@azure/msal-browser 4.7.0 → 4.9.0

package/src/interaction_client/SilentIframeClient.ts

@@ -7,17 +7,16 @@ import {
     ICrypto,
     Logger,
     PromptValue,
-    CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
     AuthError,
-    ProtocolUtils,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
     invoke,
+    ProtocolMode,
+    CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
 import { StandardInteractionClient } from "./StandardInteractionClient.js";
-import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
 import { EventHandler } from "../event/EventHandler.js";
@@ -32,16 +31,18 @@ import {
     BrowserConstants,
 } from "../utils/BrowserConstants.js";
 import {
-    initiateAuthRequest,
+    initiateCodeRequest,
+    initiateEarRequest,
     monitorIframeForHash,
 } from "../interaction_handler/SilentHandler.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler.js";
-import { NativeInteractionClient } from "./NativeInteractionClient.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { InteractionHandler } from "../interaction_handler/InteractionHandler.js";
 import * as BrowserUtils from "../utils/BrowserUtils.js";
 import * as ResponseHandler from "../response/ResponseHandler.js";
+import * as Authorize from "../protocol/Authorize.js";
+import { generatePkceCodes } from "../crypto/PkceGenerator.js";
+import { generateEarKey } from "../crypto/BrowserCrypto.js";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -114,21 +115,42 @@ export class SilentIframeClient extends StandardInteractionClient {
         }
 
         // Create silent request
-        const silentRequest: AuthorizationUrlRequest = await invokeAsync(
+        const silentRequest: CommonAuthorizationUrlRequest = await invokeAsync(
             this.initializeAuthorizationRequest.bind(this),
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
             this.logger,
             this.performanceClient,
             request.correlationId
         )(inputRequest, InteractionType.Silent);
+        silentRequest.platformBroker =
+            NativeMessageHandler.isPlatformBrokerAvailable(
+                this.config,
+                this.logger,
+                this.nativeMessageHandler,
+                silentRequest.authenticationScheme
+            );
         BrowserUtils.preconnect(silentRequest.authority);
 
+        if (this.config.auth.protocolMode === ProtocolMode.EAR) {
+            return this.executeEarFlow(silentRequest);
+        } else {
+            return this.executeCodeFlow(silentRequest);
+        }
+    }
+
+    /**
+     * Executes auth code + PKCE flow
+     * @param request
+     * @returns
+     */
+    async executeCodeFlow(
+        request: CommonAuthorizationUrlRequest
+    ): Promise<AuthenticationResult> {
+        let authClient: AuthorizationCodeClient | undefined;
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             this.apiId
         );
 
-        let authClient: AuthorizationCodeClient | undefined;
-
         try {
             // Initialize the client
             authClient = await invokeAsync(
@@ -139,10 +161,10 @@ export class SilentIframeClient extends StandardInteractionClient {
                 request.correlationId
             )({
                 serverTelemetryManager,
-                requestAuthority: silentRequest.authority,
-                requestAzureCloudOptions: silentRequest.azureCloudOptions,
-                requestExtraQueryParameters: silentRequest.extraQueryParameters,
-                account: silentRequest.account,
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
             });
 
             return await invokeAsync(
@@ -151,7 +173,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.logger,
                 this.performanceClient,
                 request.correlationId
-            )(authClient, silentRequest);
+            )(authClient, request);
         } catch (e) {
             if (e instanceof AuthError) {
                 (e as AuthError).setCorrelationId(this.correlationId);
@@ -173,25 +195,109 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.correlationId
             );
 
-            const retrySilentRequest: AuthorizationUrlRequest =
-                await invokeAsync(
-                    this.initializeAuthorizationRequest.bind(this),
-                    PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
-                    this.logger,
-                    this.performanceClient,
-                    request.correlationId
-                )(inputRequest, InteractionType.Silent);
-
             return await invokeAsync(
                 this.silentTokenHelper.bind(this),
                 PerformanceEvents.SilentIframeClientTokenHelper,
                 this.logger,
                 this.performanceClient,
                 this.correlationId
-            )(authClient, retrySilentRequest);
+            )(authClient, request);
         }
     }
 
