* @param envVariable - The environment variable value containing the URL string
|
* @param sourceName - The name of the managed identity source (for error reporting)
|
* @param logger - Logger instance for diagnostic information
|
*
|
* @returns The validated and normalized URL string
|
*
|
* @throws {ManagedIdentityError} When the environment variable contains a malformed URL
|
*/
|
BaseManagedIdentitySource.getValidatedEnvVariableUrlString = (envVariableStringName, envVariable, sourceName, logger) => {
|
try {
|
return new UrlString(envVariable).urlString;
|
}
|
catch (error) {
|
logger.info(`[Managed Identity] ${sourceName} managed identity is unavailable because the '${envVariableStringName}' environment variable is malformed.`, "");
|
throw createManagedIdentityError(MsiEnvironmentVariableUrlMalformedErrorCodes[envVariableStringName]);
|
}
|
};
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class LinearRetryStrategy {
|
/**
|
* Calculates the number of milliseconds to sleep based on the `retry-after` HTTP header.
|
*
|
* @param retryHeader - The value of the `retry-after` HTTP header. This can be either a number of seconds
|
* or an HTTP date string.
|
* @returns The number of milliseconds to sleep before retrying the request. If the `retry-after` header is not
|
* present or cannot be parsed, returns 0.
|
*/
|
calculateDelay(retryHeader, minimumDelay) {
|
if (!retryHeader) {
|
return minimumDelay;
|
}
|
// retry-after header is in seconds
|
let millisToSleep = Math.round(parseFloat(retryHeader) * 1000);
|
/*
|
* retry-after header is in HTTP Date format
|
* <day-name>, <day> <month> <year> <hour>:<minute>:<second> GMT
|
*/
|
if (isNaN(millisToSleep)) {
|
// .valueOf() is needed to subtract dates in TypeScript
|
millisToSleep =
|
new Date(retryHeader).valueOf() - new Date().valueOf();
|
}
|
return Math.max(minimumDelay, millisToSleep);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const DEFAULT_MANAGED_IDENTITY_MAX_RETRIES = 3; // referenced in unit test
|
const DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS = 1000;
|
const DEFAULT_MANAGED_IDENTITY_HTTP_STATUS_CODES_TO_RETRY_ON = [
|
HTTP_NOT_FOUND,
|
HTTP_REQUEST_TIMEOUT,
|
HTTP_TOO_MANY_REQUESTS,
|
HTTP_SERVER_ERROR,
|
HTTP_SERVICE_UNAVAILABLE,
|
HTTP_GATEWAY_TIMEOUT,
|
];
|
class DefaultManagedIdentityRetryPolicy {
|
constructor() {
|
this.linearRetryStrategy = new LinearRetryStrategy();
|
}
|
/*
|
* this is defined here as a static variable despite being defined as a constant outside of the
|
* class because it needs to be overridden in the unit tests so that the unit tests run faster
|
*/
|
static get DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS() {
|
return DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS;
|
}
|
async pauseForRetry(httpStatusCode, currentRetry, logger, retryAfterHeader) {
|
if (DEFAULT_MANAGED_IDENTITY_HTTP_STATUS_CODES_TO_RETRY_ON.includes(httpStatusCode) &&
|
currentRetry < DEFAULT_MANAGED_IDENTITY_MAX_RETRIES) {
|
const retryAfterDelay = this.linearRetryStrategy.calculateDelay(retryAfterHeader, DefaultManagedIdentityRetryPolicy.DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS);
|
logger.verbose(`Retrying request in ${retryAfterDelay}ms (retry attempt: ${currentRetry + 1})`, "");
|
// pause execution for the calculated delay
|
await new Promise((resolve) => {
|
// retryAfterHeader value of 0 evaluates to false, and DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS will be used
|
return setTimeout(resolve, retryAfterDelay);
|
});
|
return true;
|
}
|
// if the status code is not retriable or max retries have been reached, do not retry
|
return false;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class ManagedIdentityRequestParameters {
|
constructor(httpMethod, endpoint, retryPolicy) {
|
this.httpMethod = httpMethod;
|
this._baseEndpoint = endpoint;
|
this.headers = {};
|
this.bodyParameters = {};
|
this.queryParameters = {};
|
this.retryPolicy =
|
retryPolicy || new DefaultManagedIdentityRetryPolicy();
|
}
|
computeUri() {
|
const parameters = new Map();
|
if (this.queryParameters) {
|
addExtraParameters(parameters, this.queryParameters);
|
}
|
const queryParametersString = mapToQueryString(parameters);
|
return UrlString.appendQueryString(this._baseEndpoint, queryParametersString);
|
}
|
computeParametersBodyString() {
|
const parameters = new Map();
|
if (this.bodyParameters) {
|
addExtraParameters(parameters, this.bodyParameters);
|
}
|
return mapToQueryString(parameters);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
// MSI Constants. Docs for MSI are available here https://docs.microsoft.com/azure/app-service/overview-managed-identity
|
const APP_SERVICE_MSI_API_VERSION = "2019-08-01";
|
/**
|
* Azure App Service Managed Identity Source implementation.
|
*
|
* This class provides managed identity authentication for applications running in Azure App Service.
|
* It uses the local metadata service endpoint available within App Service environments to obtain
|
* access tokens without requiring explicit credentials.
|
*
|
* Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/AppServiceManagedIdentitySource.cs
|
*/
|
class AppService extends BaseManagedIdentitySource {
|
/**
|
* Creates a new instance of the AppService managed identity source.
|
*
|
* @param logger - Logger instance for diagnostic output
|
* @param nodeStorage - Node.js storage implementation for caching
|
* @param networkClient - Network client for making HTTP requests
|
* @param cryptoProvider - Cryptographic operations provider
|
* @param disableInternalRetries - Whether to disable internal retry logic
|
* @param identityEndpoint - The App Service identity endpoint URL
|
* @param identityHeader - The secret header value required for authentication
|
*/
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint, identityHeader) {
|
super(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
|
this.identityEndpoint = identityEndpoint;
|
this.identityHeader = identityHeader;
|
}
|
/**
|
* Retrieves the required environment variables for App Service managed identity.
|
*
|
* App Service managed identity requires two environment variables:
|
* - IDENTITY_ENDPOINT: The URL of the local metadata service
|
* - IDENTITY_HEADER: A secret header value for authentication
|
*
|
* @returns An array containing [identityEndpoint, identityHeader] values from environment variables.
|
* Either value may be undefined if the environment variable is not set.
|
*/
|
static getEnvironmentVariables() {
|
const identityEndpoint = process.env[ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT];
|
const identityHeader = process.env[ManagedIdentityEnvironmentVariableNames.IDENTITY_HEADER];
|
return [identityEndpoint, identityHeader];
|
}
|
/**
|
* Attempts to create an AppService managed identity source if the environment supports it.
|
*
|
* This method checks for the presence of required environment variables and validates
|
* the identity endpoint URL. If the environment is not suitable for App Service managed
|
* identity (missing environment variables or invalid endpoint), it returns null.
|
*
|
* @param logger - Logger instance for diagnostic output
|
* @param nodeStorage - Node.js storage implementation for caching
|
* @param networkClient - Network client for making HTTP requests
|
* @param cryptoProvider - Cryptographic operations provider
|
* @param disableInternalRetries - Whether to disable internal retry logic
|
*
|
* @returns A new AppService instance if the environment is suitable, null otherwise
|
*/
|
static tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries) {
|
const [identityEndpoint, identityHeader] = AppService.getEnvironmentVariables();
|
// if either of the identity endpoint or identity header variables are undefined, this MSI provider is unavailable.
