@azure/msal-browser 5.0.0-alpha.0 → 5.0.1

package/src/controllers/StandardController.ts

@@ -27,6 +27,7 @@ import {
     PkceCodes,
     AccountEntityUtils,
     Constants,
+    AuthToken,
 } from "@azure/msal-common/browser";
 import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import * as BrowserRootPerformanceEvents from "../telemetry/BrowserRootPerformanceEvents.js";
@@ -77,7 +78,7 @@ import { AuthorizationCodeRequest } from "../request/AuthorizationCodeRequest.js
 import { PlatformAuthRequest } from "../broker/nativeBroker/PlatformAuthRequest.js";
 import { StandardOperatingContext } from "../operatingcontext/StandardOperatingContext.js";
 import { BaseOperatingContext } from "../operatingcontext/BaseOperatingContext.js";
-import { HandleRedirectPromiseOptions, IController } from "./IController.js";
+import { IController } from "./IController.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { ClearCacheRequest } from "../request/ClearCacheRequest.js";
 import { createNewGuid } from "../crypto/BrowserCrypto.js";
@@ -90,31 +91,17 @@ import {
 } from "../broker/nativeBroker/PlatformAuthProvider.js";
 import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
 import { collectInstanceStats } from "../utils/MsalFrameStatsUtils.js";
-
-function getAccountType(
-    account?: AccountInfo
-): "AAD" | "MSA" | "B2C" | undefined {
-    const idTokenClaims = account?.idTokenClaims;
-    if (idTokenClaims?.tfp || idTokenClaims?.acr) {
-        return "B2C";
-    }
-
-    if (!idTokenClaims?.tid) {
-        return undefined;
-    } else if (idTokenClaims?.tid === "9188040d-6c67-4c5b-b112-36a304b66dad") {
-        return "MSA";
-    }
-    return "AAD";
-}
+import { HandleRedirectPromiseOptions } from "../request/HandleRedirectPromiseOptions.js";
 
 function preflightCheck(
     initialized: boolean,
-    performanceEvent: InProgressPerformanceEvent
+    performanceEvent: InProgressPerformanceEvent,
+    account?: AccountInfo
 ) {
     try {
         BrowserUtils.preflightCheck(initialized);
     } catch (e) {
-        performanceEvent.end({ success: false }, e);
+        performanceEvent.end({ success: false }, e, account);
         throw e;
     }
 }
@@ -301,10 +288,7 @@ export class StandardController implements IController {
      * Initializer function to perform async startup tasks such as connecting to WAM extension
      * @param request {?InitializeApplicationRequest} correlation id
      */
-    async initialize(
-        request?: InitializeApplicationRequest,
-        isBroker?: boolean
-    ): Promise<void> {
+    async initialize(request?: InitializeApplicationRequest): Promise<void> {
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.trace("initialize called", correlationId);
         if (this.initialized) {
@@ -335,11 +319,7 @@ export class StandardController implements IController {
         this.eventHandler.emitEvent(EventType.INITIALIZE_START);
 
         // Broker applications are initialized twice, so we avoid double-counting it
-        if (!isBroker) {
-            try {
-                this.logMultipleInstances(initMeasurement, initCorrelationId);
-            } catch {}
-        }
+        this.logMultipleInstances(initMeasurement, initCorrelationId);
 
         await invokeAsync(
             this.browserStorage.initialize.bind(this.browserStorage),
@@ -558,17 +538,20 @@ export class StandardController implements IController {
                             result.correlationId
                         );
                     }
-                    rootMeasurement.end({
-                        success: true,
-                        accountType: getAccountType(result.account),
-                    });
+                    rootMeasurement.end(
+                        {
+                            success: true,
+                        },
+                        undefined,
+                        result.account
+                    );
                 } else {
                     /*
                      * Instrument an event only if an error code is set. Otherwise, discard it when the redirect response
                      * is empty and the error code is missing.
                      */
                     if (rootMeasurement.event.errorCode) {
-                        rootMeasurement.end({ success: false });
+                        rootMeasurement.end({ success: false }, undefined);
                     } else {
                         rootMeasurement.discard();
                     }
@@ -627,7 +610,6 @@ export class StandardController implements IController {
             correlationId
         );
         atrMeasurement.add({
-            accountType: getAccountType(request.account),
             scenarioId: request.scenarioId,
         });
 