+    /**
+     * Executes EAR flow
+     * @param request
+     */
+    async executeEarFlow(
+        request: CommonAuthorizationUrlRequest
+    ): Promise<AuthenticationResult> {
+        const correlationId = request.correlationId;
+        const discoveredAuthority = await invokeAsync(
+            this.getDiscoveredAuthority.bind(this),
+            PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )({
+            requestAuthority: request.authority,
+            requestAzureCloudOptions: request.azureCloudOptions,
+            requestExtraQueryParameters: request.extraQueryParameters,
+            account: request.account,
+        });
+
+        const earJwk = await invokeAsync(
+            generateEarKey,
+            PerformanceEvents.GenerateEarKey,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )();
+        const silentRequest = {
+            ...request,
+            earJwk: earJwk,
+        };
+        const msalFrame = await invokeAsync(
+            initiateEarRequest,
+            PerformanceEvents.SilentHandlerInitiateAuthRequest,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            this.config,
+            discoveredAuthority,
+            silentRequest,
+            this.logger,
+            this.performanceClient
+        );
+
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
+        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        const responseString = await invokeAsync(
+            monitorIframeForHash,
+            PerformanceEvents.SilentHandlerMonitorIframeForHash,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            msalFrame,
+            this.config.system.iframeHashTimeout,
+            this.config.system.pollIntervalMilliseconds,
+            this.performanceClient,
+            this.logger,
+            correlationId,
+            responseType
+        );
+
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(responseString, responseType, this.logger);
+
+        return invokeAsync(
+            Authorize.handleResponseEAR,
+            PerformanceEvents.HandleResponseEar,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            silentRequest,
+            serverParams,
+            this.apiId,
+            this.config,
+            discoveredAuthority,
+            this.browserStorage,
+            this.nativeStorage,
+            this.eventHandler,
+            this.logger,
+            this.performanceClient,
+            this.nativeMessageHandler
+        );
+    }
+
     /**
      * Currently Unsupported
      */
@@ -212,52 +318,43 @@ export class SilentIframeClient extends StandardInteractionClient {
      */
     protected async silentTokenHelper(
         authClient: AuthorizationCodeClient,
-        silentRequest: AuthorizationUrlRequest
+        request: CommonAuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
-        const correlationId = silentRequest.correlationId;
+        const correlationId = request.correlationId;
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.SilentIframeClientTokenHelper,
             correlationId
         );
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
 
-        // Create auth code request and generate PKCE params
-        const authCodeRequest: CommonAuthorizationCodeRequest =
-            await invokeAsync(
-                this.initializeAuthorizationCodeRequest.bind(this),
-                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(silentRequest);
-
+        const silentRequest = {
+            ...request,
+            codeChallenge: pkceCodes.challenge,
+        };
         // Create authorize request url
         const navigateUrl = await invokeAsync(
-            authClient.getAuthCodeUrl.bind(authClient),
+            Authorize.getAuthCodeRequestUrl,
             PerformanceEvents.GetAuthCodeUrl,
             this.logger,
             this.performanceClient,
             correlationId
-        )({
-            ...silentRequest,
-            platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(
-                this.config,
-                this.logger,
-                this.nativeMessageHandler,
-                silentRequest.authenticationScheme
-            ),
-        });
-
-        // Create silent handler
-        const interactionHandler = new InteractionHandler(
-            authClient,
-            this.browserStorage,
-            authCodeRequest,
+        )(
+            this.config,
+            authClient.authority,
+            silentRequest,
             this.logger,
             this.performanceClient
         );
+
         // Get the frame handle for the silent request
         const msalFrame = await invokeAsync(
-            initiateAuthRequest,
+            initiateCodeRequest,
             PerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
             this.performanceClient,
@@ -269,6 +366,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId,
             this.config.system.navigateFrameWait
         );
+
         const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(
@@ -291,58 +389,28 @@ export class SilentIframeClient extends StandardInteractionClient {
             PerformanceEvents.DeserializeResponse,
             this.logger,
             this.performanceClient,
-            this.correlationId
+            correlationId
         )(responseString, responseType, this.logger);
 