|
if (!identityEndpoint || !identityHeader) {
|
logger.info(`[Managed Identity] ${ManagedIdentitySourceNames.APP_SERVICE} managed identity is unavailable because one or both of the '${ManagedIdentityEnvironmentVariableNames.IDENTITY_HEADER}' and '${ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT}' environment variables are not defined.`, "");
|
return null;
|
}
|
const validatedIdentityEndpoint = AppService.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT, identityEndpoint, ManagedIdentitySourceNames.APP_SERVICE, logger);
|
logger.info(`[Managed Identity] Environment variables validation passed for ${ManagedIdentitySourceNames.APP_SERVICE} managed identity. Endpoint URI: ${validatedIdentityEndpoint}. Creating ${ManagedIdentitySourceNames.APP_SERVICE} managed identity.`, "");
|
return new AppService(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint, identityHeader);
|
}
|
/**
|
* Creates a managed identity token request for the App Service environment.
|
*
|
* This method constructs an HTTP GET request to the App Service identity endpoint
|
* with the required headers, query parameters, and managed identity configuration.
|
* The request includes the secret header for authentication and appropriate API version.
|
*
|
* @param resource - The target resource/scope for which to request an access token (e.g., "https://graph.microsoft.com/.default")
|
* @param managedIdentityId - The managed identity configuration specifying whether to use system-assigned or user-assigned identity
|
*
|
* @returns A configured ManagedIdentityRequestParameters object ready for network execution
|
*/
|
createRequest(resource, managedIdentityId) {
|
const request = new ManagedIdentityRequestParameters(HttpMethod.GET, this.identityEndpoint);
|
request.headers[ManagedIdentityHeaders.APP_SERVICE_SECRET_HEADER_NAME] =
|
this.identityHeader;
|
request.queryParameters[ManagedIdentityQueryParameters.API_VERSION] =
|
APP_SERVICE_MSI_API_VERSION;
|
request.queryParameters[ManagedIdentityQueryParameters.RESOURCE] =
|
resource;
|
if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
|
request.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(managedIdentityId.idType)] = managedIdentityId.id;
|
}
|
// bodyParameters calculated in BaseManagedIdentity.acquireTokenWithManagedIdentity
|
return request;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const ARC_API_VERSION = "2019-11-01";
|
const DEFAULT_AZURE_ARC_IDENTITY_ENDPOINT = "http://127.0.0.1:40342/metadata/identity/oauth2/token";
|
const HIMDS_EXECUTABLE_HELPER_STRING = "N/A: himds executable exists";
|
const SUPPORTED_AZURE_ARC_PLATFORMS = {
|
win32: `${process.env["ProgramData"]}\\AzureConnectedMachineAgent\\Tokens\\`,
|
linux: "/var/opt/azcmagent/tokens/",
|
};
|
const AZURE_ARC_FILE_DETECTION = {
|
win32: `${process.env["ProgramFiles"]}\\AzureConnectedMachineAgent\\himds.exe`,
|
linux: "/opt/azcmagent/bin/himds",
|
};
|
/**
|
* Azure Arc managed identity source implementation for acquiring tokens from Azure Arc-enabled servers.
|
*
|
* This class provides managed identity authentication for applications running on Azure Arc-enabled servers
|
* by communicating with the local Hybrid Instance Metadata Service (HIMDS). It supports both environment
|
* variable-based configuration and automatic detection through the HIMDS executable.
|
*
|
* Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/AzureArcManagedIdentitySource.cs
|
*/
|
class AzureArc extends BaseManagedIdentitySource {
|
/**
|
* Creates a new instance of the AzureArc managed identity source.
|
*
|
* @param logger - Logger instance for capturing telemetry and diagnostic information
|
* @param nodeStorage - Storage implementation for caching tokens and metadata
|
* @param networkClient - Network client for making HTTP requests to the identity endpoint
|
* @param cryptoProvider - Cryptographic operations provider for token validation and encryption
|
* @param disableInternalRetries - Flag to disable automatic retry logic for failed requests
|
* @param identityEndpoint - The Azure Arc identity endpoint URL for token requests
|
*/
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint) {
|
super(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
|
this.identityEndpoint = identityEndpoint;
|
}
|
/**
|
* Retrieves and validates Azure Arc environment variables for managed identity configuration.
|
*
|
* This method checks for IDENTITY_ENDPOINT and IMDS_ENDPOINT environment variables.
|
* If either is missing, it attempts to detect the Azure Arc environment by checking for
|
* the HIMDS executable at platform-specific paths. On successful detection, it returns
|
* the default identity endpoint and a helper string indicating file-based detection.
|
*
|
* @returns An array containing [identityEndpoint, imdsEndpoint] where both values are
|
* strings if Azure Arc is available, or undefined if not available.
|
*/
|
static getEnvironmentVariables() {
|
let identityEndpoint = process.env[ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT];
|
let imdsEndpoint = process.env[ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT];
|
// if either of the identity or imds endpoints are undefined, check if the himds executable exists
|
if (!identityEndpoint || !imdsEndpoint) {
|
// get the expected Windows or Linux file path of the himds executable
|
const fileDetectionPath = AZURE_ARC_FILE_DETECTION[process.platform];
|
try {
|
/*
|
* check if the himds executable exists and its permissions allow it to be read
|
* returns undefined if true, throws an error otherwise
|
*/
|
fs.accessSync(fileDetectionPath, fs.constants.F_OK | fs.constants.R_OK);
|
identityEndpoint = DEFAULT_AZURE_ARC_IDENTITY_ENDPOINT;
|
imdsEndpoint = HIMDS_EXECUTABLE_HELPER_STRING;
|
}
|
catch (err) {
|
/*
|
* do nothing
|
* accessSync returns undefined on success, and throws an error on failure
|
*/
|
}
|
}
|
return [identityEndpoint, imdsEndpoint];
|
}
|
/**
|
* Attempts to create an AzureArc managed identity source instance.
|
*
|
* Validates the Azure Arc environment by checking environment variables
|
* and performing file-based detection. It ensures that only system-assigned managed identities
|
* are supported for Azure Arc scenarios. The method performs comprehensive validation of
|
* endpoint URLs and logs detailed information about the detection process.
|
*
|
* @param logger - Logger instance for capturing creation and validation steps
|
* @param nodeStorage - Storage implementation for the managed identity source
|
* @param networkClient - Network client for HTTP communication
|
* @param cryptoProvider - Cryptographic operations provider
|
* @param disableInternalRetries - Whether to disable automatic retry mechanisms
|
* @param managedIdentityId - The managed identity configuration, must be system-assigned
|
*
|
* @returns AzureArc instance if the environment supports Azure Arc managed identity, null otherwise
|
*
|
* @throws {ManagedIdentityError} When a user-assigned managed identity is specified (not supported for Azure Arc)
|
*/
|
static tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) {
|
const [identityEndpoint, imdsEndpoint] = AzureArc.getEnvironmentVariables();
|
// if either of the identity or imds endpoints are undefined (even after himds file detection)
|
if (!identityEndpoint || !imdsEndpoint) {
|
logger.info(`[Managed Identity] ${ManagedIdentitySourceNames.AZURE_ARC} managed identity is unavailable through environment variables because one or both of '${ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT}' and '${ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT}' are not defined. ${ManagedIdentitySourceNames.AZURE_ARC} managed identity is also unavailable through file detection.`, "");
|
return null;
|
}
|
// check if the imds endpoint is set to the default for file detection
|
if (imdsEndpoint === HIMDS_EXECUTABLE_HELPER_STRING) {
|
logger.info(`[Managed Identity] ${ManagedIdentitySourceNames.AZURE_ARC} managed identity is available through file detection. Defaulting to known ${ManagedIdentitySourceNames.AZURE_ARC} endpoint: ${DEFAULT_AZURE_ARC_IDENTITY_ENDPOINT}. Creating ${ManagedIdentitySourceNames.AZURE_ARC} managed identity.`, "");
|
}
|
else {
|
// otherwise, both the identity and imds endpoints are defined without file detection; validate them
|
const validatedIdentityEndpoint = AzureArc.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT, identityEndpoint, ManagedIdentitySourceNames.AZURE_ARC, logger);
|
// remove trailing slash
|
validatedIdentityEndpoint.endsWith("/")
|
? validatedIdentityEndpoint.slice(0, -1)
|
: validatedIdentityEndpoint;
|
AzureArc.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT, imdsEndpoint, ManagedIdentitySourceNames.AZURE_ARC, logger);
|
logger.info(`[Managed Identity] Environment variables validation passed for ${ManagedIdentitySourceNames.AZURE_ARC} managed identity. Endpoint URI: ${validatedIdentityEndpoint}. Creating ${ManagedIdentitySourceNames.AZURE_ARC} managed identity.`, "");
|
}
|
if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
|
throw createManagedIdentityError(unableToCreateAzureArc);
|
}
|
return new AzureArc(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint);
|
}
|
/**
|
* Creates a properly formatted HTTP request for acquiring tokens from the Azure Arc identity endpoint.