@@ -641,7 +623,11 @@ export class StandardController implements IController {
                 navigateCallbackResult: navigate !== false,
             });
             atrMeasurement.event =
-                atrMeasurement.end({ success: true }) || atrMeasurement.event;
+                atrMeasurement.end(
+                    { success: true },
+                    undefined,
+                    request.account
+                ) || atrMeasurement.event;
             return navigate;
         };
 
@@ -718,9 +704,9 @@ export class StandardController implements IController {
                         BrowserRootPerformanceEvents.AcquireTokenRedirect,
                         correlationId
                     )
-                    .end({ success: false }, e);
+                    .end({ success: false }, e, request.account);
             } else {
-                atrMeasurement.end({ success: false }, e);
+                atrMeasurement.end({ success: false }, e, request.account);
             }
 
             this.eventHandler.emitEvent(
@@ -753,15 +739,20 @@ export class StandardController implements IController {
 
         atPopupMeasurement.add({
             scenarioId: request.scenarioId,
-            accountType: getAccountType(request.account),
         });
 
         try {
             this.logger.verbose("acquireTokenPopup called", correlationId);
-            preflightCheck(this.initialized, atPopupMeasurement);
+            preflightCheck(
+                this.initialized,
+                atPopupMeasurement,
+                request.account
+            );
             this.browserStorage.setInteractionInProgress(
                 true,
-                INTERACTION_TYPE.SIGNIN
+                INTERACTION_TYPE.SIGNIN,
+                request.overrideInteractionInProgress,
+                correlationId
             );
         } catch (e) {
             // Since this function is syncronous we need to reject
@@ -788,11 +779,14 @@ export class StandardController implements IController {
                 ApiId.acquireTokenPopup
             )
                 .then((response) => {
-                    atPopupMeasurement.end({
-                        success: true,
-                        isNativeBroker: true,
-                        accountType: getAccountType(response.account),
-                    });
+                    atPopupMeasurement.end(
+                        {
+                            success: true,
+                            isNativeBroker: true,
+                        },
+                        undefined,
+                        response.account
+                    );
                     return response;
                 })
                 .catch((e: AuthError) => {
@@ -840,12 +834,15 @@ export class StandardController implements IController {
                     );
                 }
 
-                atPopupMeasurement.end({
-                    success: true,
-                    accessTokenSize: result.accessToken.length,
-                    idTokenSize: result.idToken.length,
-                    accountType: getAccountType(result.account),
-                });
+                atPopupMeasurement.end(
+                    {
+                        success: true,
+                        accessTokenSize: result.accessToken.length,
+                        idTokenSize: result.idToken.length,
+                    },
+                    undefined,
+                    result.account
+                );
                 return result;
             })
             .catch((e: Error) => {
@@ -859,7 +856,8 @@ export class StandardController implements IController {
                     {
                         success: false,
                     },
-                    e
+                    e,
+                    request.account
                 );
 
