@azure/msal-browser 4.16.0 → 4.19.0

package/src/cache/CacheHelpers.ts

@@ -4,16 +4,21 @@
  */
 
 import { TokenKeys } from "@azure/msal-common/browser";
-import { StaticCacheKeys } from "../utils/BrowserConstants.js";
 import { IWindowStorage } from "./IWindowStorage.js";
+import * as CacheKeys from "./CacheKeys.js";
 
 /**
  * Returns a list of cache keys for all known accounts
  * @param storage
  * @returns
  */
-export function getAccountKeys(storage: IWindowStorage<string>): Array<string> {
-    const accountKeys = storage.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+export function getAccountKeys(
+    storage: IWindowStorage<string>,
+    schemaVersion?: number
+): Array<string> {
+    const accountKeys = storage.getItem(
+        CacheKeys.getAccountKeysCacheKey(schemaVersion)
+    );
     if (accountKeys) {
         return JSON.parse(accountKeys);
     }
@@ -29,9 +34,12 @@ export function getAccountKeys(storage: IWindowStorage<string>): Array<string> {
  */
 export function getTokenKeys(
     clientId: string,
-    storage: IWindowStorage<string>
+    storage: IWindowStorage<string>,
+    schemaVersion?: number
 ): TokenKeys {
-    const item = storage.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${clientId}`);
+    const item = storage.getItem(
+        CacheKeys.getTokenKeysCacheKey(clientId, schemaVersion)
+    );
     if (item) {
         const tokenKeys = JSON.parse(item);
         if (

package/src/cache/CacheKeys.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const PREFIX = "msal";
+const BROWSER_PREFIX = "browser";
+export const CACHE_KEY_SEPARATOR = "-";
+export const CREDENTIAL_SCHEMA_VERSION = 1;
+export const ACCOUNT_SCHEMA_VERSION = 1;
+
+export const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
+export const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
+export const BROWSER_PERF_ENABLED_KEY = `${PREFIX}.${BROWSER_PREFIX}.performance.enabled`;
+export const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
+export const VERSION_CACHE_KEY = `${PREFIX}.version`;
+export const ACCOUNT_KEYS = "account.keys";
+export const TOKEN_KEYS = "token.keys";
+
+export function getAccountKeysCacheKey(
+    schema: number = ACCOUNT_SCHEMA_VERSION
+): string {
+    if (schema < 1) {
+        return `${PREFIX}.${ACCOUNT_KEYS}`;
+    }
+
+    return `${PREFIX}.${schema}.${ACCOUNT_KEYS}`;
+}
+
+export function getTokenKeysCacheKey(
+    clientId: string,
+    schema: number = CREDENTIAL_SCHEMA_VERSION
+): string {
+    if (schema < 1) {
+        return `${PREFIX}.${TOKEN_KEYS}.${clientId}`;
+    }
+
+    return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
+}

package/src/cache/CookieStorage.ts

@@ -92,6 +92,11 @@ export class CookieStorage implements IWindowStorage<string> {
     containsKey(key: string): boolean {
         return this.getKeys().includes(key);
     }
+
+    decryptData(): Promise<object | null> {
+        // Cookie storage does not support encryption, so this method is a no-op
+        return Promise.resolve(null);
+    }
 }
 
 /**

package/src/cache/EncryptedData.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type EncryptedData = {
+    id: string;
+    nonce: string;
+    data: string;
+    lastUpdatedAt: string;
+};
+
+export function isEncrypted(data: object): data is EncryptedData {
+    return (
+        data.hasOwnProperty("id") &&
+        data.hasOwnProperty("nonce") &&
+        data.hasOwnProperty("data")
+    );
+}

package/src/cache/IWindowStorage.ts

@@ -3,6 +3,8 @@
  * Licensed under the MIT License.
  */
 
+import { EncryptedData } from "./EncryptedData.js";
+
 export interface IWindowStorage<T> {
     /**
      * Async initializer
@@ -52,4 +54,10 @@ export interface IWindowStorage<T> {
      * @param key
      */
     containsKey(key: string): boolean;
+
+    decryptData(
+        key: string,
+        data: EncryptedData,
+        correlationId: string
+    ): Promise<object | null>;
 }