|
*
|
* This method constructs a GET request to the Azure Arc HIMDS endpoint with the required metadata header
|
* and query parameters. The endpoint URL is normalized to use 127.0.0.1 instead of localhost for
|
* consistency. Additional body parameters are calculated by the base class during token acquisition.
|
*
|
* @param resource - The target resource/scope for which to request an access token (e.g., "https://graph.microsoft.com/.default")
|
*
|
* @returns A configured ManagedIdentityRequestParameters object ready for network execution
|
*/
|
createRequest(resource) {
|
const request = new ManagedIdentityRequestParameters(HttpMethod.GET, this.identityEndpoint.replace("localhost", "127.0.0.1"));
|
request.headers[ManagedIdentityHeaders.METADATA_HEADER_NAME] = "true";
|
request.queryParameters[ManagedIdentityQueryParameters.API_VERSION] =
|
ARC_API_VERSION;
|
request.queryParameters[ManagedIdentityQueryParameters.RESOURCE] =
|
resource;
|
// bodyParameters calculated in BaseManagedIdentity.acquireTokenWithManagedIdentity
|
return request;
|
}
|
/**
|
* Processes the server response and handles Azure Arc-specific authentication challenges.
|
*
|
* This method implements the Azure Arc authentication flow which may require reading a secret file
|
* for authorization. When the initial request returns HTTP 401 Unauthorized, it extracts the file
|
* path from the WWW-Authenticate header, validates the file location and size, reads the secret,
|
* and retries the request with Basic authentication. The method includes comprehensive security
|
* validations to prevent path traversal and ensure file integrity.
|
*
|
* @param originalResponse - The initial HTTP response from the identity endpoint
|
* @param networkClient - Network client for making the retry request if needed
|
* @param networkRequest - The original request parameters (modified with auth header for retry)
|
* @param networkRequestOptions - Additional options for network requests
|
*
|
* @returns A promise that resolves to the server token response with access token and metadata
|
*
|
* @throws {ManagedIdentityError} When:
|
* - WWW-Authenticate header is missing or has unsupported format
|
* - Platform is not supported (not Windows or Linux)
|
* - Secret file has invalid extension (not .key)
|
* - Secret file path doesn't match expected platform path
|
* - Secret file cannot be read or is too large (>4096 bytes)
|
* @throws {ClientAuthError} When network errors occur during retry request
|
*/
|
async getServerTokenResponseAsync(originalResponse, networkClient, networkRequest, networkRequestOptions) {
|
let retryResponse;
|
if (originalResponse.status === HTTP_UNAUTHORIZED) {
|
const wwwAuthHeader = originalResponse.headers["www-authenticate"];
|
if (!wwwAuthHeader) {
|
throw createManagedIdentityError(wwwAuthenticateHeaderMissing);
|
}
|
if (!wwwAuthHeader.includes("Basic realm=")) {
|
throw createManagedIdentityError(wwwAuthenticateHeaderUnsupportedFormat);
|
}
|
const secretFilePath = wwwAuthHeader.split("Basic realm=")[1];
|
// throw an error if the managed identity application is not being run on Windows or Linux
|
if (!SUPPORTED_AZURE_ARC_PLATFORMS.hasOwnProperty(process.platform)) {
|
throw createManagedIdentityError(platformNotSupported);
|
}
|
// get the expected Windows or Linux file path
|
const expectedSecretFilePath = SUPPORTED_AZURE_ARC_PLATFORMS[process.platform];
|
// throw an error if the file in the file path is not a .key file
|
const fileName = path.basename(secretFilePath);
|
if (!fileName.endsWith(".key")) {
|
throw createManagedIdentityError(invalidFileExtension);
|
}
|
/*
|
* throw an error if the file path from the www-authenticate header does not match the
|
* expected file path for the platform (Windows or Linux) the managed identity application
|
* is running on
|
*/
|
if (expectedSecretFilePath + fileName !== secretFilePath) {
|
throw createManagedIdentityError(invalidFilePath);
|
}
|
let secretFileSize;
|
// attempt to get the secret file's size, in bytes
|
try {
|
secretFileSize = await fs.statSync(secretFilePath).size;
|
}
|
catch (e) {
|
throw createManagedIdentityError(unableToReadSecretFile);
|
}
|
// throw an error if the secret file's size is greater than 4096 bytes
|
if (secretFileSize > AZURE_ARC_SECRET_FILE_MAX_SIZE_BYTES) {
|
throw createManagedIdentityError(invalidSecret);
|
}
|
// attempt to read the contents of the secret file
|
let secret;
|
try {
|
secret = fs.readFileSync(secretFilePath, EncodingTypes.UTF8);
|
}
|
catch (e) {
|
throw createManagedIdentityError(unableToReadSecretFile);
|
}
|
const authHeaderValue = `Basic ${secret}`;
|
this.logger.info(`[Managed Identity] Adding authorization header to the request.`, "");
|
networkRequest.headers[ManagedIdentityHeaders.AUTHORIZATION_HEADER_NAME] = authHeaderValue;
|
try {
|
retryResponse =
|
await networkClient.sendGetRequestAsync(networkRequest.computeUri(), networkRequestOptions);
|
}
|
catch (error) {
|
if (error instanceof AuthError) {
|
throw error;
|
}
|
else {
|
throw createClientAuthError(networkError);
|
}
|
}
|
}
|
return this.getServerTokenResponse(retryResponse || originalResponse);
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Azure Cloud Shell managed identity source implementation.
|
*
|
* This class handles authentication for applications running in Azure Cloud Shell environment.
|
* Cloud Shell provides a browser-accessible shell for managing Azure resources and includes
|
* a pre-configured managed identity for authentication.
|
*
|
* Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/CloudShellManagedIdentitySource.cs
|
*/
|
class CloudShell extends BaseManagedIdentitySource {
|
/**
|
* Creates a new CloudShell managed identity source instance.
|
*
|
* @param logger - Logger instance for diagnostic logging
|
* @param nodeStorage - Node.js storage implementation for caching
|
* @param networkClient - HTTP client for making requests to the managed identity endpoint
|
* @param cryptoProvider - Cryptographic operations provider
|
* @param disableInternalRetries - Whether to disable automatic retry logic for failed requests
|
* @param msiEndpoint - The MSI endpoint URL obtained from environment variables
|
*/
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, msiEndpoint) {
|
super(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
|
this.msiEndpoint = msiEndpoint;
|
}
|
/**
|
* Retrieves the required environment variables for Cloud Shell managed identity.
|
*
|
* Cloud Shell requires the MSI_ENDPOINT environment variable to be set, which
|
* contains the URL of the managed identity service endpoint.
|
*
|
* @returns An array containing the MSI_ENDPOINT environment variable value (or undefined if not set)
|
*/
|
static getEnvironmentVariables() {
|
const msiEndpoint = process.env[ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT];
|
return [msiEndpoint];
|
}
|
/**
|
* Attempts to create a CloudShell managed identity source instance.
|
*
|
* This method validates that the required environment variables are present and
|
* creates a CloudShell instance if the environment is properly configured.
|
* Cloud Shell only supports system-assigned managed identities.