                 // Since this function is syncronous we need to reject
@@ -918,9 +916,12 @@ export class StandardController implements IController {
         );
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
-            accountType: getAccountType(request.account),
         });
-        preflightCheck(this.initialized, this.ssoSilentMeasurement);
+        preflightCheck(
+            this.initialized,
+            this.ssoSilentMeasurement,
+            request.account
+        );
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
@@ -978,13 +979,16 @@ export class StandardController implements IController {
                         response.account
                     );
                 }
-                this.ssoSilentMeasurement?.end({
-                    success: true,
-                    isNativeBroker: response.fromPlatformBroker,
-                    accessTokenSize: response.accessToken.length,
-                    idTokenSize: response.idToken.length,
-                    accountType: getAccountType(response.account),
-                });
+                this.ssoSilentMeasurement?.end(
+                    {
+                        success: true,
+                        isNativeBroker: response.fromPlatformBroker,
+                        accessTokenSize: response.accessToken.length,
+                        idTokenSize: response.idToken.length,
+                    },
+                    undefined,
+                    response.account
+                );
                 return response;
             })
             .catch((e: Error) => {
@@ -998,7 +1002,8 @@ export class StandardController implements IController {
                     {
                         success: false,
                     },
-                    e
+                    e,
+                    request.account
                 );
                 throw e;
             })
@@ -1062,13 +1067,16 @@ export class StandardController implements IController {
                                 result
                             );
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
-                            atbcMeasurement.end({
-                                success: true,
-                                isNativeBroker: result.fromPlatformBroker,
-                                accessTokenSize: result.accessToken.length,
-                                idTokenSize: result.idToken.length,
-                                accountType: getAccountType(result.account),
-                            });
+                            atbcMeasurement.end(
+                                {
+                                    success: true,
+                                    isNativeBroker: result.fromPlatformBroker,
+                                    accessTokenSize: result.accessToken.length,
+                                    idTokenSize: result.idToken.length,
+                                },
+                                undefined,
+                                result.account
+                            );
                             return result;
                         })
                         .catch((error: Error) => {
@@ -1117,10 +1125,13 @@ export class StandardController implements IController {
                         }
                         throw e;
                     });
-                    atbcMeasurement.end({
-                        accountType: getAccountType(result.account),
-                        success: true,
-                    });
+                    atbcMeasurement.end(
+                        {
+                            success: true,
+                        },
+                        undefined,
+                        result.account
+                    );
                     return result;
                 } else {
                     throw createBrowserAuthError(
@@ -1377,55 +1388,6 @@ export class StandardController implements IController {
         );
     }
 
-    /**
-     * Returns the signed in account matching username.
-     * (the account object is created at the time of successful login)
-     * or null when no matching account is found.
-     * This API is provided for convenience but getAccountById should be used for best reliability
-     * @param username
-     * @returns The account object stored in MSAL
-     */
-    getAccountByUsername(username: string): AccountInfo | null {
-        return AccountManager.getAccountByUsername(
-            username,
-            this.logger,
-            this.browserStorage,
-            this.getRequestCorrelationId()
-        );
-    }
-
-    /**
-     * Returns the signed in account matching homeAccountId.
-     * (the account object is created at the time of successful login)
-     * or null when no matching account is found
-     * @param homeAccountId
-     * @returns The account object stored in MSAL
-     */
-    getAccountByHomeId(homeAccountId: string): AccountInfo | null {
-        return AccountManager.getAccountByHomeId(
-            homeAccountId,
-            this.logger,
-            this.browserStorage,
-            this.getRequestCorrelationId()
-        );
-    }
-
-    /**
-     * Returns the signed in account matching localAccountId.
-     * (the account object is created at the time of successful login)
-     * or null when no matching account is found
-     * @param localAccountId
-     * @returns The account object stored in MSAL
-     */
-    getAccountByLocalId(localAccountId: string): AccountInfo | null {
-        return AccountManager.getAccountByLocalId(
-            localAccountId,
-            this.logger,
-            this.browserStorage,
-            this.getRequestCorrelationId()
-        );
-    }
-
     /**
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
      * @param account
@@ -1475,7 +1437,8 @@ export class StandardController implements IController {
             );
         await this.browserStorage.setAccount(
             accountEntity,
-            result.correlationId
+            result.correlationId,
+            AuthToken.isKmsi(result.idTokenClaims)
         );
 
         if (result.fromPlatformBroker) {
@@ -1901,24 +1864,27 @@ export class StandardController implements IController {
             scenarioId: request.scenarioId,
         });
 