package/src/cache/LocalStorage.ts

@@ -4,7 +4,6 @@
  */
 
 import {
-    Constants,
     TokenKeys,
     IPerformanceClient,
     invokeAsync,
@@ -33,7 +32,8 @@ import { CookieStorage, SameSiteOptions } from "./CookieStorage.js";
 import { IWindowStorage } from "./IWindowStorage.js";
 import { MemoryStorage } from "./MemoryStorage.js";
 import { getAccountKeys, getTokenKeys } from "./CacheHelpers.js";
-import { StaticCacheKeys } from "../utils/BrowserConstants.js";
+import * as CacheKeys from "./CacheKeys.js";
+import { EncryptedData, isEncrypted } from "./EncryptedData.js";
 
 const ENCRYPTION_KEY = "msal.cache.encryption";
 const BROADCAST_CHANNEL_NAME = "msal.broadcast.cache";
@@ -43,13 +43,6 @@ type EncryptionCookie = {
     key: CryptoKey;
 };
 
-type EncryptedData = {
-    id: string;
-    nonce: string;
-    data: string;
-    lastUpdatedAt: string;
-};
-
 export class LocalStorage implements IWindowStorage<string> {
     private clientId: string;
     private initialized: boolean;
@@ -105,16 +98,8 @@ export class LocalStorage implements IWindowStorage<string> {
                     correlationId
                 )(baseKey),
             };
-            await invokeAsync(
-                this.importExistingCache.bind(this),
-                PerformanceEvents.ImportExistingCache,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(correlationId);
         } else {
-            // Encryption key doesn't exist or is invalid, generate a new one and clear existing cache
-            this.clear();
+            // Encryption key doesn't exist or is invalid, generate a new one
             const id = createNewGuid();
             const baseKey = await invokeAsync(
                 generateBaseKey,
@@ -155,6 +140,14 @@ export class LocalStorage implements IWindowStorage<string> {
             );
         }
 
+        await invokeAsync(
+            this.importExistingCache.bind(this),
+            PerformanceEvents.ImportExistingCache,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(correlationId);
+
         // Register listener for cache updates in other tabs
         this.broadcast.addEventListener("message", this.updateCache.bind(this));
 
@@ -174,6 +167,54 @@ export class LocalStorage implements IWindowStorage<string> {
         return this.memoryStorage.getItem(key);
     }
 
+    async decryptData(
+        key: string,
+        data: EncryptedData,
+        correlationId: string
+    ): Promise<object | null> {
+        if (!this.initialized || !this.encryptionCookie) {
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.uninitializedPublicClientApplication
+            );
+        }
+
+        if (data.id !== this.encryptionCookie.id) {
+            // Data was encrypted with a different key. It must be removed because it is from a previous session.
+            this.performanceClient.incrementFields(
+                { encryptedCacheExpiredCount: 1 },
+                correlationId
+            );
+            return null;
+        }
+
+        const decryptedData = await invokeAsync(
+            decrypt,
+            PerformanceEvents.Decrypt,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            this.encryptionCookie.key,
+            data.nonce,
+            this.getContext(key),
+            data.data
+        );
+
+        if (!decryptedData) {
+            return null;
+        }
+
+        try {
+            return JSON.parse(decryptedData);
+        } catch (e) {
+            this.performanceClient.incrementFields(
+                { encryptedCacheCorruptionCount: 1 },
+                correlationId
+            );
+            return null;
+        }
+    }
+
     setItem(key: string, value: string): void {
         window.localStorage.setItem(key, value);
     }
@@ -252,7 +293,7 @@ export class LocalStorage implements IWindowStorage<string> {
         // Clean up anything left
         this.getKeys().forEach((cacheKey: string) => {
             if (
-                cacheKey.startsWith(Constants.CACHE_PREFIX) ||
+                cacheKey.startsWith(CacheKeys.PREFIX) ||
                 cacheKey.indexOf(this.clientId) !== -1
             ) {
                 this.removeItem(cacheKey);
@@ -272,7 +313,14 @@ export class LocalStorage implements IWindowStorage<string> {
         let accountKeys = getAccountKeys(this);
         accountKeys = await this.importArray(accountKeys, correlationId);
         // Write valid account keys back to map
-        this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+        if (accountKeys.length) {
+            this.setItem(
+                CacheKeys.getAccountKeysCacheKey(),
+                JSON.stringify(accountKeys)
+            );
+        } else {
+            this.removeItem(CacheKeys.getAccountKeysCacheKey());
+        }
 