|
*
|
* @param logger - Logger instance for diagnostic logging
|
* @param nodeStorage - Node.js storage implementation for caching
|
* @param networkClient - HTTP client for making requests
|
* @param cryptoProvider - Cryptographic operations provider
|
* @param disableInternalRetries - Whether to disable automatic retry logic
|
* @param managedIdentityId - The managed identity configuration (must be system-assigned)
|
*
|
* @returns A CloudShell instance if the environment is valid, null otherwise
|
*
|
* @throws {ManagedIdentityError} When a user-assigned managed identity is requested,
|
* as Cloud Shell only supports system-assigned identities
|
*/
|
static tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) {
|
const [msiEndpoint] = CloudShell.getEnvironmentVariables();
|
// if the msi endpoint environment variable is undefined, this MSI provider is unavailable.
|
if (!msiEndpoint) {
|
logger.info(`[Managed Identity] ${ManagedIdentitySourceNames.CLOUD_SHELL} managed identity is unavailable because the '${ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT} environment variable is not defined.`, "");
|
return null;
|
}
|
const validatedMsiEndpoint = CloudShell.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT, msiEndpoint, ManagedIdentitySourceNames.CLOUD_SHELL, logger);
|
logger.info(`[Managed Identity] Environment variable validation passed for ${ManagedIdentitySourceNames.CLOUD_SHELL} managed identity. Endpoint URI: ${validatedMsiEndpoint}. Creating ${ManagedIdentitySourceNames.CLOUD_SHELL} managed identity.`, "");
|
if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
|
throw createManagedIdentityError(unableToCreateCloudShell);
|
}
|
return new CloudShell(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, msiEndpoint);
|
}
|
/**
|
* Creates an HTTP request to acquire an access token from the Cloud Shell managed identity endpoint.
|
*
|
* This method constructs a POST request to the MSI endpoint with the required headers and
|
* body parameters for Cloud Shell authentication. The request includes the target resource
|
* for which the access token is being requested.
|
*
|
* @param resource - The target resource/scope for which to request an access token (e.g., "https://graph.microsoft.com/.default")
|
*
|
* @returns A configured ManagedIdentityRequestParameters object ready for network execution
|
*/
|
createRequest(resource) {
|
const request = new ManagedIdentityRequestParameters(HttpMethod.POST, this.msiEndpoint);
|
request.headers[ManagedIdentityHeaders.METADATA_HEADER_NAME] = "true";
|
request.bodyParameters[ManagedIdentityQueryParameters.RESOURCE] =
|
resource;
|
return request;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
class ExponentialRetryStrategy {
|
constructor(minExponentialBackoff, maxExponentialBackoff, exponentialDeltaBackoff) {
|
this.minExponentialBackoff = minExponentialBackoff;
|
this.maxExponentialBackoff = maxExponentialBackoff;
|
this.exponentialDeltaBackoff = exponentialDeltaBackoff;
|
}
|
/**
|
* Calculates the exponential delay based on the current retry attempt.
|
*
|
* @param {number} currentRetry - The current retry attempt number.
|
* @returns {number} - The calculated exponential delay in milliseconds.
|
*
|
* The delay is calculated using the formula:
|
* - If `currentRetry` is 0, it returns the minimum backoff time.
|
* - Otherwise, it calculates the delay as the minimum of:
|
* - `(2^(currentRetry - 1)) * deltaBackoff`
|
* - `maxBackoff`
|
*
|
* This ensures that the delay increases exponentially with each retry attempt,
|
* but does not exceed the maximum backoff time.
|
*/
|
calculateDelay(currentRetry) {
|
// Attempt 1
|
if (currentRetry === 0) {
|
return this.minExponentialBackoff;
|
}
|
// Attempt 2+
|
const exponentialDelay = Math.min(Math.pow(2, currentRetry - 1) * this.exponentialDeltaBackoff, this.maxExponentialBackoff);
|
return exponentialDelay;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const HTTP_STATUS_400_CODES_FOR_EXPONENTIAL_STRATEGY = [
|
HTTP_NOT_FOUND,
|
HTTP_REQUEST_TIMEOUT,
|
HTTP_GONE,
|
HTTP_TOO_MANY_REQUESTS,
|
];
|
const EXPONENTIAL_STRATEGY_NUM_RETRIES = 3;
|
const LINEAR_STRATEGY_NUM_RETRIES = 7;
|
const MIN_EXPONENTIAL_BACKOFF_MS = 1000;
|
const MAX_EXPONENTIAL_BACKOFF_MS = 4000;
|
const EXPONENTIAL_DELTA_BACKOFF_MS = 2000;
|
const HTTP_STATUS_GONE_RETRY_AFTER_MS = 10 * 1000; // 10 seconds
|
class ImdsRetryPolicy {
|
constructor() {
|
this.exponentialRetryStrategy = new ExponentialRetryStrategy(ImdsRetryPolicy.MIN_EXPONENTIAL_BACKOFF_MS, ImdsRetryPolicy.MAX_EXPONENTIAL_BACKOFF_MS, ImdsRetryPolicy.EXPONENTIAL_DELTA_BACKOFF_MS);
|
}
|
/*
|
* these are defined here as static variables despite being defined as constants outside of the
|
* class because they need to be overridden in the unit tests so that the unit tests run faster
|
*/
|
static get MIN_EXPONENTIAL_BACKOFF_MS() {
|
return MIN_EXPONENTIAL_BACKOFF_MS;
|
}
|
static get MAX_EXPONENTIAL_BACKOFF_MS() {
|
return MAX_EXPONENTIAL_BACKOFF_MS;
|
}
|
static get EXPONENTIAL_DELTA_BACKOFF_MS() {
|
return EXPONENTIAL_DELTA_BACKOFF_MS;
|
}
|
static get HTTP_STATUS_GONE_RETRY_AFTER_MS() {
|
return HTTP_STATUS_GONE_RETRY_AFTER_MS;
|
}
|
set isNewRequest(value) {
|
this._isNewRequest = value;
|
}
|
/**
|
* Pauses execution for a calculated delay before retrying a request.
|
*
|
* @param httpStatusCode - The HTTP status code of the response.
|
* @param currentRetry - The current retry attempt number.
|
* @param retryAfterHeader - The value of the "retry-after" header from the response.
|
* @returns A promise that resolves to a boolean indicating whether a retry should be attempted.
|
*/
|
async pauseForRetry(httpStatusCode, currentRetry, logger) {
|
if (this._isNewRequest) {
|
this._isNewRequest = false;
|
// calculate the maxRetries based on the status code, once per request
|
this.maxRetries =
|
httpStatusCode === HTTP_GONE
|
? LINEAR_STRATEGY_NUM_RETRIES
|
: EXPONENTIAL_STRATEGY_NUM_RETRIES;
|
}
|
/**
|
* (status code is one of the retriable 400 status code
|
* or
|
* status code is >= 500 and <= 599)
|
* and
|
* current count of retries is less than the max number of retries
|
*/
|
if ((HTTP_STATUS_400_CODES_FOR_EXPONENTIAL_STRATEGY.includes(httpStatusCode) ||
|
(httpStatusCode >= HTTP_SERVER_ERROR_RANGE_START &&
|
httpStatusCode <= HTTP_SERVER_ERROR_RANGE_END &&
|
currentRetry < this.maxRetries)) &&
|
currentRetry < this.maxRetries) {
|
const retryAfterDelay = httpStatusCode === HTTP_GONE
|
? ImdsRetryPolicy.HTTP_STATUS_GONE_RETRY_AFTER_MS
|
: this.exponentialRetryStrategy.calculateDelay(currentRetry);
|
logger.verbose(`Retrying request in ${retryAfterDelay}ms (retry attempt: ${currentRetry + 1})`, "");
|
// pause execution for the calculated delay
|
await new Promise((resolve) => {
|
return setTimeout(resolve, retryAfterDelay);
|
});
|
return true;
|
}
|
// if the status code is not retriable or max retries have been reached, do not retry
|
return false;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
// Documentation for IMDS is available at https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http
|
const IMDS_TOKEN_PATH = "/metadata/identity/oauth2/token";
|
const DEFAULT_IMDS_ENDPOINT = `http://169.254.169.254${IMDS_TOKEN_PATH}`;
|
const IMDS_API_VERSION = "2018-02-01";
|
/**
|
* Managed Identity source implementation for Azure Instance Metadata Service (IMDS).