-        preflightCheck(this.initialized, atsMeasurement);
+        preflightCheck(this.initialized, atsMeasurement, request.account);
         this.logger.verbose("acquireTokenSilent called", correlationId);
 
         const account = request.account || this.getActiveAccount();
         if (!account) {
             throw createBrowserAuthError(BrowserAuthErrorCodes.noAccountError);
         }
-        atsMeasurement.add({ accountType: getAccountType(account) });
 
         return this.acquireTokenSilentDeduped(request, account, correlationId)
             .then((result) => {
-                atsMeasurement.end({
-                    success: true,
-                    fromCache: result.fromCache,
-                    isNativeBroker: result.fromPlatformBroker,
-                    accessTokenSize: result.accessToken.length,
-                    idTokenSize: result.idToken.length,
-                });
+                atsMeasurement.end(
+                    {
+                        success: true,
+                        fromCache: result.fromCache,
+                        isNativeBroker: result.fromPlatformBroker,
+                        accessTokenSize: result.accessToken.length,
+                        idTokenSize: result.idToken.length,
+                    },
+                    undefined,
+                    result.account
+                );
                 return {
                     ...result,
                     state: request.state,
@@ -1935,7 +1901,8 @@ export class StandardController implements IController {
                     {
                         success: false,
                     },
-                    error
+                    error,
+                    account
                 );
                 throw error;
             });
@@ -2285,16 +2252,20 @@ export class StandardController implements IController {
     private getPreGeneratedPkceCodes(
         correlationId: string
     ): PkceCodes | undefined {
-        this.logger.verbose(
-            "Attempting to pick up pre-generated PKCE codes",
-            correlationId
-        );
         const res = this.pkceCode ? { ...this.pkceCode } : undefined;
         this.pkceCode = undefined;
-        this.logger.verbose(
-            `'${res ? "Found" : "Did not find"}' pre-generated PKCE codes`,
-            correlationId
-        );
+        if (res) {
+            this.logger.verbose(
+                `Pre-generated PKCE codes were found`,
+                correlationId
+            );
+        } else {
+            this.logger.verbose(
+                `Pre-generated PKCE codes were not found`,
+                correlationId
+            );
+        }
+
         this.performanceClient.addFields(
             { usePreGeneratedPkce: !!res },
             correlationId

package/src/controllers/UnknownOperatingContextController.ts

@@ -5,7 +5,6 @@
 
 import {
     CommonAuthorizationUrlRequest,
-    CommonSilentFlowRequest,
     PerformanceCallbackFunction,
     AccountInfo,
     Logger,
@@ -28,8 +27,8 @@ import { RedirectRequest } from "../request/RedirectRequest.js";
 import { SilentRequest } from "../request/SilentRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { ApiId, WrapperSKU } from "../utils/BrowserConstants.js";
-import { IController, HandleRedirectPromiseOptions } from "./IController.js";
+import { WrapperSKU } from "../utils/BrowserConstants.js";
+import { IController } from "./IController.js";
 import { UnknownOperatingContext } from "../operatingcontext/UnknownOperatingContext.js";
 import { CryptoOps } from "../crypto/CryptoOps.js";
 import {
@@ -40,6 +39,7 @@ import { EventCallbackFunction } from "../event/EventMessage.js";
 import { ClearCacheRequest } from "../request/ClearCacheRequest.js";
 import { EventType } from "../event/EventType.js";
 import { EventHandler } from "../event/EventHandler.js";
+import { HandleRedirectPromiseOptions } from "../request/HandleRedirectPromiseOptions.js";
 