         const tokenKeys: TokenKeys = getTokenKeys(this.clientId, this);
         tokenKeys.idToken = await this.importArray(
@@ -288,10 +336,18 @@ export class LocalStorage implements IWindowStorage<string> {
             correlationId
         );
         // Write valid token keys back to map
-        this.setItem(
-            `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`,
-            JSON.stringify(tokenKeys)
-        );
+        if (
+            tokenKeys.idToken.length ||
+            tokenKeys.accessToken.length ||
+            tokenKeys.refreshToken.length
+        ) {
+            this.setItem(
+                CacheKeys.getTokenKeysCacheKey(this.clientId),
+                JSON.stringify(tokenKeys)
+            );
+        } else {
+            this.removeItem(CacheKeys.getTokenKeysCacheKey(this.clientId));
+        }
     }
 
     /**
@@ -320,13 +376,13 @@ export class LocalStorage implements IWindowStorage<string> {
             return null;
         }
 
-        if (!encObj.id || !encObj.nonce || !encObj.data) {
-            // Data is not encrypted, likely from old version of MSAL. It must be removed because we don't know how old it is.
+        if (!isEncrypted(encObj)) {
+            // Data is not encrypted
             this.performanceClient.incrementFields(
                 { unencryptedCacheCount: 1 },
                 correlationId
             );
-            return null;
+            return encObj;
         }
 
         if (encObj.id !== this.encryptionCookie.id) {

package/src/cache/MemoryStorage.ts

@@ -51,4 +51,9 @@ export class MemoryStorage<T> implements IWindowStorage<T> {
     clear(): void {
         this.cache.clear();
     }
+
+    decryptData(): Promise<object | null> {
+        // Memory storage does not support encryption, so this method is a no-op
+        return Promise.resolve(null);
+    }
 }

package/src/cache/SessionStorage.ts

@@ -49,4 +49,9 @@ export class SessionStorage implements IWindowStorage<string> {
     containsKey(key: string): boolean {
         return window.sessionStorage.hasOwnProperty(key);
     }
+
+    decryptData(): Promise<object | null> {
+        // Session storage does not support encryption, so this method is a no-op
+        return Promise.resolve(null);
+    }
 }

package/src/config/Configuration.ts

@@ -132,6 +132,10 @@ export type CacheOptions = {
      * Used to specify the cacheLocation user wants to set. Valid values are "localStorage", "sessionStorage" and "memoryStorage".
      */
     cacheLocation?: BrowserCacheLocation | string;
+    /**
+     * Used to specify the number of days cache entries written by previous versions of MSAL.js should be retained in the browser. Defaults to 5 days.
+     */
+    cacheRetentionDays?: number;
     /**
      * Used to specify the temporaryCacheLocation user wants to set. Valid values are "localStorage", "sessionStorage" and "memoryStorage".
      * @deprecated This option is deprecated and will be removed in the next major version.
@@ -311,6 +315,7 @@ export function buildConfiguration(
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS: Required<CacheOptions> = {
         cacheLocation: BrowserCacheLocation.SessionStorage,
+        cacheRetentionDays: 5,
         temporaryCacheLocation: BrowserCacheLocation.SessionStorage,
         storeAuthStateInCookie: false,
         secureCookies: false,