|
*
|
* IMDS is available on Azure Virtual Machines and Virtual Machine Scale Sets and provides
|
* a REST endpoint to obtain OAuth tokens for managed identities. This implementation
|
* handles both system-assigned and user-assigned managed identities.
|
*
|
* Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/ImdsManagedIdentitySource.cs
|
*/
|
class Imds extends BaseManagedIdentitySource {
|
/**
|
* Constructs an Imds instance with the specified configuration.
|
*
|
* @param logger - Logger instance for recording debug information and errors
|
* @param nodeStorage - NodeStorage instance used for token caching operations
|
* @param networkClient - Network client implementation for making HTTP requests to IMDS
|
* @param cryptoProvider - CryptoProvider for generating correlation IDs and other cryptographic operations
|
* @param disableInternalRetries - When true, disables the built-in retry logic for IMDS requests
|
* @param identityEndpoint - The complete IMDS endpoint URL including the token path
|
*/
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint) {
|
super(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
|
this.identityEndpoint = identityEndpoint;
|
}
|
/**
|
* Creates an Imds instance with the appropriate endpoint configuration.
|
*
|
* This method checks for the presence of the AZURE_POD_IDENTITY_AUTHORITY_HOST environment
|
* variable, which is used in Azure Kubernetes Service (AKS) environments with Azure AD
|
* Pod Identity. If found, it uses that endpoint; otherwise, it falls back to the standard
|
* IMDS endpoint (169.254.169.254).
|
*
|
* @param logger - Logger instance for recording endpoint discovery and validation
|
* @param nodeStorage - NodeStorage instance for token caching
|
* @param networkClient - Network client for HTTP requests
|
* @param cryptoProvider - CryptoProvider for cryptographic operations
|
* @param disableInternalRetries - Whether to disable built-in retry logic
|
*
|
* @returns A configured Imds instance ready to make token requests
|
*/
|
static tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries) {
|
let validatedIdentityEndpoint;
|
if (process.env[ManagedIdentityEnvironmentVariableNames
|
.AZURE_POD_IDENTITY_AUTHORITY_HOST]) {
|
logger.info(`[Managed Identity] Environment variable ${ManagedIdentityEnvironmentVariableNames.AZURE_POD_IDENTITY_AUTHORITY_HOST} for ${ManagedIdentitySourceNames.IMDS} returned endpoint: ${process.env[ManagedIdentityEnvironmentVariableNames
|
.AZURE_POD_IDENTITY_AUTHORITY_HOST]}`, "");
|
validatedIdentityEndpoint = Imds.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.AZURE_POD_IDENTITY_AUTHORITY_HOST, `${process.env[ManagedIdentityEnvironmentVariableNames
|
.AZURE_POD_IDENTITY_AUTHORITY_HOST]}${IMDS_TOKEN_PATH}`, ManagedIdentitySourceNames.IMDS, logger);
|
}
|
else {
|
logger.info(`[Managed Identity] Unable to find ${ManagedIdentityEnvironmentVariableNames.AZURE_POD_IDENTITY_AUTHORITY_HOST} environment variable for ${ManagedIdentitySourceNames.IMDS}, using the default endpoint.`, "");
|
validatedIdentityEndpoint = DEFAULT_IMDS_ENDPOINT;
|
}
|
return new Imds(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, validatedIdentityEndpoint);
|
}
|
/**
|
* Creates a properly configured HTTP request for acquiring an access token from IMDS.
|
*
|
* This method builds a complete request object with all necessary headers, query parameters,
|
* and retry policies required by the Azure Instance Metadata Service.
|
*
|
* Key request components:
|
* - HTTP GET method to the IMDS token endpoint
|
* - Metadata header set to "true" (required by IMDS)
|
* - API version parameter (currently "2018-02-01")
|
* - Resource parameter specifying the target audience
|
* - Identity-specific parameters for user-assigned managed identities
|
* - IMDS-specific retry policy
|
*
|
* @param resource - The target resource/scope for which to request an access token (e.g., "https://graph.microsoft.com/.default")
|
* @param managedIdentityId - The managed identity configuration specifying whether to use system-assigned or user-assigned identity
|
*
|
* @returns A configured ManagedIdentityRequestParameters object ready for network execution
|
*/
|
createRequest(resource, managedIdentityId) {
|
const request = new ManagedIdentityRequestParameters(HttpMethod.GET, this.identityEndpoint);
|
request.headers[ManagedIdentityHeaders.METADATA_HEADER_NAME] = "true";
|
request.queryParameters[ManagedIdentityQueryParameters.API_VERSION] =
|
IMDS_API_VERSION;
|
request.queryParameters[ManagedIdentityQueryParameters.RESOURCE] =
|
resource;
|
if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
|
request.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(managedIdentityId.idType, true // indicates source is IMDS
|
)] = managedIdentityId.id;
|
}
|
// The bodyParameters are calculated in BaseManagedIdentity.acquireTokenWithManagedIdentity.
|
request.retryPolicy = new ImdsRetryPolicy();
|
return request;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const SERVICE_FABRIC_MSI_API_VERSION = "2019-07-01-preview";
|
/**
|
* Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/ServiceFabricManagedIdentitySource.cs
|
*/
|
class ServiceFabric extends BaseManagedIdentitySource {
|
/**
|
* Constructs a new ServiceFabric managed identity source for acquiring tokens from Azure Service Fabric clusters.
|
*
|
* Service Fabric managed identity allows applications running in Service Fabric clusters to authenticate
|
* without storing credentials in code. This source handles token acquisition using the Service Fabric
|
* Managed Identity Token Service (MITS).
|
*
|
* @param logger - Logger instance for logging authentication events and debugging information
|
* @param nodeStorage - NodeStorage instance for caching tokens and other authentication artifacts
|
* @param networkClient - Network client for making HTTP requests to the Service Fabric identity endpoint
|
* @param cryptoProvider - Crypto provider for cryptographic operations like token validation
|
* @param disableInternalRetries - Whether to disable internal retry logic for failed requests
|
* @param identityEndpoint - The Service Fabric managed identity endpoint URL
|
* @param identityHeader - The Service Fabric managed identity secret header value
|
*/
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint, identityHeader) {
|
super(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
|
this.identityEndpoint = identityEndpoint;
|
this.identityHeader = identityHeader;
|
}
|
/**
|
* Retrieves the environment variables required for Service Fabric managed identity authentication.
|
*
|
* Service Fabric managed identity requires three specific environment variables to be set by the
|
* Service Fabric runtime:
|
* - IDENTITY_ENDPOINT: The endpoint URL for the Managed Identity Token Service (MITS)
|
* - IDENTITY_HEADER: A secret value used for authentication with the MITS
|
* - IDENTITY_SERVER_THUMBPRINT: The thumbprint of the MITS server certificate for secure communication
|
*
|
* @returns An array containing the identity endpoint, identity header, and identity server thumbprint values.
|
* Elements will be undefined if the corresponding environment variables are not set.
|
*/
|
static getEnvironmentVariables() {
|
const identityEndpoint = process.env[ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT];
|
const identityHeader = process.env[ManagedIdentityEnvironmentVariableNames.IDENTITY_HEADER];
|
const identityServerThumbprint = process.env[ManagedIdentityEnvironmentVariableNames
|
.IDENTITY_SERVER_THUMBPRINT];
|
return [identityEndpoint, identityHeader, identityServerThumbprint];
|
}
|
/**
|
* Attempts to create a ServiceFabric managed identity source if the runtime environment supports it.