 /**
  * UnknownOperatingContextController class
@@ -120,26 +120,11 @@ export class UnknownOperatingContextController implements IController {
                   this.eventHandler
               );
     }
-    getBrowserStorage(): BrowserCacheManager {
-        return this.browserStorage;
-    }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     getAccount(accountFilter: AccountFilter): AccountInfo | null {
         return null;
     }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    getAccountByHomeId(homeAccountId: string): AccountInfo | null {
-        return null;
-    }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    getAccountByLocalId(localAccountId: string): AccountInfo | null {
-        return null;
-    }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    getAccountByUsername(username: string): AccountInfo | null {
-        return null;
-    }
     getAllAccounts(): AccountInfo[] {
         return [];
     }
@@ -175,40 +160,6 @@ export class UnknownOperatingContextController implements IController {
         blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
-    acquireTokenNative(
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        request:
-            | PopupRequest
-            | SilentRequest
-            | Partial<
-                  Omit<
-                      CommonAuthorizationUrlRequest,
-                      | "responseMode"
-                      | "earJwk"
-                      | "codeChallenge"
-                      | "codeChallengeMethod"
-                      | "platformBroker"
-                  >
-              >,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        apiId: ApiId,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        accountId?: string | undefined
-    ): Promise<AuthenticationResult> {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as Promise<AuthenticationResult>;
-    }
-    acquireTokenByRefreshToken(
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        commonRequest: CommonSilentFlowRequest,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        silentRequest: SilentRequest
-    ): Promise<AuthenticationResult> {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as Promise<AuthenticationResult>;
-    }
     addEventCallback(
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         callback: EventCallbackFunction,
@@ -324,26 +275,6 @@ export class UnknownOperatingContextController implements IController {
     getConfiguration(): BrowserConfiguration {
         return this.config;
     }
-    isBrowserEnv(): boolean {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return true;
-    }
-    getBrowserCrypto(): ICrypto {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as ICrypto;
-    }
-    getPerformanceClient(): IPerformanceClient {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as IPerformanceClient;
-    }
-    getRedirectResponse(): Map<string, Promise<AuthenticationResult | null>> {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as Map<string, Promise<AuthenticationResult | null>>;
-    }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async clearCache(logoutRequest?: ClearCacheRequest): Promise<void> {

package/src/custom_auth/CustomAuthConstants.ts

@@ -12,6 +12,7 @@ export const GrantType = {
     CONTINUATION_TOKEN: "continuation_token",
     REDIRECT: "redirect",
     ATTRIBUTES: "attributes",
+    MFA_OOB: "mfa_oob",
 } as const;
 
 export const ChallengeType = {

package/src/custom_auth/controller/CustomAuthStandardController.ts

@@ -31,6 +31,7 @@ import {
     SIGN_IN_PASSWORD_REQUIRED_RESULT_TYPE,
     SIGN_IN_COMPLETED_RESULT_TYPE,
     SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
+    SIGN_IN_MFA_REQUIRED_RESULT_TYPE,
 } from "../sign_in/interaction_client/result/SignInActionResult.js";
 import { SignUpClient } from "../sign_up/interaction_client/SignUpClient.js";
 import { CustomAuthInterationClientFactory } from "../core/interaction_client/CustomAuthInterationClientFactory.js";
@@ -43,6 +44,7 @@ import { CustomAuthApiClient } from "../core/network_client/custom_auth_api/Cust
 import { FetchHttpClient } from "../core/network_client/http_client/FetchHttpClient.js";
 import { ResetPasswordClient } from "../reset_password/interaction_client/ResetPasswordClient.js";
 import { JitClient } from "../core/interaction_client/jit/JitClient.js";
+import { MfaClient } from "../core/interaction_client/mfa/MfaClient.js";
 import { NoCachedAccountFoundError } from "../core/error/NoCachedAccountFoundError.js";
 import * as ArgumentValidator from "../core/utils/ArgumentValidator.js";
 import { UserAlreadySignedInError } from "../core/error/UserAlreadySignedInError.js";
@@ -52,6 +54,7 @@ import { SignInCodeRequiredState } from "../sign_in/auth_flow/state/SignInCodeRe
 import { SignInPasswordRequiredState } from "../sign_in/auth_flow/state/SignInPasswordRequiredState.js";
 import { SignInCompletedState } from "../sign_in/auth_flow/state/SignInCompletedState.js";
 import { AuthMethodRegistrationRequiredState } from "../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+import { MfaAwaitingState } from "../core/auth_flow/mfa/state/MfaState.js";
 import { SignUpCodeRequiredState } from "../sign_up/auth_flow/state/SignUpCodeRequiredState.js";
 import { SignUpPasswordRequiredState } from "../sign_up/auth_flow/state/SignUpPasswordRequiredState.js";
 import { ResetPasswordCodeRequiredState } from "../reset_password/auth_flow/state/ResetPasswordCodeRequiredState.js";
@@ -68,6 +71,7 @@ export class CustomAuthStandardController
     private readonly signUpClient: SignUpClient;
     private readonly resetPasswordClient: ResetPasswordClient;
     private readonly jitClient: JitClient;
+    private readonly mfaClient: MfaClient;
     private readonly cacheClient: CustomAuthSilentCacheClient;
     private readonly customAuthConfig: CustomAuthBrowserConfiguration;
     private readonly authority: CustomAuthAuthority;
@@ -103,6 +107,7 @@ export class CustomAuthStandardController
             this.networkClient,
             this.browserStorage,
             this.logger,
+            this.performanceClient,
             this.customAuthConfig.customAuth?.authApiProxyUrl
         );
 