package/src/controllers/StandardController.ts

@@ -262,6 +262,7 @@ export class StandardController implements IController {
         // initialize in memory storage for native flows
         const nativeCacheOptions: Required<CacheOptions> = {
             cacheLocation: BrowserCacheLocation.MemoryStorage,
+            cacheRetentionDays: 5,
             temporaryCacheLocation: BrowserCacheLocation.MemoryStorage,
             storeAuthStateInCookie: false,
             secureCookies: false,

package/src/custom_auth/CustomAuthActionInputs.ts

@@ -15,6 +15,7 @@ export type SignInInputs = CustomAuthActionInputs & {
     username: string;
     password?: string;
     scopes?: Array<string>;
+    claims?: string;
 };
 
 export type SignUpInputs = CustomAuthActionInputs & {
@@ -30,8 +31,10 @@ export type ResetPasswordInputs = CustomAuthActionInputs & {
 export type AccessTokenRetrievalInputs = {
     forceRefresh: boolean;
     scopes?: Array<string>;
+    claims?: string;
 };
 
 export type SignInWithContinuationTokenInputs = {
     scopes?: Array<string>;
+    claims?: string;
 };

package/src/custom_auth/controller/CustomAuthStandardController.ts

@@ -41,10 +41,7 @@ import { CustomAuthApiClient } from "../core/network_client/custom_auth_api/Cust
 import { FetchHttpClient } from "../core/network_client/http_client/FetchHttpClient.js";
 import { ResetPasswordClient } from "../reset_password/interaction_client/ResetPasswordClient.js";
 import { NoCachedAccountFoundError } from "../core/error/NoCachedAccountFoundError.js";
-import {
-    ensureArgumentIsNotEmptyString,
-    ensureArgumentIsNotNullOrUndefined,
-} from "../core/utils/ArgumentValidator.js";
+import * as ArgumentValidator from "../core/utils/ArgumentValidator.js";
 import { UserAlreadySignedInError } from "../core/error/UserAlreadySignedInError.js";
 import { CustomAuthSilentCacheClient } from "../get_account/interaction_client/CustomAuthSilentCacheClient.js";
 import { UnsupportedEnvironmentError } from "../core/error/UnsupportedEnvironmentError.js";
@@ -177,19 +174,27 @@ export class CustomAuthStandardController
         const correlationId = this.getCorrelationId(signInInputs);
 
         try {
-            ensureArgumentIsNotNullOrUndefined(
+            ArgumentValidator.ensureArgumentIsNotNullOrUndefined(
                 "signInInputs",
                 signInInputs,
                 correlationId
             );
 
-            ensureArgumentIsNotEmptyString(
+            ArgumentValidator.ensureArgumentIsNotEmptyString(
                 "signInInputs.username",
                 signInInputs.username,
                 correlationId
             );
             this.ensureUserNotSignedIn(correlationId);
 
+            if (signInInputs.claims) {
+                ArgumentValidator.ensureArgumentIsJSONString(
+                    "signInInputs.claims",
+                    signInInputs.claims,
+                    correlationId
+                );
+            }
+
             // start the signin flow
             const signInStartParams: SignInStartParams = {
                 clientId: this.customAuthConfig.auth.clientId,
@@ -231,6 +236,7 @@ export class CustomAuthStandardController
                         username: signInInputs.username,
                         codeLength: startResult.codeLength,
                         scopes: signInInputs.scopes ?? [],
+                        claims: signInInputs.claims,
                     })
                 );
             } else if (
@@ -258,6 +264,7 @@ export class CustomAuthStandardController
                             cacheClient: this.cacheClient,
                             username: signInInputs.username,
                             scopes: signInInputs.scopes ?? [],
+                            claims: signInInputs.claims,
                         })
                     );
                 }
@@ -277,6 +284,7 @@ export class CustomAuthStandardController
                     continuationToken: startResult.continuationToken,
                     password: signInInputs.password,
                     username: signInInputs.username,
+                    claims: signInInputs.claims,
                 };
 
                 const completedResult = await this.signInClient.submitPassword(
@@ -327,13 +335,13 @@ export class CustomAuthStandardController
         const correlationId = this.getCorrelationId(signUpInputs);
 
         try {
-            ensureArgumentIsNotNullOrUndefined(
+            ArgumentValidator.ensureArgumentIsNotNullOrUndefined(
                 "signUpInputs",
                 signUpInputs,
                 correlationId
             );
 