-        if (serverParams.accountId) {
-            this.logger.verbose(
-                "Account id found in hash, calling WAM for token"
-            );
-            if (!this.nativeMessageHandler) {
-                throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.nativeConnectionNotEstablished
-                );
-            }
-            const nativeInteractionClient = new NativeInteractionClient(
-                this.config,
-                this.browserStorage,
-                this.browserCrypto,
-                this.logger,
-                this.eventHandler,
-                this.navigationClient,
-                this.apiId,
-                this.performanceClient,
-                this.nativeMessageHandler,
-                serverParams.accountId,
-                this.browserStorage,
-                correlationId
-            );
-            const { userRequestState } = ProtocolUtils.parseRequestState(
-                this.browserCrypto,
-                silentRequest.state
-            );
-            return invokeAsync(
-                nativeInteractionClient.acquireToken.bind(
-                    nativeInteractionClient
-                ),
-                PerformanceEvents.NativeInteractionClientAcquireToken,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )({
-                ...silentRequest,
-                state: userRequestState,
-                prompt: silentRequest.prompt || PromptValue.NONE,
-            });
-        }
-
-        // Handle response from hash string
         return invokeAsync(
-            interactionHandler.handleCodeResponse.bind(interactionHandler),
-            PerformanceEvents.HandleCodeResponse,
+            Authorize.handleResponseCode,
+            PerformanceEvents.HandleResponseCode,
             this.logger,
             this.performanceClient,
             correlationId
-        )(serverParams, silentRequest);
+        )(
+            request,
+            serverParams,
+            pkceCodes.verifier,
+            this.apiId,
+            this.config,
+            authClient,
+            this.browserStorage,
+            this.nativeStorage,
+            this.eventHandler,
+            this.logger,
+            this.performanceClient,
+            this.nativeMessageHandler
+        );
     }
 }

package/src/interaction_client/StandardInteractionClient.ts

@@ -5,7 +5,6 @@
 
 import {
     ServerTelemetryManager,
-    CommonAuthorizationCodeRequest,
     Constants,
     AuthorizationCodeClient,
     ClientConfiguration,
@@ -20,10 +19,9 @@ import {
     invokeAsync,
     BaseAuthRequest,
     StringDict,
-    PkceCodes,
+    CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
 import { BaseInteractionClient } from "./BaseInteractionClient.js";
-import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest.js";
 import {
     BrowserConstants,
     InteractionType,
@@ -35,7 +33,6 @@ import * as BrowserUtils from "../utils/BrowserUtils.js";
 import { RedirectRequest } from "../request/RedirectRequest.js";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
-import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 import { createNewGuid } from "../crypto/BrowserCrypto.js";
 import { initializeBaseRequest } from "../request/RequestHelpers.js";
 
@@ -43,43 +40,6 @@ import { initializeBaseRequest } from "../request/RequestHelpers.js";
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
  */
 export abstract class StandardInteractionClient extends BaseInteractionClient {
-    /**
-     * Generates an auth code request tied to the url request.
-     * @param request
-     * @param pkceCodes
-     */
-    protected async initializeAuthorizationCodeRequest(
-        request: AuthorizationUrlRequest,
-        pkceCodes?: PkceCodes
-    ): Promise<CommonAuthorizationCodeRequest> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            this.correlationId
-        );
-
-        const generatedPkceParams: PkceCodes =
-            pkceCodes ||
-            (await invokeAsync(
-                generatePkceCodes,
-                PerformanceEvents.GeneratePkceCodes,
-                this.logger,
-                this.performanceClient,
-                this.correlationId
-            )(this.performanceClient, this.logger, this.correlationId));
-
-        const authCodeRequest: CommonAuthorizationCodeRequest = {
-            ...request,
-            redirectUri: request.redirectUri,
-            code: Constants.EMPTY_STRING,
-            codeVerifier: generatedPkceParams.verifier,
-        };
-
-        request.codeChallenge = generatedPkceParams.challenge;
-        request.codeChallengeMethod = Constants.S256_CODE_CHALLENGE_METHOD;
-
-        return authCodeRequest;
-    }
-
     /**
      * Initializer for the logout request.
      * @param logoutRequest
@@ -330,7 +290,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
     protected async initializeAuthorizationRequest(
         request: RedirectRequest | PopupRequest | SsoSilentRequest,
         interactionType: InteractionType
-    ): Promise<AuthorizationUrlRequest> {
+    ): Promise<CommonAuthorizationUrlRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
             this.correlationId
@@ -359,7 +319,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             this.logger
         );
 