|
*
|
* Checks for the presence of all required Service Fabric environment variables
|
* and validates the endpoint URL format. It will only create a ServiceFabric instance if the application
|
* is running in a properly configured Service Fabric cluster with managed identity enabled.
|
*
|
* Note: User-assigned managed identities must be configured at the cluster level, not at runtime.
|
* This method will log a warning if a user-assigned identity is requested.
|
*
|
* @param logger - Logger instance for logging creation events and validation results
|
* @param nodeStorage - NodeStorage instance for caching tokens and authentication artifacts
|
* @param networkClient - Network client for making HTTP requests to the identity endpoint
|
* @param cryptoProvider - Crypto provider for cryptographic operations
|
* @param disableInternalRetries - Whether to disable internal retry logic for failed requests
|
* @param managedIdentityId - Managed identity identifier specifying system-assigned or user-assigned identity
|
*
|
* @returns A ServiceFabric instance if all environment variables are valid and present, otherwise null
|
*/
|
static tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) {
|
const [identityEndpoint, identityHeader, identityServerThumbprint] = ServiceFabric.getEnvironmentVariables();
|
if (!identityEndpoint || !identityHeader || !identityServerThumbprint) {
|
logger.info(`[Managed Identity] ${ManagedIdentitySourceNames.SERVICE_FABRIC} managed identity is unavailable because one or all of the '${ManagedIdentityEnvironmentVariableNames.IDENTITY_HEADER}', '${ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT}' or '${ManagedIdentityEnvironmentVariableNames.IDENTITY_SERVER_THUMBPRINT}' environment variables are not defined.`, "");
|
return null;
|
}
|
const validatedIdentityEndpoint = ServiceFabric.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT, identityEndpoint, ManagedIdentitySourceNames.SERVICE_FABRIC, logger);
|
logger.info(`[Managed Identity] Environment variables validation passed for ${ManagedIdentitySourceNames.SERVICE_FABRIC} managed identity. Endpoint URI: ${validatedIdentityEndpoint}. Creating ${ManagedIdentitySourceNames.SERVICE_FABRIC} managed identity.`, "");
|
if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
|
logger.warning(`[Managed Identity] ${ManagedIdentitySourceNames.SERVICE_FABRIC} user assigned managed identity is configured in the cluster, not during runtime. See also: https://learn.microsoft.com/en-us/azure/service-fabric/configure-existing-cluster-enable-managed-identity-token-service.`, "");
|
}
|
return new ServiceFabric(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, identityEndpoint, identityHeader);
|
}
|
/**
|
* Creates HTTP request parameters for acquiring an access token from the Service Fabric Managed Identity Token Service (MITS).
|
*
|
* This method constructs a properly formatted HTTP GET request that includes:
|
* - The secret header for authentication with MITS
|
* - API version parameter for the Service Fabric MSI endpoint
|
* - Resource parameter specifying the target Azure service
|
* - Optional identity parameters for user-assigned managed identities
|
*
|
* The request follows the Service Fabric managed identity protocol and uses the 2019-07-01-preview API version.
|
* For user-assigned identities, the appropriate query parameter (client_id, object_id, or resource_id) is added
|
* based on the identity type.
|
*
|
* @param resource - The Azure resource URI for which the access token is requested (e.g., "https://vault.azure.net/")
|
* @param managedIdentityId - The managed identity configuration specifying system-assigned or user-assigned identity details
|
*
|
* @returns A configured ManagedIdentityRequestParameters object ready for network execution
|
*/
|
createRequest(resource, managedIdentityId) {
|
const request = new ManagedIdentityRequestParameters(HttpMethod.GET, this.identityEndpoint);
|
request.headers[ManagedIdentityHeaders.ML_AND_SF_SECRET_HEADER_NAME] =
|
this.identityHeader;
|
request.queryParameters[ManagedIdentityQueryParameters.API_VERSION] =
|
SERVICE_FABRIC_MSI_API_VERSION;
|
request.queryParameters[ManagedIdentityQueryParameters.RESOURCE] =
|
resource;
|
if (managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED) {
|
request.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(managedIdentityId.idType)] = managedIdentityId.id;
|
}
|
// bodyParameters calculated in BaseManagedIdentity.acquireTokenWithManagedIdentity
|
return request;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const MACHINE_LEARNING_MSI_API_VERSION = "2017-09-01";
|
const MANAGED_IDENTITY_MACHINE_LEARNING_UNSUPPORTED_ID_TYPE_ERROR = `Only client id is supported for user-assigned managed identity in ${ManagedIdentitySourceNames.MACHINE_LEARNING}.`; // referenced in unit test
|
/**
|
* Machine Learning Managed Identity Source implementation for Azure Machine Learning environments.
|
*
|
* This class handles managed identity authentication specifically for Azure Machine Learning services.
|
* It supports both system-assigned and user-assigned managed identities, using the MSI_ENDPOINT
|
* and MSI_SECRET environment variables that are automatically provided in Azure ML environments.
|
*/
|
class MachineLearning extends BaseManagedIdentitySource {
|
/**
|
* Creates a new MachineLearning managed identity source instance.
|
*
|
* @param logger - Logger instance for diagnostic information
|
* @param nodeStorage - Node storage implementation for caching
|
* @param networkClient - Network client for making HTTP requests
|
* @param cryptoProvider - Cryptographic operations provider
|
* @param disableInternalRetries - Whether to disable automatic request retries
|
* @param msiEndpoint - The MSI endpoint URL from environment variables
|
* @param secret - The MSI secret from environment variables
|
*/
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, msiEndpoint, secret) {
|
super(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
|
this.msiEndpoint = msiEndpoint;
|
this.secret = secret;
|
}
|
/**
|
* Retrieves the required environment variables for Azure Machine Learning managed identity.
|
*
|
* This method checks for the presence of MSI_ENDPOINT and MSI_SECRET environment variables
|
* that are automatically set by the Azure Machine Learning platform when managed identity
|
* is enabled for the compute instance or cluster.
|
*
|
* @returns An array containing [msiEndpoint, secret] where either value may be undefined
|
* if the corresponding environment variable is not set
|
*/
|
static getEnvironmentVariables() {
|
const msiEndpoint = process.env[ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT];
|
const secret = process.env[ManagedIdentityEnvironmentVariableNames.MSI_SECRET];
|
return [msiEndpoint, secret];
|
}
|
/**
|
* Attempts to create a MachineLearning managed identity source.
|
*
|
* This method validates the Azure Machine Learning environment by checking for the required
|
* MSI_ENDPOINT and MSI_SECRET environment variables. If both are present and valid,
|
* it creates and returns a MachineLearning instance. If either is missing or invalid,
|
* it returns null, indicating that this managed identity source is not available
|
* in the current environment.
|
*
|
* @param logger - Logger instance for diagnostic information
|
* @param nodeStorage - Node storage implementation for caching
|
* @param networkClient - Network client for making HTTP requests
|
* @param cryptoProvider - Cryptographic operations provider
|
* @param disableInternalRetries - Whether to disable automatic request retries
|
*
|
* @returns A new MachineLearning instance if the environment is valid, null otherwise
|
*/
|
static tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries) {
|
const [msiEndpoint, secret] = MachineLearning.getEnvironmentVariables();
|
// if either of the MSI endpoint or MSI secret variables are undefined, this MSI provider is unavailable.
|
if (!msiEndpoint || !secret) {
|
logger.info(`[Managed Identity] ${ManagedIdentitySourceNames.MACHINE_LEARNING} managed identity is unavailable because one or both of the '${ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT}' and '${ManagedIdentityEnvironmentVariableNames.MSI_SECRET}' environment variables are not defined.`, "");
|
return null;
|
}
|
const validatedMsiEndpoint = MachineLearning.getValidatedEnvVariableUrlString(ManagedIdentityEnvironmentVariableNames.MSI_ENDPOINT, msiEndpoint, ManagedIdentitySourceNames.MACHINE_LEARNING, logger);
|
logger.info(`[Managed Identity] Environment variables validation passed for ${ManagedIdentitySourceNames.MACHINE_LEARNING} managed identity. Endpoint URI: ${validatedMsiEndpoint}. Creating ${ManagedIdentitySourceNames.MACHINE_LEARNING} managed identity.`, "");
|
return new MachineLearning(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, msiEndpoint, secret);
|
}
|
/**
|
* Creates a managed identity token request for Azure Machine Learning environments.