-            ensureArgumentIsNotEmptyString(
+            ArgumentValidator.ensureArgumentIsNotEmptyString(
                 "signUpInputs.username",
                 signUpInputs.username,
                 correlationId
@@ -439,13 +447,13 @@ export class CustomAuthStandardController
         const correlationId = this.getCorrelationId(resetPasswordInputs);
 
         try {
-            ensureArgumentIsNotNullOrUndefined(
+            ArgumentValidator.ensureArgumentIsNotNullOrUndefined(
                 "resetPasswordInputs",
                 resetPasswordInputs,
                 correlationId
             );
 
-            ensureArgumentIsNotEmptyString(
+            ArgumentValidator.ensureArgumentIsNotEmptyString(
                 "resetPasswordInputs.username",
                 resetPasswordInputs.username,
                 correlationId

package/src/custom_auth/core/auth_flow/AuthFlowErrorBase.ts

@@ -127,6 +127,18 @@ export abstract class AuthFlowErrorBase {
             this.errorData.error === CustomAuthApiErrorCode.EXPIRED_TOKEN
         );
     }
+
+    /**
+     * @todo verify the password change required error can be detected once the MFA is in place.
+     * This error will be raised during signin and refresh tokens when calling /token endpoint.
+     */
+    protected isPasswordResetRequiredError(): boolean {
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.INVALID_REQUEST &&
+            this.errorData.errorCodes?.includes(50142) === true
+        );
+    }
 }
 
 export abstract class AuthActionErrorBase extends AuthFlowErrorBase {

package/src/custom_auth/core/network_client/custom_auth_api/SignInApiClient.ts

@@ -90,6 +90,7 @@ export class SignInApiClient extends BaseApiClient {
                 grant_type: GrantType.PASSWORD,
                 scope: params.scope,
                 password: params.password,
+                ...(params.claims && { claims: params.claims }),
             },
             params.telemetryManager,
             params.correlationId
@@ -105,6 +106,7 @@ export class SignInApiClient extends BaseApiClient {
                 scope: params.scope,
                 oob: params.oob,
                 grant_type: GrantType.OOB,
+                ...(params.claims && { claims: params.claims }),
             },
             params.telemetryManager,
             params.correlationId
@@ -121,6 +123,7 @@ export class SignInApiClient extends BaseApiClient {
                 scope: params.scope,
                 grant_type: GrantType.CONTINUATION_TOKEN,
                 client_info: true,
+                ...(params.claims && { claims: params.claims }),
             },
             params.telemetryManager,
             params.correlationId

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiRequestTypes.ts

@@ -19,6 +19,7 @@ export interface SignInChallengeRequest extends ApiRequestBase {
 interface SignInTokenRequestBase extends ApiRequestBase {
     continuation_token: string;
     scope: string;
+    claims?: string;
 }
 
 export interface SignInPasswordTokenRequest extends SignInTokenRequestBase {

package/src/custom_auth/core/utils/ArgumentValidator.ts

@@ -24,3 +24,25 @@ export function ensureArgumentIsNotEmptyString(
         throw new InvalidArgumentError(argName, correlationId);
     }
 }
+
+export function ensureArgumentIsJSONString(
+    argName: string,
+    argValue: string,
+    correlationId?: string
+): void {
+    try {
+        const parsed = JSON.parse(argValue);
+        if (
+            typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)
+        ) {
+            throw new InvalidArgumentError(argName, correlationId);
+        }
+    } catch (e) {
+        if (e instanceof SyntaxError) {
+            throw new InvalidArgumentError(argName, correlationId);
+        }
+        throw e; // Rethrow unexpected errors
+    }
+}

package/src/custom_auth/get_account/auth_flow/CustomAuthAccountData.ts

@@ -18,10 +18,7 @@ import {
     TokenClaims,
 } from "@azure/msal-common/browser";
 import { SilentRequest } from "../../../request/SilentRequest.js";
-import {
-    ensureArgumentIsNotEmptyString,
-    ensureArgumentIsNotNullOrUndefined,
-} from "../../core/utils/ArgumentValidator.js";
+import * as ArgumentValidator from "../../core/utils/ArgumentValidator.js";
 