@@ -130,6 +135,7 @@ export class CustomAuthStandardController
         this.resetPasswordClient =
             interactionClientFactory.create(ResetPasswordClient);
         this.jitClient = interactionClientFactory.create(JitClient);
+        this.mfaClient = interactionClientFactory.create(MfaClient);
         this.cacheClient = interactionClientFactory.create(
             CustomAuthSilentCacheClient
         );
@@ -243,6 +249,7 @@ export class CustomAuthStandardController
                         signInClient: this.signInClient,
                         cacheClient: this.cacheClient,
                         jitClient: this.jitClient,
+                        mfaClient: this.mfaClient,
                         username: signInInputs.username,
                         codeLength: startResult.codeLength,
                         scopes: signInInputs.scopes ?? [],
@@ -273,6 +280,7 @@ export class CustomAuthStandardController
                             signInClient: this.signInClient,
                             cacheClient: this.cacheClient,
                             jitClient: this.jitClient,
+                            mfaClient: this.mfaClient,
                             username: signInInputs.username,
                             scopes: signInInputs.scopes ?? [],
                             claims: signInInputs.claims,
@@ -345,6 +353,29 @@ export class CustomAuthStandardController
                             claims: signInInputs.claims,
                         })
                     );
+                } else if (
+                    submitPasswordResult.type ===
+                    SIGN_IN_MFA_REQUIRED_RESULT_TYPE
+                ) {
+                    // MFA is required - create MfaAwaitingState
+                    this.logger.verbose(
+                        "MFA required for sign-in.",
+                        correlationId
+                    );
+
+                    return new SignInResult(
+                        new MfaAwaitingState({
+                            correlationId: correlationId,
+                            continuationToken:
+                                submitPasswordResult.continuationToken,
+                            logger: this.logger,
+                            config: this.customAuthConfig,
+                            mfaClient: this.mfaClient,
+                            cacheClient: this.cacheClient,
+                            scopes: signInInputs.scopes ?? [],
+                            authMethods: submitPasswordResult.authMethods ?? [],
+                        })
+                    );
                 } else {
                     // Unexpected result type
                     const result = submitPasswordResult as { type: string };
@@ -438,6 +469,7 @@ export class CustomAuthStandardController
                         signUpClient: this.signUpClient,
                         cacheClient: this.cacheClient,
                         jitClient: this.jitClient,
+                        mfaClient: this.mfaClient,
                         username: signUpInputs.username,
                         codeLength: startResult.codeLength,
                         codeResendInterval: startResult.interval,
@@ -462,6 +494,7 @@ export class CustomAuthStandardController
                         signUpClient: this.signUpClient,
                         cacheClient: this.cacheClient,
                         jitClient: this.jitClient,
+                        mfaClient: this.mfaClient,
                         username: signUpInputs.username,
                     })
                 );
@@ -532,6 +565,7 @@ export class CustomAuthStandardController
                     resetPasswordClient: this.resetPasswordClient,
                     cacheClient: this.cacheClient,
                     jitClient: this.jitClient,
+                    mfaClient: this.mfaClient,
                     username: resetPasswordInputs.username,
                     codeLength: startResult.codeLength,
                 })