|
*
|
* This method constructs the HTTP request parameters needed to acquire an access token
|
* from the Azure Machine Learning managed identity endpoint. It handles both system-assigned
|
* and user-assigned managed identities with specific logic for each type:
|
*
|
* - System-assigned: Uses the DEFAULT_IDENTITY_CLIENT_ID environment variable
|
* - User-assigned: Only supports client ID-based identification (not object ID or resource ID)
|
*
|
* The request uses the 2017-09-01 API version and includes the required secret header
|
* for authentication with the MSI endpoint.
|
*
|
* @param resource - The target resource/scope for which to request an access token (e.g., "https://graph.microsoft.com/.default")
|
* @param managedIdentityId - The managed identity configuration specifying whether to use system-assigned or user-assigned identity
|
*
|
* @returns A configured ManagedIdentityRequestParameters object ready for network execution
|
*
|
* @throws Error if an unsupported managed identity ID type is specified (only client ID is supported for user-assigned)
|
*/
|
createRequest(resource, managedIdentityId) {
|
const request = new ManagedIdentityRequestParameters(HttpMethod.GET, this.msiEndpoint);
|
request.headers[ManagedIdentityHeaders.METADATA_HEADER_NAME] = "true";
|
request.headers[ManagedIdentityHeaders.ML_AND_SF_SECRET_HEADER_NAME] =
|
this.secret;
|
request.queryParameters[ManagedIdentityQueryParameters.API_VERSION] =
|
MACHINE_LEARNING_MSI_API_VERSION;
|
request.queryParameters[ManagedIdentityQueryParameters.RESOURCE] =
|
resource;
|
if (managedIdentityId.idType === ManagedIdentityIdType.SYSTEM_ASSIGNED) {
|
request.queryParameters[ManagedIdentityUserAssignedIdQueryParameterNames.MANAGED_IDENTITY_CLIENT_ID_2017] = process.env[ManagedIdentityEnvironmentVariableNames
|
.DEFAULT_IDENTITY_CLIENT_ID]; // this environment variable is always set in an Azure Machine Learning source
|
}
|
else if (managedIdentityId.idType ===
|
ManagedIdentityIdType.USER_ASSIGNED_CLIENT_ID) {
|
request.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(managedIdentityId.idType, false, // isIMDS
|
true // uses2017API
|
)] = managedIdentityId.id;
|
}
|
else {
|
throw new Error(MANAGED_IDENTITY_MACHINE_LEARNING_UNSUPPORTED_ID_TYPE_ERROR);
|
}
|
// bodyParameters calculated in BaseManagedIdentity.acquireTokenWithManagedIdentity
|
return request;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/*
|
* Class to initialize a managed identity and identify the service.
|
* Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/ManagedIdentityClient.cs
|
*/
|
class ManagedIdentityClient {
|
constructor(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries) {
|
this.logger = logger;
|
this.nodeStorage = nodeStorage;
|
this.networkClient = networkClient;
|
this.cryptoProvider = cryptoProvider;
|
this.disableInternalRetries = disableInternalRetries;
|
}
|
async sendManagedIdentityTokenRequest(managedIdentityRequest, managedIdentityId, fakeAuthority, refreshAccessToken) {
|
if (!ManagedIdentityClient.identitySource) {
|
ManagedIdentityClient.identitySource =
|
this.selectManagedIdentitySource(this.logger, this.nodeStorage, this.networkClient, this.cryptoProvider, this.disableInternalRetries, managedIdentityId);
|
}
|
return ManagedIdentityClient.identitySource.acquireTokenWithManagedIdentity(managedIdentityRequest, managedIdentityId, fakeAuthority, refreshAccessToken);
|
}
|
allEnvironmentVariablesAreDefined(environmentVariables) {
|
return Object.values(environmentVariables).every((environmentVariable) => {
|
return environmentVariable !== undefined;
|
});
|
}
|
/**
|
* Determine the Managed Identity Source based on available environment variables. This API is consumed by ManagedIdentityApplication's getManagedIdentitySource.
|
* @returns ManagedIdentitySourceNames - The Managed Identity source's name
|
*/
|
getManagedIdentitySource() {
|
ManagedIdentityClient.sourceName =
|
this.allEnvironmentVariablesAreDefined(ServiceFabric.getEnvironmentVariables())
|
? ManagedIdentitySourceNames.SERVICE_FABRIC
|
: this.allEnvironmentVariablesAreDefined(AppService.getEnvironmentVariables())
|
? ManagedIdentitySourceNames.APP_SERVICE
|
: this.allEnvironmentVariablesAreDefined(MachineLearning.getEnvironmentVariables())
|
? ManagedIdentitySourceNames.MACHINE_LEARNING
|
: this.allEnvironmentVariablesAreDefined(CloudShell.getEnvironmentVariables())
|
? ManagedIdentitySourceNames.CLOUD_SHELL
|
: this.allEnvironmentVariablesAreDefined(AzureArc.getEnvironmentVariables())
|
? ManagedIdentitySourceNames.AZURE_ARC
|
: ManagedIdentitySourceNames.DEFAULT_TO_IMDS;
|
return ManagedIdentityClient.sourceName;
|
}
|
/**
|
* Tries to create a managed identity source for all sources
|
* @returns the managed identity Source
|
*/
|
selectManagedIdentitySource(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) {
|
const source = ServiceFabric.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) ||
|
AppService.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries) ||
|
MachineLearning.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries) ||
|
CloudShell.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) ||
|
AzureArc.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries, managedIdentityId) ||
|
Imds.tryCreate(logger, nodeStorage, networkClient, cryptoProvider, disableInternalRetries);
|
if (!source) {
|
throw createManagedIdentityError(unableToCreateSource);
|
}
|
return source;
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
const SOURCES_THAT_SUPPORT_TOKEN_REVOCATION = [ManagedIdentitySourceNames.SERVICE_FABRIC];
|
/**
|
* Class to initialize a managed identity and identify the service
|
* @public
|
*/
|
class ManagedIdentityApplication {
|
constructor(configuration) {
|
// undefined config means the managed identity is system-assigned
|
this.config = buildManagedIdentityConfiguration(configuration || {});
|
this.logger = new Logger(this.config.system.loggerOptions, name, version);
|
const fakeStatusAuthorityOptions = {
|
canonicalAuthority: DEFAULT_AUTHORITY,
|
};
|
if (!ManagedIdentityApplication.nodeStorage) {
|
ManagedIdentityApplication.nodeStorage = new NodeStorage(this.logger, this.config.managedIdentityId.id, DEFAULT_CRYPTO_IMPLEMENTATION, fakeStatusAuthorityOptions);
|
}
|
this.networkClient = this.config.system.networkClient;
|
this.cryptoProvider = new CryptoProvider();
|
const fakeAuthorityOptions = {
|
protocolMode: ProtocolMode.AAD,
|
knownAuthorities: [DEFAULT_AUTHORITY_FOR_MANAGED_IDENTITY],
|
cloudDiscoveryMetadata: "",
|
authorityMetadata: "",
|
};
|
this.fakeAuthority = new Authority(DEFAULT_AUTHORITY_FOR_MANAGED_IDENTITY, this.networkClient, ManagedIdentityApplication.nodeStorage, fakeAuthorityOptions, this.logger, this.cryptoProvider.createNewGuid(), // correlationID
|
new StubPerformanceClient(), true);
|
this.fakeClientCredentialClient = new ClientCredentialClient({
|
authOptions: {
|
clientId: this.config.managedIdentityId.id,
|
authority: this.fakeAuthority,
|
},
|
});
|
this.managedIdentityClient = new ManagedIdentityClient(this.logger, ManagedIdentityApplication.nodeStorage, this.networkClient, this.cryptoProvider, this.config.disableInternalRetries);
|
this.hashUtils = new HashUtils();
|
}
|
/**
|
* Acquire an access token from the cache or the managed identity
|
* @param managedIdentityRequest - the ManagedIdentityRequestParams object passed in by the developer
|
* @returns the access token
|
*/
|
async acquireToken(managedIdentityRequestParams) {
|
if (!managedIdentityRequestParams.resource) {
|
throw createClientConfigurationError(urlEmptyError);
|
}
|
const managedIdentityRequest = {
|
forceRefresh: managedIdentityRequestParams.forceRefresh,
|
resource: managedIdentityRequestParams.resource.replace("/.default", ""),
|
scopes: [
|
managedIdentityRequestParams.resource.replace("/.default", ""),
|
],
|
authority: this.fakeAuthority.canonicalAuthority,
|
correlationId: this.cryptoProvider.createNewGuid(),
|
claims: managedIdentityRequestParams.claims,
|
clientCapabilities: this.config.clientCapabilities,
|
};
|
if (managedIdentityRequest.forceRefresh) {
|
return this.acquireTokenFromManagedIdentity(managedIdentityRequest, this.config.managedIdentityId, this.fakeAuthority);
|
}
|
const [cachedAuthenticationResult, lastCacheOutcome] = await this.fakeClientCredentialClient.getCachedAuthenticationResult(managedIdentityRequest, this.config, this.cryptoProvider, this.fakeAuthority, ManagedIdentityApplication.nodeStorage);
|
/*
|
* Check if claims are present in the managed identity request.