 /*
  * Account information.
@@ -34,8 +31,15 @@ export class CustomAuthAccountData {
         private readonly logger: Logger,
         private readonly correlationId: string
     ) {
-        ensureArgumentIsNotEmptyString("correlationId", correlationId);
-        ensureArgumentIsNotNullOrUndefined("account", account, correlationId);
+        ArgumentValidator.ensureArgumentIsNotEmptyString(
+            "correlationId",
+            correlationId
+        );
+        ArgumentValidator.ensureArgumentIsNotNullOrUndefined(
+            "account",
+            account,
+            correlationId
+        );
     }
 
     /**
@@ -107,12 +111,20 @@ export class CustomAuthAccountData {
         accessTokenRetrievalInputs: AccessTokenRetrievalInputs
     ): Promise<GetAccessTokenResult> {
         try {
-            ensureArgumentIsNotNullOrUndefined(
+            ArgumentValidator.ensureArgumentIsNotNullOrUndefined(
                 "accessTokenRetrievalInputs",
                 accessTokenRetrievalInputs,
                 this.correlationId
             );
 
+            if (accessTokenRetrievalInputs.claims) {
+                ArgumentValidator.ensureArgumentIsJSONString(
+                    "accessTokenRetrievalInputs.claims",
+                    accessTokenRetrievalInputs.claims,
+                    this.correlationId
+                );
+            }
+
             this.logger.verbose("Getting current account.", this.correlationId);
 
             const currentAccount = this.cacheClient.getCurrentAccount(
@@ -133,7 +145,8 @@ export class CustomAuthAccountData {
             const commonSilentFlowRequest = this.createCommonSilentFlowRequest(
                 currentAccount,
                 accessTokenRetrievalInputs.forceRefresh,
-                newScopes
+                newScopes,
+                accessTokenRetrievalInputs.claims
             );
             const result = await this.cacheClient.acquireToken(
                 commonSilentFlowRequest
@@ -158,7 +171,8 @@ export class CustomAuthAccountData {
     private createCommonSilentFlowRequest(
         accountInfo: AccountInfo,
         forceRefresh: boolean = false,
-        requestScopes: Array<string>
+        requestScopes: Array<string>,
+        claims?: string
     ): CommonSilentFlowRequest {
         const silentRequest: SilentRequest = {
             authority: this.config.auth.authority,
@@ -171,6 +185,7 @@ export class CustomAuthAccountData {
                 accessToken: true,
                 refreshToken: true,
             },
+            ...(claims && { claims: claims }),
         };
 
         return {

package/src/custom_auth/sign_in/auth_flow/error_type/SignInError.ts

@@ -31,6 +31,14 @@ export class SignInError extends AuthActionErrorBase {
         return this.isPasswordIncorrectError();
     }
 
+    /**
+     * Checks if the error is due to password reset being required.
+     * @returns true if the error is due to password reset being required, false otherwise.
+     */
+    isPasswordResetRequired(): boolean {
+        return this.isPasswordResetRequiredError();
+    }
+
     /**
      * Checks if the error is due to the provided challenge type is not supported.
      * @returns {boolean} True if the error is due to the provided challenge type is not supported, false otherwise.

package/src/custom_auth/sign_in/auth_flow/state/SignInCodeRequiredState.ts

@@ -37,6 +37,7 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                 continuationToken: this.stateParameters.continuationToken ?? "",
                 code: code,
                 username: this.stateParameters.username,
+                claims: this.stateParameters.claims,
             };
 
             this.stateParameters.logger.verbose(