-        const validatedRequest: AuthorizationUrlRequest = {
+        const validatedRequest: CommonAuthorizationUrlRequest = {
             ...baseRequest,
             redirectUri: redirectUri,
             state: state,

package/src/interaction_handler/InteractionHandler.ts

@@ -14,7 +14,9 @@ import {
     PerformanceEvents,
     invokeAsync,
     CcsCredentialType,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
+    AuthorizeProtocol,
+    CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
@@ -23,7 +25,6 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest.js";
 
 /**
  * Abstract class which defines operations for a browser interaction handling class.
@@ -54,8 +55,8 @@ export class InteractionHandler {
      * @param locationHash
      */
     async handleCodeResponse(
-        response: ServerAuthorizationCodeResponse,
-        request: AuthorizationUrlRequest
+        response: AuthorizeResponse,
+        request: CommonAuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.HandleCodeResponse,
@@ -64,7 +65,7 @@ export class InteractionHandler {
 
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(
+            authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
                 request.state
             );
@@ -101,7 +102,7 @@ export class InteractionHandler {
      */
     async handleCodeResponseFromServer(
         authCodeResponse: AuthorizationCodePayload,
-        request: AuthorizationUrlRequest,
+        request: CommonAuthorizationUrlRequest,
         validateNonce: boolean = true
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
@@ -159,7 +160,7 @@ export class InteractionHandler {
      * Build ccs creds if available
      */
     protected createCcsCredentials(
-        request: AuthorizationUrlRequest
+        request: CommonAuthorizationUrlRequest
     ): CcsCredential | null {
         if (request.account) {
             return {

package/src/interaction_handler/SilentHandler.ts

@@ -10,19 +10,25 @@ import {
     invokeAsync,
     invoke,
     ServerResponseType,
+    Authority,
+    CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError.js";
-import { DEFAULT_IFRAME_TIMEOUT_MS } from "../config/Configuration.js";
+import {
+    BrowserConfiguration,
+    DEFAULT_IFRAME_TIMEOUT_MS,
+} from "../config/Configuration.js";
+import { getEARForm } from "../protocol/Authorize.js";
 
 /**
  * Creates a hidden iframe to given URL using user-requested scopes as an id.
  * @param urlNavigate
  * @param userRequestScopes
  */
-export async function initiateAuthRequest(
+export async function initiateCodeRequest(
     requestUrl: string,
     performanceClient: IPerformanceClient,
     logger: Logger,
@@ -57,6 +63,29 @@ export async function initiateAuthRequest(
     )(requestUrl);
 }
 
+export async function initiateEarRequest(
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<HTMLIFrameElement> {
+    const frame = createHiddenIframe();
+    if (!frame.contentDocument) {
+        throw "No document associated with iframe!";
+    }
+    const form = await getEARForm(
+        frame.contentDocument,
+        config,
+        authority,
+        request,
+        logger,
+        performanceClient
+    );
+    form.submit();
+    return frame;
+}
+
 /**
  * Monitors an iframe content window until it loads a url with a known hash, or hits a specified timeout.
  * @param iframe

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -75,8 +75,7 @@ export class NestedAppAuthAdapter {
 
         const correlationId =
             request.correlationId || this.crypto.createNewGuid();
-        const requestBuilder = new RequestParameterBuilder(correlationId);
-        const claims = requestBuilder.addClientCapabilitiesToClaims(
+        const claims = RequestParameterBuilder.addClientCapabilitiesToClaims(
             request.claims,
             this.clientCapabilities
         );

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.7.0";
+export const version = "4.9.0";