|
* If so, the cached token will not be used.
|
*/
|
if (managedIdentityRequest.claims) {
|
const sourceName = this.managedIdentityClient.getManagedIdentitySource();
|
/*
|
* Check if there is a cached token and if the Managed Identity source supports token revocation.
|
* If so, hash the cached access token and add it to the request.
|
*/
|
if (cachedAuthenticationResult &&
|
SOURCES_THAT_SUPPORT_TOKEN_REVOCATION.includes(sourceName)) {
|
const revokedTokenSha256Hash = this.hashUtils
|
.sha256(cachedAuthenticationResult.accessToken)
|
.toString(EncodingTypes.HEX);
|
managedIdentityRequest.revokedTokenSha256Hash =
|
revokedTokenSha256Hash;
|
}
|
return this.acquireTokenFromManagedIdentity(managedIdentityRequest, this.config.managedIdentityId, this.fakeAuthority);
|
}
|
if (cachedAuthenticationResult) {
|
// if the token is not expired but must be refreshed; get a new one in the background
|
if (lastCacheOutcome ===
|
CacheOutcome.PROACTIVELY_REFRESHED) {
|
this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.", managedIdentityRequest.correlationId);
|
// force refresh; will run in the background
|
const refreshAccessToken = true;
|
await this.acquireTokenFromManagedIdentity(managedIdentityRequest, this.config.managedIdentityId, this.fakeAuthority, refreshAccessToken);
|
}
|
return cachedAuthenticationResult;
|
}
|
else {
|
return this.acquireTokenFromManagedIdentity(managedIdentityRequest, this.config.managedIdentityId, this.fakeAuthority);
|
}
|
}
|
/**
|
* Acquires a token from a managed identity endpoint.
|
*
|
* @param managedIdentityRequest - The request object containing parameters for the managed identity token request.
|
* @param managedIdentityId - The identifier for the managed identity (e.g., client ID or resource ID).
|
* @param fakeAuthority - A placeholder authority used for the token request.
|
* @param refreshAccessToken - Optional flag indicating whether to force a refresh of the access token.
|
* @returns A promise that resolves to an AuthenticationResult containing the acquired token and related information.
|
*/
|
async acquireTokenFromManagedIdentity(managedIdentityRequest, managedIdentityId, fakeAuthority, refreshAccessToken) {
|
// make a network call to the managed identity
|
return this.managedIdentityClient.sendManagedIdentityTokenRequest(managedIdentityRequest, managedIdentityId, fakeAuthority, refreshAccessToken);
|
}
|
/**
|
* Determine the Managed Identity Source based on available environment variables. This API is consumed by Azure Identity SDK.
|
* @returns ManagedIdentitySourceNames - The Managed Identity source's name
|
*/
|
getManagedIdentitySource() {
|
return (ManagedIdentityClient.sourceName ||
|
this.managedIdentityClient.getManagedIdentitySource());
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Cache plugin that serializes data to the cache and deserializes data from the cache
|
* @public
|
*/
|
class DistributedCachePlugin {
|
constructor(client, partitionManager) {
|
this.client = client;
|
this.partitionManager = partitionManager;
|
}
|
/**
|
* Deserializes the cache before accessing it
|
* @param cacheContext - TokenCacheContext
|
*/
|
async beforeCacheAccess(cacheContext) {
|
const partitionKey = await this.partitionManager.getKey();
|
const cacheData = await this.client.get(partitionKey);
|
cacheContext.tokenCache.deserialize(cacheData);
|
}
|
/**
|
* Serializes the cache after accessing it
|
* @param cacheContext - TokenCacheContext
|
*/
|
async afterCacheAccess(cacheContext) {
|
if (cacheContext.cacheHasChanged) {
|
const kvStore = cacheContext.tokenCache.getKVStore();
|
const accountEntities = Object.values(kvStore).filter((value) => isAccountEntity(value));
|
let partitionKey;
|
if (accountEntities.length > 0) {
|
const accountEntity = accountEntities[0];
|
partitionKey = await this.partitionManager.extractKey(accountEntity);
|
}
|
else {
|
partitionKey = await this.partitionManager.getKey();
|
}
|
await this.client.set(partitionKey, cacheContext.tokenCache.serialize());
|
}
|
}
|
}
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* @packageDocumentation
|
* @module @azure/msal-node
|
*/
|
/**
|
* Warning: This set of exports is purely intended to be used by other MSAL libraries, and should be considered potentially unstable. We strongly discourage using them directly, you do so at your own risk.
|
* Breaking changes to these APIs will be shipped under a minor version, instead of a major version.
|
*/
|
const PromptValue = PromptValue$1;
|
const ResponseMode = ResponseMode$1;
|
|
exports.AuthError = AuthError;
|
exports.AuthErrorCodes = AuthErrorCodes;
|
exports.AzureCloudInstance = AzureCloudInstance;
|
exports.ClientAssertion = ClientAssertion;
|
exports.ClientAuthError = ClientAuthError;
|
exports.ClientAuthErrorCodes = ClientAuthErrorCodes;
|
exports.ClientConfigurationError = ClientConfigurationError;
|
exports.ClientConfigurationErrorCodes = ClientConfigurationErrorCodes;
|
exports.ConfidentialClientApplication = ConfidentialClientApplication;
|
exports.CryptoProvider = CryptoProvider;
|
exports.DistributedCachePlugin = DistributedCachePlugin;
|
exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
|
exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
|
exports.Logger = Logger;
|
exports.ManagedIdentityApplication = ManagedIdentityApplication;
|
exports.ManagedIdentitySourceNames = ManagedIdentitySourceNames;
|
exports.PromptValue = PromptValue;
|
exports.ProtocolMode = ProtocolMode;
|
exports.PublicClientApplication = PublicClientApplication;
|
exports.ResponseMode = ResponseMode;
|
exports.ServerError = ServerError;
|
exports.TokenCache = TokenCache;
|
exports.TokenCacheContext = TokenCacheContext;
|
exports.internals = internals;
|
exports.version = version;
|
//# sourceMappingURL=msal-node.cjs.map
|
